0

This is an addition to: Understanding Apache's access log

I have an Apache log file with the following (this is from an example data set on the Splunk website):

178.19.3.35 - - [19/Oct/2013:15:23:00] "GET /flower_store/product.screen?product_id=FL-DLH-02 HTTP/1.1" 200 10582 "http://mystore.splunk.com/flower_store/category.screen?category_id=CANDY&JSESSIONID=SD3SL8FF9ADFF9" "Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.0.10) Gecko/20070223 CentOS/1.5.0.10-0.1.el4.centos Firefox/1.5.0.10" 2258 3329

What is not explained in the above post or in the Apache log help is the 2258 3329 at the very end of this block. What do those numbers mean?

Community
  • 1
  • 1
RedRaven
  • 725
  • 2
  • 18
  • 33
  • https://httpd.apache.org/docs/1.3/logs.html#common may be useful reference. After 200 is probably the size of the file being downloaded. The two final numbers, I'm not sure.. – Devin Rhode Jan 26 '21 at 19:54
  • You can verify the number after 200 is the file size by downloading the file, and then check how large the file is – Devin Rhode Jan 27 '21 at 03:39

1 Answers1

1

Log file format can be customized in almost any way, so the only way to be sure what those numbers might mean is to check the server configuration.

  1. Open httpd.conf
  2. Find LogFormat
  3. Check Format Strings for the meaning
Astralized
  • 46
  • 2