Transaction Logging

Transaction logging records the activity that takes place on your server every day. The server stores this information in log files that are kept in the log file directory. Using the Remote Server Management (RSM) feature of Purveyor, you can manage how logging is performed.

How does Transaction Logging Work?

A server gathers logging information at frequencies you specify and stores the information in log files. The file name syntax corresponds to the frequency at which the files are created. For example, if your server creates log files on a daily basis, the name for the file created on 21 August 1996 would be HS960821 (year, month, then day). The server keeps the current log file open until the first HTTP transaction takes place the following day.

When this first transaction occurs, the server closes the previous day’s log file and opens a new one. The server then logs the transaction to the new log file.

The log file records any or all of the following information, depending upon the selections you choose using RSM.:

Time and date of the request

IP address or domain name of the server

IP address or domain name of the client

HTTP command

URL requested

Version of the HTTP protocol used

What is the Log File Format?

The log file is an ASCII file having this format:

remotehost logonid authname [date] request status bytes

remotehost is the IP address of the remote client. If you enable DNS lookup, this field contains the remote client host name instead.
Logonid is always a hyphen (-).
date is the date and time at which the request was issued.
request is the HTTP request as received by the server.
Status is the status code returned to the client, if known, or a hyphen if otherwise.
Bytes is the number of data bytes transmitted to the client in satisfying this request (excluding the HTTP headers), or a hyphen if this in unknown.

If DNS lookup is enabled, Purveyor resolves the IP address of the client to a domain name. This is useful for logging purposes. However, it may slow down the server slightly.

Purveyor allows you to modify this format by creating and modifying templates that specify what information the server saves in the log and the sequence it uses to record information.

The server controls the log file format by using a log template string. You can reconfigure the log template string. The server logs the logging template in to the log file when the server creates a new log file or whenever the user changes the logging template.

The Log Template

The log template can contain a number of formatting commands. Each command starts with a percent (%) character. A single upper- or lowercase letter follows the character.

Case is significant in the log template.

When the server writes a log file entry, the server replaces each formatting command in the template by the corresponding parameters:

Time-related
Name and address
Transaction information
Logging HTTP headers
Default template

The server copies other information in the template to the log file entry without a change. If a particular parameter is unavailable, the server represents it as a hyphen (-) in the log file entry.

The server writes the log template string itself to the log file every time:

The server starts.
The user reconfigures the server.
The server creates a new log file.

This helps programs that analyze log files to produce statistics.

Time-related Parameters

The server records the time when it receives, not completes, the request. The server logs the transaction in the log file when the transaction is complete. This means that entries can appear in the log file in an unexpected order. Table 13 lists the time-related codes and their meanings.

Table 13 Time-related Parameters

Code

Description

%a

Weekday name (abbreviated)

%A

Weekday name (full)

%b

Month name (abbreviated)

%B

Month name (full)

%c

"Short" date and time representation appropriate to the server's locale

%d

Day of the month as a two-digit number (01 to 31)

%H

Hour as a two-digit number (24-hour format: 00 to 23)

%I

Hour as a two-digit number (12-hour format: 00 to 11)

%j

Day of the year as a three-digit number (001 to 366)

%m

Month as a two-digit number (01 to 12)

%M

Minute as a two-digit number (00 to 59)

%O

Offset of local time from GMT in the format +hhmm.

%p

AM/PM indicator (appropriate to server's locale) for a 12-hour clock

%S

Second as a two-digit number (00 to 59)

%t

Subsequent time commands in the template refer to local time.

%T

Subsequent time commands in the template refer to GMT.

%U

Week of the year as a two-digit number (00 to 51), counting Sunday as the first day of the week

%w

Weekday as a single-digit number (0 to 6), counting Sunday as the first day of the week

%W

Week of the year as a two-digit number, with Monday as the first day of the week (00-51)

%X

Time representation appropriate to server's locale

%y

Year as a two-digit number (00 to 99).

%Y

Year as a four-digit number.

%z, %Z

Server's time zone name or abbreviation

All time is presented as local time. The %O and %T parameters are ignored. The %z and %Z parameters return empty because the time zone in unknown.

Name and Address Parameters

Table 14 lists the log template name and address parameters and their meanings.

Table 14 Log Template Name and Address Parameters

Parameter

Description

%l

The IP address belonging to the server on which the request was received

%L

The host name corresponding the %l.

%r

The IP address of the client who sent the request

%R

The host name corresponding to %r, or the IP address itself if the host name cannot be determined

Transaction Information Parameters

Table 15 lists the log template transaction information parameters and their meanings.

Table 15 Log Template Transaction Information Parameters

Parameter

Description

%e

The realm to which the authenticated user name belongs

%f

User information, such as from a CGI DLL

%I

The user identity as obtained using the RFC931 protocol. Most servers, including Purveyor, do not implement this protocol so the commands always returns a hyphen.

