apache访问日志

apacha在用户访问网站是记录了用户的访问日志，访问行为等等，这些都可以通过日志来查看相关信息。

• 查看apache配置文件关于logs的信息
  
  log的两种配置，common与combined，系统默认使用第二种配置（common）
  h–>来源ip
  l–>用户
  u–>用户名和密码
  t–>时间
  r–>行为
  s–>状态码
  b–>大小
  User-Agent–>用户代理（即通过哪种形式访问，即使用浏览器还是curl命令等）
  Referer–>进入该网站的上一条网站信息，即在百度中搜索了linux后进入了linux开源社区网站，则在linux开源社区网站服务器上会记录百度搜索linux后结果的网站，即Referer。
• 查看为修改前访问日志

• 修改虚拟主机中配置
  [root@zhounan1 ~]# vim /usr/local/apache2.4/conf/extra/httpd-vhosts.conf
  修改conmon为combined即可
• 刷新配置文件后登录网站后在查看日志

[root@zhounan1 ~]# /usr/local/apache2.4/bin/apachectl -t
Syntax OK
[root@zhounan1 ~]# /usr/local/apache2.4/bin/apachectl graceful

第一部分为apache默认日志配置
第二部分为修改的combined日志配置

[root@zhounan1 ~]# tail -n15 /usr/local/apache2.4/logs/phpems.com-access_log 
192.168.131.1 - - [06/Dec/2018:22:23:48 +0800] "GET / HTTP/1.1" 301 226
192.168.131.1 - - [06/Dec/2018:22:23:48 +0800] "GET / HTTP/1.1" 200 8
192.168.131.1 - - [06/Dec/2018:22:23:48 +0800] "GET /favicon.ico HTTP/1.1" 404 209
192.168.131.1 - - [06/Dec/2018:22:24:16 +0800] "GET / HTTP/1.1" 200 8
192.168.131.1 - - [06/Dec/2018:22:24:16 +0800] "GET /favicon.ico HTTP/1.1" 404 209
192.168.131.1 - - [07/Dec/2018:01:26:01 +0800] "GET / HTTP/1.1" 301 226 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:63.0) Gecko/20100101 Firefox/63.0"
192.168.131.1 - - [07/Dec/2018:01:26:01 +0800] "GET / HTTP/1.1" 200 8 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:63.0) Gecko/20100101 Firefox/63.0"
192.168.131.1 - - [07/Dec/2018:01:26:01 +0800] "GET /favicon.ico HTTP/1.1" 404 209 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:63.0) Gecko/20100101 Firefox/63.0"
192.168.131.10 - - [07/Dec/2018:01:27:32 +0800] "GET HTTP://www.zhounan.com/admin.php HTTP/1.1" 301 235 "-" "curl/7.29.0"
192.168.131.10 - - [07/Dec/2018:01:27:39 +0800] "HEAD HTTP://www.zhounan.com/admin.php HTTP/1.1" 301 - "-" "curl/7.29.0"
192.168.131.1 - - [07/Dec/2018:01:30:48 +0800] "GET / HTTP/1.1" 301 226 "http://ask.apelearn.com/question/18429" "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko"
192.168.131.1 - - [07/Dec/2018:01:30:48 +0800] "GET / HTTP/1.1" 200 8 "http://ask.apelearn.com/question/18429" "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko"
192.168.131.1 - - [07/Dec/2018:01:30:48 +0800] "GET /favicon.ico HTTP/1.1" 404 209 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko"
192.168.131.1 - - [07/Dec/2018:01:30:48 +0800] "GET /favicon.ico HTTP/1.1" 301 237 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko"
192.168.131.1 - - [07/Dec/2018:01:30:48 +0800] "GET /favicon.ico HTTP/1.1" 404 209 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko"
[root@zhounan1 ~]# 

第一部分22点的logs为conmon配置格式
第二部分为1：30左右的logs为combined配置格式
下一条为从ask.apelearn.com论坛发帖通过点击帖子内容及网站域名www.zhounan.com跳转到phpems.com下记录的Referer

192.168.131.1 - - [07/Dec/2018:01:30:48 +0800] "GET / HTTP/1.1" 200 8 "http://ask.apelearn.com/question/18429" "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko"