Apache/NCSA Combined Log Format

A "combined" log file format is like this:
216.67.1.91 - leon [01/Jul/2002:12:11:52 +0000] "GET /index.html HTTP/1.1" 200 431"http://www.loganalyzer.net/" "Mozilla/4.05 [en] (WinNT; I)" "USERID=CustomerA;IMPID=01234"

The following are the fields in Combined log format (with the three additional fields shown in bold):

host rfc931 username date:time request statuscode bytes referrer user_agent cookie

The following is a description of the fields in the fields in the Combined log format:

host (216.67.1.91 in the example)
     The IP address or host/subdomain name of the HTTP client that made the HTTP resource request.

rfc931 ("-" in the example)
     The identifier used to identify the client making the HTTP request. If no value is present, a "-" is substituted.

username (leon in the example)
     The username, (or user ID) used by the client for authentication. If no value is present, a "-" is substituted.

date:time ([01/Jul/2002:12:11:52 +0000] in the example)
     The date and time stamp of the HTTP request.
     The fields in the date/time field are: [dd/MMM/yyyy:hh:mm:ss +-hhmm]
     where the fields are defined as follow:

     dd is the day of the month
     MMM is the month
     yyy is the year
     :hh is the hour
     :mm is the minute
     :ss is the seconds
     +-hhmm is the time zone

In practice, the day is typically logged in two-digit format even for single-digit days. For example, the second day of the month would be represented as 02. However, some HTTP servers do log a single digit day as a single digit. When parsing log records, you should be aware of both possible day representations.

	request ("GET /index.html HTTP/1.1" in the example)
	The HTTP request. The request field contains three pieces of information. The main piece is the requested resource (index.html). The request field also contains the HTTP method (GET) and the HTTP protocol version (1.1).
	statuscode (200 in the example)
	The status is the numeric code indicating the success or failure of the HTTP request.
	bytes (431 in the example)
	The bytes field is a numeric field containing the number of bytes of data transferred as part of the HTTP request, not including the HTTP header.
	referrer ("http://www.loganalyzer.net/" in the example)
	The URL which linked the user to your site. (Optional)
	user_agent ("Mozilla/4.05 [en] (WinNT; I)" in the example)
	The Web browser and platform used by the visitor to your site.(Optional)
	cookies ("USERID=CustomerA;IMPID=01234" in the example)
	Cookies are pieces of information that the HTTP server can send back to client along the with the requested resources. A client's browser may store this information and subsequently send it back to the HTTP server upon making additional resource requests. The HTTP server can establish multiple cookies per HTTP request.