%n

Number of bytes sent to the client (excluding HTTP headers)

%q

The complete HTTP request received from the client, including the HTTP method, the URL requested, and the HTTP version number

%Q

The full name of the file directory to which the URL maps

%s

The HTTP status code returned to the client

%u

The authenticated user name

Logging HTTP Headers Parameter

The server can log arbitrary HTTP request headers. The parameter is %:header:

header is the name of the HTTP header.

For example, %:User-agent: records in the log file the User-agent header from the client request.

Header names are not case sensitive.

Default Template Parameter

The default log template corresponds to the CommonLogfile Format used by many other HTTP servers. It is:
%r %i %u [%d/%b/%Y:%H:%M:%S %O] "%q" %s %n

The parameter meanings are described in Table 16.

Table 16 Common Logfile Format

Parameter

Meaning

%r

The IP address of the client sending the request

%i

The user identity as obtained using the RFC931 protocol. Most servers, including Purveyor, do not implement this protocol, so the command always returns a hyphen.

%u

The authenticated user name

[%d/

A square bracket ([) followed by the day of the month as a two-digit number (01 to 31), then a slash

%b/

The month name, abbreviated, then a slash

%Y:

The year as a two-digit number (00 to 99), then a colon

%H:

The hour as a two-digit number (24-hour format, 00 to 23), then a colon

%M:

The minute as a two-digit number (00 to 59), then a colon

%S

The second as a two-digit number, then a space

%O]

The offset of local time from GMT in the format +hhmm, then a closing square bracket (])

"%q"

A quotation mark, then the complete HTTP request received from the client, including the HTTP method, the URL requested, and the HTTP version number, and then another quotation mark

%s

The HTTP status code returned to the client

%n

The number of bytes sent to the client (excluding HTTP headers)

Code	Description
%a	Weekday name (abbreviated)
%A	Weekday name (full)
%b	Month name (abbreviated)
%B	Month name (full)
%c	"Short" date and time representation appropriate to the server's locale
%d	Day of the month as a two-digit number (01 to 31)
%H	Hour as a two-digit number (24-hour format: 00 to 23)
%I	Hour as a two-digit number (12-hour format: 00 to 11)
%j	Day of the year as a three-digit number (001 to 366)
%m	Month as a two-digit number (01 to 12)
%M	Minute as a two-digit number (00 to 59)
%O	Offset of local time from GMT in the format +hhmm.
%p	AM/PM indicator (appropriate to server's locale) for a 12-hour clock
%S	Second as a two-digit number (00 to 59)
%t	Subsequent time commands in the template refer to local time.
%T	Subsequent time commands in the template refer to GMT.
%U	Week of the year as a two-digit number (00 to 51), counting Sunday as the first day of the week
%w	Weekday as a single-digit number (0 to 6), counting Sunday as the first day of the week
%W	Week of the year as a two-digit number, with Monday as the first day of the week (00-51)
%X	Time representation appropriate to server's locale
%y	Year as a two-digit number (00 to 99).
%Y	Year as a four-digit number.
%z, %Z	Server's time zone name or abbreviation

Parameter	Description
%l	The IP address belonging to the server on which the request was received
%L	The host name corresponding the %l.
%r	The IP address of the client who sent the request
%R	The host name corresponding to %r, or the IP address itself if the host name cannot be determined

Parameter	Description
%e	The realm to which the authenticated user name belongs
%f	User information, such as from a CGI DLL
%I	The user identity as obtained using the RFC931 protocol. Most servers, including Purveyor, do not implement this protocol so the commands always returns a hyphen.
%n	Number of bytes sent to the client (excluding HTTP headers)
%q	The complete HTTP request received from the client, including the HTTP method, the URL requested, and the HTTP version number
%Q	The full name of the file directory to which the URL maps
%s	The HTTP status code returned to the client
%u	The authenticated user name

Parameter	Meaning
%r	The IP address of the client sending the request
%i	The user identity as obtained using the RFC931 protocol. Most servers, including Purveyor, do not implement this protocol, so the command always returns a hyphen.
%u	The authenticated user name
[%d/	A square bracket ([) followed by the day of the month as a two-digit number (01 to 31), then a slash
%b/	The month name, abbreviated, then a slash
%Y:	The year as a two-digit number (00 to 99), then a colon
%H:	The hour as a two-digit number (24-hour format, 00 to 23), then a colon
%M:	The minute as a two-digit number (00 to 59), then a colon
%S	The second as a two-digit number, then a space
%O]	The offset of local time from GMT in the format +hhmm, then a closing square bracket (])
"%q"	A quotation mark, then the complete HTTP request received from the client, including the HTTP method, the URL requested, and the HTTP version number, and then another quotation mark
%s	The HTTP status code returned to the client
%n	The number of bytes sent to the client (excluding HTTP headers)