Using a server log file

A standard HTTP server log entry may look like this:

193.63.182.194 [03/March/2001:11:30:35]
‘GET/webguidelines/index.htm HTTP/1.0’ 200 35000

What this means:

• 193.63.182.194 is in principle the IP number of the client’s (the visitor’s) host name or computer making the request. In fact it may actually be the IP number of a ‘proxy’ device that made the HTTP request on behalf of the real user. Such devices include the web content caching appliances that ISPs are increasingly deploying (‘perimeter caches’) and the firewalls that are typically deployed between corporate networks and the Internet. See section 1.4.5 Not the whole picture!

• 03/March/2001 indicates the date of the access.

• 11:30:35 indicates the time (hours:minutes:seconds) of the access.

• ‘GET/webguidelines/index.htm HTTP/1.0’ is the request that the browser sent to the server.

• 200 is the HTTP status code with which the request completed (code 200 means that the file was served successfully. See annex I Common HTTP server status codes.

• 35000 is the size in bytes of the file that was transferred to the client’s browser.

Depending upon the logging capabilities of the web server software and how the web server logging has been configured, web server logs may contain a large amount of additional information such as:

• HTTP_REFERRER this records the URL of the web page that referred the visitor to the current page. This actually records how a user (client) makes their way through your website.

• USER_AGENT this records the program name and version number of the browser that the user (client) employed. For example, Microsoft Internet Explorer/4.04 (Windows 95).