Apache access and error logs, field by field

common and combined

mod_log_config documents these format strings. The third one is combined plus %D, the request duration in microseconds, appended at the end:

LogFormat "%h %l %u %t \"%r\" %>s %b" common
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\"" combined
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\" %D" combined_time
CustomLog logs/access_log combined_time

An access log line in combined_time:

198.51.100.7 - - [18/Oct/2026:10:02:31 +0000] "GET /report.php?id=8 HTTP/1.1" 500 612 "-" "Mozilla/5.0" 30001544

Response time: %D, %T and %{UNIT}T

Put the time at the end of the format, after the User-Agent, so every combined field keeps its position and $NF is always the duration. The board detects the number at the end and reads it as %D or %T.

It is the time taken to serve the request, so for a proxied or FastCGI request it includes the time the backend took. If %D is high on PHP or proxy paths, the next place to look is the error log at the same second.

The 2.4 error log

The error log layout is set by ErrorLogFormat. With the default, a line looks like this:

[Sun Oct 18 10:04:30.654321 2026] [core:error] [pid 4123:tid 140230300] [client 198.51.100.7:41900] AH00124: Request exceeded the limit of 10 internal redirects due to probable configuration error.

Counting by module:level and by AH code is the fastest way to see what changed: one new AH code appearing thousands of times is usually the incident.

Apache 2.2 error lines have no module or pid part ([time] [error] [client …] message); the board reads both.

What the board shows for Apache

• Status codes, where errors happen, top paths, top client IPs, who is calling, bytes by path.
• Latency distribution and slowest paths when %D or %T is present.
• A per-minute timeline you can drag; every card and the raw lines follow the selection.
• Scanner probes: requests for wp-login.php, .env, .git/ and similar.
• For the error log: lines per module:level, AH codes, client addresses and a timeline.

Shell one-liners for Apache logs

Tested against a sample combined log with %D appended and a 2.4 error log. File names follow the RHEL-family default (access_log, error_log); Debian and Ubuntu use access.log and error.log.

• Status code distribution.

  awk '{print $9}' access_log | sort | uniq -c | sort -rn

  Copy

• Clients with the most requests.

  cut -d' ' -f1 access_log | sort | uniq -c | sort -rn | head

  Copy

• Which paths get 4xx, and which code.

  awk '$9 ~ /^4/ {print $9, $7}' access_log | sort | uniq -c | sort -rn | head

  Copy

• Five slowest requests in milliseconds, from %D.

  awk '{printf "%.1f ms %s\n", $NF/1000, $7}' access_log | sort -rn | head -5

  Copy

• p95 response time from %D (nearest-rank).

  awk '{print $NF}' access_log | sort -n | awk '{a[NR]=$1} END {i=int(NR*0.95); if (i<NR*0.95) i++; printf "%.1f ms\n", a[i]/1000}'

  Copy

• Average time and request count per path.

  awk '{s[$7]+=$NF; n[$7]++} END {for (p in s) printf "%.1f ms %d %s\n", s[p]/n[p]/1000, n[p], p}' access_log | sort -rn

  Copy

• Requests per minute.

  cut -d[ -f2 access_log | cut -d: -f1-3 | uniq -c

  Copy

• Total response bytes (%b logs a dash for zero, so skip it).

  awk '$10 != "-" {s+=$10} END {printf "%.1f KiB\n", s/1024}' access_log

  Copy

• Error log: lines per module:level.

  grep -oE '^\[[^]]+\] \[[a-z_0-9]+:[a-z0-9]+\]' error_log | awk '{print $NF}' | sort | uniq -c | sort -rn

  Copy

• Error log: most frequent AH message codes.

  grep -oE 'AH[0-9]{5}' error_log | sort | uniq -c | sort -rn | head

  Copy

• Error log: which client addresses trigger errors.

  grep -oE '\[client [0-9a-f.:]+' error_log | awk '{print $2}' | sed -E 's/:[0-9]+$//' | sort | uniq -c | sort -rn | head

  Copy