Working with Log Files

Server log files record your server's activity. You can use these logs to monitor your server and to help you when troubleshooting. Both the error log file and the access log file are located in /NOVONYX/SUITESPOT/HTTPS-SERVERNAME/LOGS. The error log file lists all the errors the server has encountered, and the access log file records information about requests to the server and the responses from the server. You can use the Server Status form to specify what to include in the access log file. Use the log analyzer to generate server statistics. You can back up server error and access log files by archiving them.

Viewing an Access Log File

You can view the server's active and archived access log files from the Server Status form.

1. From the Web Manager home page, click Enterprise Web Server servername > Server Status > View Access Log.

2. Select the access log file you want to see from the View This Log File drop-down list.

   Active log files for resources and archived log files appear in the list.

3. To limit how much of the access log you see, enter the number of lines you want to see in the Number of Entries field.

   The order of the log entries on the screen is the order in which they were recorded in the log.

4. If want to filter the access log entries for a particular word, enter the word in the Only Show Entries With field.

   Case is important; make sure the case for your entry matches the case of the word you're searching for.

5. Click OK.

Here is an example of an access log in the common logfile format:

wiley.a.com - - [16/Feb/1996:21:18:26 -0800] "GET / HTTP/1.0" 200 751  
wiley.a.com - - [17/Feb/1996:1:04:38 -0800] "GET /docs/grafx/icon.gif HTTP/1.0" 204 342  
wiley.a.com - - [20/Feb/1996:4:36:53 -0800] "GET /help HTTP/1.0" 401 571  
arrow.a.com - john [29/Mar/1996:4:36:53 -0800] "GET /help HTTP/1.0" 401 571

The following table describes the last line of the sample access log.

Table 5. Fields in the Last Line of the Sample Access Log File

Here is an example of an access log using the flexible logging format:

wiley.a.com - - [25/Mar/1996:12:55:26 -0800] "GET /index.htm HTTP/1.0" "GET" "/?-" "HTTP/   1.0" 304 0 - Mozilla/2.0 (WinNT; I)   
wiley.a.com - - [25/Mar/1996:12:55:26 -0800] "GET / HTTP/1.0" "GET" "/?-" "HTTP/1.0" 304 0    - Mozilla/2.0 (WinNT; I)   
wiley.a.com - - [25/Mar/1996:12:55:26 -0800] "GET / HTTP/1.0" "GET" "/?-" "HTTP/1.0" 304 0    - Mozilla/2.0 (X11; I; IRIX 5.3 IP22) 

The access log in the flexible logging format looks similar to the access log using the common logfile format.

Viewing an Error Log File

The error log file contains errors the server has encountered after the log file was created; it also contains information about the server, such as when the server was started. Incorrect user authentication is also recorded in the error log. Use the error log to find broken URL paths or missing files.

1. From the Web Manager home page, click Enterprise Web Server servername > Server Status > View Error Log.

2. Enter the number of lines you'd like to see in the Number of Errors to View field if you want to see more or less than 25 lines of the error log at one time.

   The order of the log entries on the screen is the order in which they were recorded in the log.

3. If you'd like to filter the error messages for a particular word, enter the word in the Only Show Entries With field.

   Case is important; make sure the case for your entry matches the case of the word you're searching for.

4. Click OK.

Here is an example of an error log:

[13/Feb/1996:16:56:51] info: successful server startup  
[20/Mar/1996 19:08:52] warning: for host wiley.a.com trying to GET /report.html, append-trailer reports: error opening   
[30/Mar/1996 15:05:43] security: for host arrow.a.com trying to GET /, basic-ncsa reports: user jane password did not match database 

In this example, the first line is an informational message---the server started successfully. The second log entry shows that the client wiley.a.com requested the file REPORT.HTML, but the file wasn't in the primary document directory on the server. The third log entry shows that the password entered for the user jane was incorrect.

Setting Log Preferences

You can customize access logging for any resource by specifying whether to log accesses, which format to use for logging, and whether the server should spend time looking up the domain names of clients when they access a resource.

Server access logs can be in common logfile format, flexible log format, or your own customized format. The Common Logfile Format is a commonly supported format that provides a fixed amount of information about the server. The flexible log format allows you to choose (from the Server Status form) what to log. A customized format uses parameter blocks that you specify to control what gets logged. Once an access log for a resource has been created, you can't change its format unless you archive it or create a new access log file for the resource.

To set access logging preferences, do the following:

1. From the Web Manager home page, click Enterprise Web Server servername > Server Status > Log Preferences.

2. Select the resource that you would like to apply custom logging to from the Editing drop-down list.

3. Select whether to log client accesses.

4. Enter the full path in the Log File field.

   By default, the log files are kept in the logs directory in the server root directory. If you specify a partial pathname, the server assumes the path is the logs directory in the server root.

5. Under Record, click Domain Names or IP Addresses.

6. In the Format list, select Common Logfile Format, flexible log format (Only Log option), or Custom Format.

7. (Conditional) If you selected Only Log, you can select any or all of the following flexible log format items in the checklist:

   • Client Host Name: The hostname (or IP address if DNS is disabled) of the client requesting access.
   • Authenticate Username: The authenticated username is listed in the access log if authentication is necessary.
   • System Date: The date and time of the client request.
   • Full Request: The exact request the client made.
   • Status: The status code the server returned to the client.
   • Content Length: The content length, in bytes, of the document sent to the client.
   • HTTP Header, "Referer": The referer specifies the page from which the client accessed the current page. For example, if a user was looking at the results from a text search query, the referer would be the page that the user accessed the text search engine from. Referers allow the server to create a list of backtracked links.
   • HTTP Header, "User-Agent": The user-agent information---which includes the type of browser the client is using, its version, and the operating system it's running on---comes from the User-Agent field in the HTTP header information the client sends to the server.
   • Method: The request method used.
   • URI: Universal Resource Identifier. The location of a resource on the server. For example, for http://www.a.com:8080/special/docs, the URI is special/docs.
   • Query String of the URI: Anything after the question mark in a URI. For example, for http://www.a.com:8080/special/docs?find_this, the query string of the URI is find_this.
   • Protocol: The transport protocol and version used.

8. (Conditional) If you selected a custom format, enter your custom format in the Custom format field.

9. If you don't want to log client access from certain hostnames or IP addresses, enter the hostname or IP address in the Hostnames and IP Addresses fields.

   Enter a wildcard pattern of hosts that the server should ignore when recording accesses. For example, use *.netscape.com if you don't want to log accesses from people whose domain is netscape.com; you can enter wildcard patterns for hostnames, IP addresses, or both.

10. Click OK.

Archiving Log Files

You can archive the access and error log files and have the server create new ones.

When you archive log files, the server renames the current log files and then creates new log files with the original names. You can back up or archive, or delete, the old log files, which are saved as the original filename followed by the date and time the file was rotated. For example, ACCESS might become ACCESS.24APR-04AM

You can archive log files immediately or have the server archive log files at a specific time on specific days. This information is stored in /NOVONYX/SUITESPOT/https-servername/LOGS.

Before running the log analyzer, you should archive the server logs.

1. From the Web Manager home page, click Enterprise Web Server servername > Server Status > Archive Log.

   The Archive Log Files form appears.

2. Do one of the following:

   • To rotate the log files immediately, click Archive.
   • To archive at specific times on specific days, click Rotate Log At, select a time from the drop-down menu, and check the days for archiving to occur.

3. Click OK.