I am building a log parser in PHP and have trouble with apache error log format. With access log, it's easy to see the default LogFormat in apache config file then check in my virtual hosts for any customization.

But with error log, I can't find anything in apache config, and I have no custom ErrorLogFormat directive anywhere.

Why I want to check it is because the documentation confuses me. Here are some examples of ErrorLogFormat directive from apache documentation:

#Simple example
ErrorLogFormat "[%t] [%l] [pid %P] %F: %E: [client %a] %M"
#Example (similar to the 2.2.x format)
ErrorLogFormat "[%t] [%l] %7F: %E: [client\ %a] %M% ,\ referer\ %{Referer}i"
#Example (default format for threaded MPMs)
ErrorLogFormat "[%{u}t] [%-m:%l] [pid %P:tid %T] %7F: %E: [client\ %a] %M% ,\ referer\ %{Referer}i"

And below two examples of logs lines I see on my own server (apache 2.4):

[Sun Sep 27 07:45:01.899495 2020] [ssl:error] [pid 23080] AH01941: stapling_renew_response: responder error
[Wed Sep 30 20:56:31.065219 2020] [reqtimeout:info] [pid 7079] [client x.x.x.x:59452] AH01382: Request header read timeout

This part %F: %E: [client %a] (ie: fileName, errorCode, clientIP), (or at least %E: [client %a], I can't find any example with filename) seems to be inverted. My parser would be able to catch the error code in the two log lines above (AH01941 and AH01382) if I consider my own ErrorLogFormat is [%{u}t] [%-m:%l] [pid %P] [client %a] %F: %E: %M.

But if I follow the documentation and set: [%{u}t] [%-m:%l] [pid %P] %F: %E: [client %a] %M, then the second line (with clientIP) will have no errorCode and a message (%M) containing the error code: AH01382: Request header read timeout.

So how / where can I get the current ErrorLogFormat ?

  • I normally use one log managment solution to converted log into user firendly format suche as splunk or logstash . Don't waste your time in something developed before Oct 1 '20 at 21:03
  • My guess is sometimes an error message does not have a specific client ip.
    – ezra-s
    Oct 1 '20 at 22:28
  • @ezra-s You are right, this field can be missing depending on error, thanks for paying attention. What is not clear for me is the place of that field when existing: I would say before errorcode from what I see in my logs and in all log lines exemples on internet, but the official documentation lets me think it should be after errorcode. Maybe a mistake in the doc?
    – Chris
    Oct 2 '20 at 10:46
  • 1
    @Chris What the doc says is ErrorLog is for "additional info for the logs", maybe you should not specify the client ip in the error to try to make the log messages more homogeneous, also doc mentions about specifying ErrorLogFormat for request or connection. If I were you I would play with those settings as well as the "invaluable" "%L", which creates some sort of a unique hash value associated with the request and the error that triggers it and can be specified aslso for access.log, so to locate associated error/access log you just have to grep for that value.
    – ezra-s
    Oct 5 '20 at 16:55
  • 1
    @ezra-s Maybe my question is not clear, sorry for that. My log parser works fine when I consider the %a field (when existing) will appear before the %E. Here is the log format I set in my app (not apache) and that works with my apache 2.4.38 logs: [%{u}t] [%-m:%l] [pid %P:tid %T] [client %a] %F: %E: %M ,\ referer\ %{Referer}i". I have made no change to ErrorLogFormat and I don't want to change it to not break my app but you give a way and ideas to make tests elsewhere. Thanks again
    – Chris
    Oct 5 '20 at 19:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.