Log files

The access logs we keep for you are in the NCSA "combined log" format where each line contains a single request to the server.

An example entry, with an explanation for each part of the data is shown below

195.092.194.011 - - [05/Oct/2000:20:28:15 +0100] "GET /gizmos.htm HTTP/1.1" 200 2504 "http://search.netscape.com/cgi-bin/search?cp=nsiwidsrc&search=widgets&x=9&y=2" "Mozilla/4.0 (compatible; MSIE 5.01; Windows 95; FREESERVE_IE5)"

So what does it all mean?

195.092.194.011 - - [05/Oct/2000:20:28:15 +0100] "GET /gizmos.htm HTTP/1.1" 200 2504 "http://search.netscape.com/cgi-bin/search?cp=nsiwidsrc&search=widgets&x=9&y=2" "Mozilla/4.0 (compatible; MSIE 5.01; Windows 95; FREESERVE_IE5)"

The first entry is the user's IP address, the identity number of the computer they use to connect to the internet (if you want to get really technical, the format is known as the "dotted octet notation"). Usually this is the address of the server belonging to their Internet Service Provider (ISP), although many businesses now have their own servers. As computers work in numbers, not words the users server will usually announce itself with its identity number which is not really very helpful.

Fortunately, many (but not all) of them are also given an alias called a 'Hostname' which is a bit more meaningful to us mortals. Unfortunately, the server hosting the web site has to ask for this information which takes a fair bit of processing power and slows everything down so we keep this option turned off.

All is not lost! There are some very good (and free) programs available that allow you to look up an IP address and find out the hostname, any log analysis program worth its salt will also have this feature.

So, just who is '195.092.194.011'? The hostname is 'webcache01p.cache.pol.co.uk' - FreeServe to you and me.

195.092.194.011 - - [05/Oct/2000:20:28:15 +0100] "GET /gizmos.htm HTTP/1.1" 200 2504 "http://search.netscape.com/cgi-bin/search?cp=nsiwidsrc&search=widgets&x=9&y=2" "Mozilla/4.0 (compatible; MSIE 5.01; Windows 95; FREESERVE_IE5)"

The next two entries are only used if the visitor had to supply a user name and password to access a restricted part of the site.

The first one is for the user's password. This will always be a dash for security and privacy reasons.

The second one is 'authuser', the log-in name they used to gain access to the site. If you do have a section of your site password protected, checking the 'authuser' against the IP address will give you an indication that someone's log-in details may have been compromised.

195.092.194.011 - - [05/Oct/2000:20:28:15 +0100] "GET /gizmos.htm HTTP/1.1" 200 2504 "http://search.netscape.com/cgi-bin/search?cp=nsiwidsrc&search=widgets&x=9&y=2" "Mozilla/4.0 (compatible; MSIE 5.01; Windows 95; FREESERVE_IE5)"

The next part is fairly straight forward. It is the date and time of the visit plus the offset from (usually) GMT.

195.092.194.011 - - [05/Oct/2000:20:28:15 +0100] "GET /gizmos.htm HTTP/1.1" 200 2504 "http://search.netscape.com/cgi-bin/search?cp=nsiwidsrc&search=widgets&x=9&y=2" "Mozilla/4.0 (compatible; MSIE 5.01; Windows 95; FREESERVE_IE5)"

This indicates that the user told his browser to 'get' the file. If they used an e-mail form on the web site to send you a message this will be 'POST'. You may also sometimes see 'HEAD', usually this is a request from a search engine 'spider' coming round to check over your site.

195.092.194.011 - - [05/Oct/2000:20:28:15 +0100] "GET /gizmos.htm HTTP/1.1" 200 2504 "http://search.netscape.com/cgi-bin/search?cp=nsiwidsrc&search=widgets&x=9&y=2" "Mozilla/4.0 (compatible; MSIE 5.01; Windows 95; FREESERVE_IE5)"

This is the name of the file the user asked for. If this is blank or just '/' it means no specific file name was given in which case the server will send the index (home) page.

195.092.194.011 - - [05/Oct/2000:20:28:15 +0100] "GET /gizmos.htm HTTP/1.1" 200 2504 "http://search.netscape.com/cgi-bin/search?cp=nsiwidsrc&search=widgets&x=9&y=2" "Mozilla/4.0 (compatible; MSIE 5.01; Windows 95; FREESERVE_IE5)"

Stands for HyperText Transfer Protocol version 1.1 - it is the file transfer method, don't worry about it.

195.092.194.011 - - [05/Oct/2000:20:28:15 +0100] "GET /gizmos.htm HTTP/1.1" 200 2504 "http://search.netscape.com/cgi-bin/search?cp=nsiwidsrc&search=widgets&x=9&y=2" "Mozilla/4.0 (compatible; MSIE 5.01; Windows 95; FREESERVE_IE5)"

Next comes the status code - in this case indicating the file was transferred OK. Other status codes you may see are:

202 - Accepted
206 - Partial content
304 - Not modified since last retrieval. Use cached copy
400 - Bad request
401 - Requires a password
403 - Access forbidden
404 - Not found
500 - Server error
501 - Not Implemented
502 - Bad Gateway
503 - Service Unavailable

195.092.194.011 - - [05/Oct/2000:20:28:15 +0100] "GET /gizmos.htm HTTP/1.1" 200 2504 "http://search.netscape.com/cgi-bin/search?cp=nsiwidsrc&search=widgets&x=9&y=2" "Mozilla/4.0 (compatible; MSIE 5.01; Windows 95; FREESERVE_IE5)"

This is the bit you're really interested in. It is the referring page, i.e. the page they came from. If the user arrived via a search engine this usually contains a lot of information that is only of any use to the search engine but you will usually see a sub-string beginning with 'search' or 'query' followed by the search term(s) the user entered. In this case the user had done a search for "widgets" on the Netscape search engine, been offered a link to 'gizmos.htm and had clicked on it to have a look. Checking to see where the users came from and what search terms they used can help you work out who is linking to your site and where it may need altering to attract more visitors.

195.092.194.011 - - [05/Oct/2000:20:28:15 +0100] "GET /gizmos.htm HTTP/1.1" 200 2504 "http://search.netscape.com/cgi-bin/search?cp=nsiwidsrc&search=widgets&x=9&y=2" "Mozilla/4.0 (compatible; MSIE 5.01; Windows 95; FREESERVE_IE5)"

The final entry tells you which browser and operating system the visitor was using. 'Mozilla' is the code name for Netscape which led the way in browser development. The visitor was actually using the FreeServe edition of Microsoft Internet Explorer 5.01 which claims to be compatible with Netscape Navigator 4.0. Their pc was using the Windows95 operating system.