Today, the most commonly used web server types are generally Apache, IIS, and Nginx.

APACHE Web Server and Log Records

Because it’s open source, flexible, robust, and performant, Apache is among the most preferred types of web servers. It offers very comprehensive and flexible logging capabilities.

Apache Web Server has two log files called Error Log and Access Log.

1. Access Log:

This is the log file where visitors to the website hosted on the web server are recorded. From here we can find out which directories users access, how the web server responds to requests coming from users, which type of web browser visitors are using, and many other pieces of information.

The format of the access log is highly configurable. The location and content of the access log are controlled by the CustomLog directive. The default Apache access log file location:

• /var/log/httpd/access_log: This is where the Apache access log file is located on RHEL / Red Hat / CentOS / Fedora Linux.
• /var/log/apache2/access.log: This is where the Apache access log file is located on Debian / Ubuntu Linux.
• /var/log/httpd-access.log: This is where the FreeBSD Apache access log file is located.

You can use the grep command to find the location of the Apache log file: An example usage is as follows;

• grep CustomLog /usr/local/etc/apache22/httpd.conf

• grep CustomLog /etc/apache2/apache2.conf

• grep CustomLog /etc/httpd/conf/httpd.conf

• Below is a sample Access log line for an Apache web server that I took from a source.

“

88.238.104.122 – – [18/Jun/2017:21:15:31 +0300] “GET /hakkinda HTTP/1.1” 200 740 “http://www.site.com/category/linux/” “Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.104 Safari/537.36”

Let me briefly try to explain what these log entries mean.

• 88.238.104.122- Indicates the IP address of the incoming traffic.
• 18/Jun/2017:21:15:31+0300- Shows the time zone and server time at the moment the request occurred.
• GET- The request method.
• /hakkinda- The requested URL address.
• HTTP/1.1- Protocol information.
• 200- The response the server returned to the request.
• 740- The size of the response in bytes.
• http://www.site.com- Where the request to the requested URL came from (referrer). If there’s a “–” mark, there’s no referrer, meaning visitors accessed the site directly.
• Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.104 Safari/537.36- This is the User Agent information.

“

2. Error Log:

The errors and identification information encountered by Apache httpd while processing requests are relayed to this file. Whenever any problem is encountered on the server, this file is checked to find out and investigate where the error occurred.

• /var/log/httpd/error_log:
• On RHEL / Red Hat / CentOS / Fedora Linux, Apache’s error files are found in this file.
• /var/log/apache2/error.log: On Debian / Ubuntu Linux, Apache’s error log files are found in this log file.
• /var/log/httpd-error.log: On FreeBSD, Apache’s error log files are found in this log file.

You can use the grep command to find the location of the Apache log file as follows:

• grep ErrorLog /usr/local/etc/apache22/httpd.conf

• grep ErrorLog /etc/apache2/apache2.conf

• grep ErrorLog /etc/httpd/conf/httpd.conf

• Again, here’s an Error log line for an Apache web server that I took from a source:

“

Sun Jun 18 20:20:09.961372 2017] [core:error] [pid 16637:tid 4328636416] [client 88.238.104.122 File does not exist: /usr/local/apache2/htdocs/favicon.ic

“

IIS Web Server and Log Records

• On Windows-based operating systems, the web server software developed by Microsoft that enables websites to be published and web applications to run is called IIS.
• Unless changed, the access log records for websites published through the IIS application are stored in the “inetpub\logs\Logfiles” directory.
• Log records in the IIS application can be recorded in different formats: IIS, NCSA, W3C… If we don’t make any changes, records are kept in the W3C format by default.
• Configuring logging correctly is of great importance for being able to examine and make sense of an attack after it has occurred.

Here’s a sample IIS Log line I found from a source;

“”

#Software: Microsoft Internet Information Services 6.0 #Version: 1.0 #Date: 2002-05-24 20:18:01 #Fields: date time c-ip cs-username s-ip s-port cs-method cs-uri-stem cs-uri-query scstatus sc-bytes cs-bytes time-taken cs(User-Agent) cs(Referrer) 2002-05-24 20:18:01 172.224.24.114 – 206.73.118.24 80 GET /Default.htm – 200 7930 248 31 Mozilla/4.0+(compatible;+MSIE+5.01;+Windows+2000+Server) http://64.224.24.114/

“”

NGINX Web Server and Log Records

• Nginx was originally developed by Russian engineers as a mail server and was later adapted to work as a web server.
• Highly praised for its performance, this web server software is quite ideal for high-traffic sites.
• It has also been observed to use less CPU in comparisons made against Apache and LiteSpeed.
• By default, like Apache, Nginx writes its activity to two types of logs: the Error log and the Access log.
• It can run on operating systems such as Linux, FreeBSD variants, Solaris, macOS X, Windows, etc.

By default, the error log and access log are found in the directories specified below. • /var/log/nginx/error.log • /var/log/nginx/access.log

• A sample access.log line for an nginx web server:

“”

88.238.104.122– – [23/May/2017:13:50:59 +0000] “POST /wordpress/wp-admin/post.php HTTP/1.1” 200 2 “http://www.site.com/wordpress/wp-admin/post-new.php” “Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_4; en-US) AppleWebKit/534.3 (KHTML, like Gecko) Chrome/6.0.472.25 Safari/534.3”

“”

• A sample error.log line for an nginx web server:

“” 2017/03/23 13:15:25 [error] 19997#0: *1 open ()“/var/www/nginx/phpmyadmin/scripts/index.php” failed (2: No such file or directory), client: 88.238.104.122, server: localhost, request: “GET /phpmy-admin/scripts/index.php HTTP/1.1”, host: www.site.com

“”