Knowing your log format before you parse

Knowing your log format before you parse

Garbage parsing comes from guessing the format. Four references that decode what each field actually is.

→ Apache's mod_log_config docs — every % directive, so Combined vs Common is never ambiguous.
Takeaway: %h %l %u %t "%r" %>s %b is Common; Combined adds referer + UA.

→ Nginx's log_format reference — the default differs subtly from Apache; $request packs method+URI+protocol.

⭐ Pick of the week: the W3C Extended Log File Format spec — for IIS and CDN logs where fields are self-describing in the header line.
Takeaway: read the #Fields: directive, never assume column order.

→ MaxMind's notes on the X-Forwarded-For trap — behind a proxy, $remote_addr is the CDN, not the visitor.

Source credit: Apache, Nginx, W3C, MaxMind docs.