How to Configure Custom Log Formats in Apache

This guide provides a straightforward walkthrough for configuring custom log formats in the Apache HTTP Server. By modifying the LogFormat and CustomLog directives within your Apache configuration files, you can tailor your access logs to capture specific data points—such as response times, custom headers, and detailed client information—that are essential for effective debugging, security auditing, and traffic analysis.

Locating the Configuration Files

Before making any changes, you need to access the main Apache configuration file. The location varies depending on your operating system:

You may also apply these changes within specific Virtual Host configuration files, typically located in /etc/apache2/sites-available/ or /etc/httpd/conf.d/.

Defining a Custom Format with LogFormat

The LogFormat directive defines the structure and the information that Apache will record. It takes two arguments: a string containing format nicknames/variables, and a nickname to identify that specific format style.

The syntax follows this structure: LogFormat "format_string" nickname

Here is an example of defining a custom format that captures the client’s IP, the request timestamp, the first line of the request, the status code, and the time taken to serve the request in microseconds (%D):

LogFormat "%h %t \"%r\" %>s %D" detailed_custom

Commonly used format strings include:

Applying the Custom Format with CustomLog

Once your format is defined and named via LogFormat, you must instruct Apache to use it for a specific log file using the CustomLog directive.

The syntax requires the path to the log file and the nickname of the format you defined: CustomLog /var/log/apache2/custom_access.log detailed_custom

Verifying and Restarting Apache

To ensure there are no syntax errors in your new configuration, run the Apache configuration test command:

If the output reads “Syntax OK”, restart the Apache service to apply the changes:

Your Apache server will now begin logging incoming traffic to the specified file using your newly defined custom format structure.