Apache logs explained: access_log, error_log and combined format

Updated November 2026

Apache httpd writes two kinds of log: the access log, one line per request (who asked for what, and what they got), and the error log, where the server reports problems. This page shows where they are, explains every field of the standard "combined" line, and covers custom formats, error levels, rotation and privacy for Apache 2.4.

Where the logs are

Debian also writes other_vhosts_access.log for virtual hosts that have no log of their own. Virtual hosts often log to their own files, so check the real paths with sudo apachectl -S (it prints "Main ErrorLog") and grep -ri customlog /etc/apache2/ (or /etc/httpd/). Watch a log live with sudo tail -F /var/log/apache2/access.log.

The combined format, field by field

Almost every distribution logs in the "combined" format, defined like this:

LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
CustomLog "logs/access_log" combined

A real line from it looks like this (the addresses are documentation examples):

203.0.113.45 - alice [03/Nov/2026:14:02:17 +0000] "GET /reports/q3.html?print=1 HTTP/1.1" 200 18342 "https://www.example.com/reports/" "Mozilla/5.0 (X11; Linux x86_64; rv:144.0) Gecko/20100101 Firefox/144.0"

The "common" format is the first seven fields only. One distribution difference: Debian and Ubuntu define combined with %O instead of %b, which counts bytes actually sent including headers (from mod_logio), so you never see a hyphen there. Quotes and backslashes inside fields are escaped as \" and \\, and control characters as \xhh.

Adding your own fields

Define a new format under its own name rather than editing combined, because log analyzers expect the standard. Useful additions are the time taken and the virtual host:

LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %{ms}T %v" combined_plus
# Debian, Ubuntu (on RHEL, Fedora use "logs/access_log")
CustomLog ${APACHE_LOG_DIR}/access.log combined_plus

To leave out noise such as a load balancer's health checks, mark those requests and log the rest:

SetEnvIf Request_URI "^/health$" dontlog
CustomLog ${APACHE_LOG_DIR}/access.log combined env=!dontlog

Put CustomLog and ErrorLog inside each <VirtualHost> to give each site its own files; see virtual hosts. With hundreds of sites, one shared log with %v uses fewer file descriptors.

The error log

An Apache 2.4 error log line names the module and the severity, the process and thread, the client, and an error code (AH followed by five digits) you can search for:

[Tue Nov 03 14:10:05.233171 2026] [authz_core:error] [pid 41721:tid 41760] [client 198.51.100.7:50412] AH01630: client denied by server configuration: /var/www/example.com/admin/

LogLevel sets how much is written. The default is warn, and each level includes the ones above it:

Raise the level for one module only, and only while you debug, because trace levels fill disks fast:

# follow mod_rewrite's decisions
LogLevel warn rewrite:trace3
# more detail on TLS handshakes
LogLevel warn ssl:info
# bring back "File does not exist" lines for 404s
LogLevel warn core:info

Use one of these lines at a time: a later LogLevel in the same context replaces the earlier one, so combine modules on one line, such as LogLevel warn rewrite:trace3 ssl:info. The module must be loaded, or configtest stops with "Cannot find module rewrite".

Since 2.4, missing-file messages for 404s are logged at info, so you will not see them at the default level. LogLevel also works inside a <Directory>, and ErrorLog syslog:local1 sends errors to syslog instead of a file. For reading common messages, see troubleshooting errors; for rewrite tracing, mod_rewrite.

Rotating logs

A busy site's access log grows by gigabytes. There are two ways to keep it in check.

logrotate (the distribution default)

Debian and Ubuntu ship /etc/logrotate.d/apache2: daily rotation, 14 old files kept, compression delayed by one day, then apache2 is reloaded so it reopens its files. RHEL and Fedora ship /etc/logrotate.d/httpd, which reloads httpd.service. For logs in another folder, add a file like this:

# /etc/logrotate.d/example-com
/var/www/example.com/logs/*.log {
    daily
    rotate 30
    maxage 30
    missingok
    notifempty
    compress
    delaycompress
    dateext
    create 640 root adm
    sharedscripts
    postrotate
        if systemctl is-active --quiet apache2; then systemctl reload apache2; fi
    endscript
}

On RHEL use httpd instead of apache2 and a group such as root. Dry-run it with sudo logrotate -d /etc/logrotate.d/example-com. Avoid copytruncate for Apache; its own man page warns that lines can be lost between the copy and the truncate.

rotatelogs (piped logging)

Apache can write through a pipe to its own rotatelogs program, which starts a new file on schedule without any reload:

CustomLog "|/usr/bin/rotatelogs -l -L /var/log/apache2/access.log /var/log/apache2/access.%Y-%m-%d.log 86400" combined
ErrorLog  "|/usr/bin/rotatelogs -l /var/log/apache2/error.%Y-%m-%d.log 86400"

86400 means every 24 hours, -l uses local time instead of UTC, -L keeps a hard link with a fixed name for tail -F, and a size such as 100M rotates by size instead. rotatelogs does not delete old files (unless you use -n to cycle a fixed number of them), so add a cron job (for example find /var/log/apache2 -name 'access.*.log' -mtime +30 -delete). It lives in /usr/bin on Debian; find it elsewhere with command -v rotatelogs. Disable the distribution's logrotate entry for files you rotate this way.

Privacy and safety

Access logs hold IP addresses, user names, and full URLs, which sometimes include e-mail addresses or tokens in query strings. Treat them as personal information:

• Keep them only as long as you need them; rotate and maxage in logrotate enforce that.
• Restrict who can read them (640, group adm on Debian).
• Do not log what you do not use. A format without %h drops addresses entirely.
• Mask addresses before they reach disk if you need rough location but not the person.

Apache has no built-in masking code, but a piped logger can do it. This script zeroes the last part of IPv4 addresses and keeps only the first 48 bits of IPv6 addresses:

#!/bin/sh
# /usr/local/bin/apache-anon-log - mask client IPs, append to the file given as $1
exec /usr/bin/sed -u -E \
  -e 's/^([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})\.[0-9]{1,3} /\1.0 /' \
  -e 's/^([0-9a-fA-F]{1,4}:[0-9a-fA-F]{1,4}:[0-9a-fA-F]{1,4}):[0-9a-fA-F:]* /\1:: /' \
  -e 's/^([0-9a-fA-F]{1,4}:[0-9a-fA-F]{1,4})::[0-9a-fA-F:]* /\1:: /' \
  >> "$1"

sudo chmod 755 /usr/local/bin/apache-anon-log
# in the virtual host, instead of the normal CustomLog:
CustomLog "|/usr/local/bin/apache-anon-log /var/log/apache2/access.log" combined

A line then starts 203.0.113.0 - - [03/Nov/2026…. Apache restarts the script on every reload, so logrotate keeps working. Piped log programs run as the user that started Apache, usually root, so keep them this simple and writable only by root. If you only need anonymous reports, GoAccess can mask addresses at report time instead (see log analysis).

Sources

• Log Files, Apache HTTP Server 2.4 documentation
• mod_log_config, Apache HTTP Server 2.4 documentation
• Core features (ErrorLog, ErrorLogFormat, LogLevel, HostnameLookups), Apache HTTP Server 2.4 documentation
• rotatelogs, Apache HTTP Server 2.4 documentation
• mod_remoteip, Apache HTTP Server 2.4 documentation
• logrotate(8) manual page, man7.org
• httpd.conf (default log formats), CentOS Stream httpd package
• httpd.logrotate, CentOS Stream httpd package
• Referrer-Policy header, MDN Web Docs