28/01/10

Error logs
  - record important events
  - compulsory
  - decisions
    - where to log using ErrorLog directive, e.g.
        ErrorLog logs/error_log
    - which events to log using the LogLevel directive, e.g.
        LogLevel crit

Transfer logs
  - most common is an access log: logs info about each client request and its response
  - needs mod_log_config
  - decisions
    - whether to log
    - what data to log
    - where to log	

  Where to log
    - using TransferLog directive, e.g.
        TransferLog logs/access_log
  
  What data to log
  - default is Common Log Format

    host ident authuser [date] "request" status bytes
    
    - host is hostname of client but this is not sent by client; IP adddres is used instead
      If you want the hostname
        HostNameLookups on
      means server will do a reverse DNS lookup for each client IP address
      Or
        HostNameLookups double
      does a reverse and forward DNS lookup to help detect DNS spoofing attacks
      But the cost is high, and it may still fail to find hostname
      Best to leave it off (default)
      
   - ident is userid of client; will usually be -
     If you want to see it,
        - needs mod_ident
        - And
            IdentityCheck on
     Then server will send a request to client, asking for userid
     If client is running an identd server, it can respond with user's id, which server
     can then include in the log
     But (a) cost is high; (b) almost no client runs identd; (c) you cannot trust the info
     anyway.
     Best to leave it off (default)
     
  - authuser: if the request was for a password-protected page, this is the userid supplied
  
  - date
  
  - request, e.g. "GET /index.html HTTP/1.1"
  
  - status: response code, e.g. 200 or 404
  
  - bytes: size of the response
  
  You can define your own log format (look up details in manual if interested), e.g.
    LogFormat "%t %r %>s %b"
  This logs date, request, final status and number of bytes
  You can extract extra headers from the client's request to include them in what you log, e.g.
    LogFormat "%t %r %>s %b %{Referer}i %{User-Agent}i"
    
  Whether to log
    - You may not want to log every request
    -  E.g. you want to log requests for web pages but not for images
    - Needs mod_env and mod_setenvif
        LogFormat "%t %r %>s %b %{Referer}i %{User-Agent}i" mylogformat
        SetEnvIf Request_URI "(\.gif|\.jpg|\.png)$" image
        CustomLog ogs/mylog mylogformat env=!image