Understanding an access log entry

Discussion in 'Apache' started by eazyigz, Mar 31, 2010.

0
  1. #1
    Hi,
    I have an access log with the following entry:
    10.250.17.236 - - [05/Mar/2010:15:04:55 -0500] "GET /img/closelabel.gif HTTP/1.0" 200 979 "70.151.125.19" "http://inform.com/animal-cruelty" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30; InfoPath.1; .NET CLR 3.0.04506.648; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)"
    Code (markup):
    I believe that this is an extended/combined log format. What I do not understand is what the "70.151.125.19" address means. Is it the referrer? If so, then what is the "http://inform.com/animal-cruelty" value, isn't that a referrer too?

    Thanks,
    Igor
     
    eazyigz, Mar 31, 2010 IP
  2. Axcell

    Axcell Active Member

    Messages:
    128
    Likes Received:
    2
    Best Answers:
    0
    Trophy Points:
    73
    #2
    70.151.125.19 mean the visitor IP address
     
    Axcell, Apr 1, 2010 IP
  3. zacharooni

    zacharooni Well-Known Member

    Messages:
    346
    Likes Received:
    20
    Best Answers:
    4
    Trophy Points:
    120
    #3
    Actually, it looks like your site is being accessed via your LAN from 10.250.17.236.

    What does your LogFormat look like in httpd.conf?
     
    zacharooni, Apr 1, 2010 IP
  4. eazyigz

    eazyigz Peon

    Messages:
    2
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    0
    #4
    Axcell: thank you. I wasn't sure what that number correlated to in the combined or extended log formats. I still don't see the correlation though...

    zacharooni: 10.250.17.236 is an address of one of our internal servers. I assume it is the one that handled the request (no reverse proxy). My httpd.conf it is set up to use 'Combined' for LogFormat. And the specification of the Combined log format doesn't have a placeholder for a client's ip address. Am I missing something?
     
    eazyigz, Apr 1, 2010 IP