Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Let's say my apache config contains the following

CookieTracking on
CookieName userfault

LogFormat "%{userfault}C" userfaultlog
CustomLog /var/log/ userfaultlog

I see that the log then contains lines with IP.somenumber, e.g.

I'd like to know the specifications for this number, more specifically how it can be stored in the most efficient way. I looked around and could only find the default CookieStyle is 'Netscape', but that didn't get me much further.

Can I safely assume it will fit in a 64bit number? Is it even a number (and decimal at that)?

share|improve this question
up vote 1 down vote accepted

The document for the Netscape Cookie Spec is here: . What you're logging is the content of the cookie. For example in my site I have:


I think the number is a timestamp or expire date.


In the source code of mod_usertrack, you can find how the cookie ID is generated. The comments say:

Make Cookie: Now we have to generate something that is going to be pretty unique. We can base it on the pid, time, hostip

So the number we see is a unique ID for tracking the cookie.

share|improve this answer
I think it's some sort of timestamp too, but I'd like to know the exact format, the link you provided is helpfull, but doesn't touch that either... – Pieter Aug 25 '09 at 10:09
Got it. I've updated my answer. – HD. Aug 25 '09 at 19:28
thanks alot, somehow didn't occur to me to dig in the source code...for anyone else: the number trailing the IP is generated by apr_time_now(), which returns a 64 bit timestamp (microseconds since epoch) – Pieter Sep 1 '09 at 13:52

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.