Access Log

The WebMaster uses the access log to track every attempt to access the server, even failed attempts. This information can be useful for many different reasons. It can be used to determine which pages are being hit the most and perhaps where bad links exist (in the cases where unsuccessful attempts are reported). The access log has two different formats. The format used is dependent upon the file system the log is configured within. For every file system other than the QSYS file system the log file is a text file with its format conforming to the defacto standard put in place by the web server industry. By following this standard format it has made it easier for the WebMaster to obtain industry standard tools to help analyze the data. If the log file is configured for the QSYS file system the file is a Data Base file which contains a superset of the data stored within the text format. In either format if the file exists prior to starting the server the file will be appended to. If the file does not exist it will be created.

The access log is a file created using the Access Log Filename configuration value. Access logging can be disabled by specifying a blank access log filename within the master configuration file, or by specifying a '*none' value within the CHGWWWCFG command.

Access Log Text File Format

The following is the format of an access log entry.

Internet Address - User Name [Date and time stamp] "Req type URL HTTP level" Status code Bytes Transferred

Internet Address

The internet address of the host machine requesting the URL. This would be in the form of a host name if one is available.

User Name

The user name passed in the authentication header of the request.

Date and Time stamp

The format of the date and time stamp is [DD/Mth/Year:hr:mi:ss +-GMT] where

DD is the day of the month
Mth is the month
Year is the year
hr is the hour displayed as a value (0 - 23 hours)
mi is the minutes
ss is the seconds
GMT will be the difference in time between the current time zone set on the AS/400 and Greenwich Mean Time. The first character in this field represents whether the current time zone is ahead (+) or behind (-) GMT. The next 4 characters represent the offset in hours and minutes HHMM.

Req type

The type of request being logged.

URL

The Uniform Resource Locator requested to be processed.

HTTP level

The HTTP protocol level requested by the browser. If there is no value in this location the requesting browsers HTTP protocol contains a level prior to HTTP/1.0 level (0.9 is the only valid HTTP protocol documented prior to 1.0).

Status code

The status code resulting from the attempt to access the URL specified. For example 200 indicates that the request was successfully processed without errors.

Bytes transferred

The size of the URL transferred to fulfill the request.

Access Log Data Base File Format

The data base format of the access log is very similar to the text formatted log file in the sense that it contains a single record for each attempted document access and it includes a superset of the data available in the text log file. The field ordering of the data base version of the access log file differs from the text formatted version. The following is the format of the data base version of an access log entry.

Short Internet Address - User Name Date Time [Date and time stamp] Status code Bytes Transferred "Req type URL HTTP level" Long Internet Host Name

Short Internet Address (32 characters)

The internet address of the host machine requesting the URL. This would be in the form of a host name if one is available. This field only contains the first 32 characters of the host name. The entire host name is supplied in the Long Internet Host Name field.

User Name (10 characters)

The user name passed in the HTTP authentication header of the request.

Date (8 characters)

This is the current access request date specified in the current time zone versus the GMT time zone. The format of this field is "YYYYMMDD"

YYYY is the year using 4 character positions
MM is the month using 2 character positions
DD is the day of the month using 2 character positions.

Time (6 characters)

This is the current access request time specified in the current time zone versus the GMT time zone. The format of this field is "HHMMSS"

HH is the hour displayed as a value of (00 - 23 hours) using 2 character positions
MM is the minutes using 2 character positions
SS is the seconds using 2 character positions

Date and Time stamp (28 characters)

The access request date and time specified using the access log industry standard format (including the fact that the date and time is specified in Greenwich Mean Time (GMT)). The format of the date and time stamp is [DD/MM/YYYY:HH:MM:SS +-GMT] where

DD is the day of the month using 2 character positions
MM is the month using 2 character positions
YYYY is the year using 4 character positions
HH is the hour displayed as a value of (0 - 23 hours) using 2 characters positions
MM is the minutes using 2 character positions
SS is the seconds using 2 character positions
GMT will be the difference in time between the current time zone set on the AS/400 and Greenwich Mean Time (GMT) using 5 character positions. The first character in this field represents whether the current time zone is ahead (+) or behind (-) GMT. The next 4 characters represent the offset in hours and minutes HHMM.

Status code (3 characters)

The status code resulting from the attempt to access the URL specified. For example 200 indicates that the request was successfully processed without errors.

Bytes transferred (10 characters)

The size of the URL transferred to fulfill the request.

Req method type (6 characters)

The HTTP request method type being logged (Get, Post, Put or Delete).

HTTP level (10 characters)

URL (128 characters)

The Uniform Resource Locator requested to be processed.

Long Internet Address (128 characters)

The internet address of the host machine requesting the URL. This would be in the form of a host name if one is available. This field supports the entire host name. The short internet address only contains the first 32 characters. In the cases where the host name is longer than 32 characters this field would be the location to find the entire name.

The differences between the text access log file and the data base access log file are described by the additional fields listed below.

The date and time of the access attempt is recorded using the current time zone values (not GMT). This information is supplied separating the date and time into two separate fields.
A long and short version of the host name are both available. The long host name field which can hold up to 128 characters is located at the end of the record, while a short version (holding only the first 32 characters of the host name) is recorded in the first field of the record. The shortened host name is located in the front of the record for two reasons, the first is to make the host name or internet address easily available to the WebMaster when viewing the file using the DSPPFM command or the Web Server/400's integrated data base access support. Secondly it is kept in the same location as the text file format, this is for the WebMaster who is accustomed to viewing the text based industry standard access log. The long host name field is located as the last field in the record. This field will include the entire name, and is only needed when the name exceeds 32 characters.

The DDS source used to create the access log can be found in the WWWSERVER library QDDSSRC file ACCESSLOG member. This information can be used to programmatically describe the record format of the access log data base file.

The Server User Profile requires Read, Write and eXecute authorities for the directory containing the access log file.