Apache · Configuration and operations
How do you design a useful Apache LogFormat?
Short answer
Start from combined and add fields you actually query: virtual host, response time, upstream address and request ID. Prefer a structured or consistently parseable format and be careful with quoting and untrusted values.
The LogFormat directive is a template of percent escapes. The combined format includes client address, identity, user, timestamp, request, status, bytes, referer and user agent. Production formats usually add vhost, duration and proxy information so one line can answer latency and routing questions.
LogFormat "%v %a %u %t %m %U%q %H %>s %O %D %{X-Forwarded-For}i %{X-Request-ID}i" app
LogFormat "%t|%v|%a|%m|%U|%q|%>s|%O|%D|%{X-Request-ID}i" app_pipe
CustomLog /var/log/apache2/app-access.log app_pipeUseful escapes
- %a is the peer address; %h is the remote host, which may involve DNS
- %v is the virtual host, %p is the port and %m is the request method
- %U is the path without the query string; %q includes it
- %>s is the final status and %O is bytes sent including headers
- %D is duration in microseconds; %T is seconds
- %{VAR}i reads a request header; %{VAR}e reads an environment variable
- %X reports connection status, useful for keep-alive analysis
Do not build JSON by pasting untrusted header values without escaping. A user agent containing quotes can break the structure. Use a dedicated logging module or a format that escapes, or accept a less convenient but parseable delimiter. If logs feed a SIEM, keep field names stable and document the format.
Follow-ups you should expect
Interviewers use these to check whether the first answer was understanding or memorisation.
- 1Which LogFormat escape gives request duration?
- 2How do you include a request ID from an upstream proxy?
- 3Why is hand-built JSON logging risky?
- 4How do you correlate Apache logs with application logs?
Say it in the interview
I start from combined and add the fields I actually query: vhost, duration, bytes and proxy or request IDs. I keep the format stable and parseable, and I am careful with untrusted headers because naive JSON concatenation breaks on quotes. For correlation I propagate a request ID and include it in both proxy and application logs.
Use this as a model, not a script. Saying it in your own words is what makes it survive follow-up pressure.
Related questions
Reading is step one
Now say it out loud.
Understanding an answer and delivering it under pressure are different skills. Rehearse this topic in a live Apache mock interview and get scored feedback on depth, clarity and confidence.