Logging Cookies with the Apache httpd web server
Archive - Originally posted on "The Horse's Mouth" - 2008-08-20 07:55:13 - Graham EllisAn interesting question that came up yesterday - can we extend Apache httpd's logging to include details of cookies sent to the server? The answer is yes, and overnight I have done a little testing.
Let's say I want a log file with records like this:
203.126.136.220 [20/Aug/2008:07:39:25 +0100] "wxt=551e80d6ca00833407af3f85ac8919a5" 200 "GET /forum/The-Tcl-programming-language/File-Searching.html HTTP/1.1"
66.249.65.108 [20/Aug/2008:07:40:44 +0100] "-" 200 "GET /forum/The-MySQL-Relational-Database/Copying-a-table-structure.html HTTP/1.1"
220.227.116.220 [20/Aug/2008:07:40:37 +0100] "wxt=d173ff275e98ed6535eb14ca992976e0; whcmy=whc48abbbef58a62" 200 "GET /resources/P307.html HTTP/1.0"
All I had to do was to add the following two lines to my httpd.conf file:
LogFormat "%h %t \"%{Cookie}i\" %>s \"%r\"" cookie
CustomLog "/home/wellho/logs/cookie_log" cookieThe first line defines a new log file format including the cookie header, and the second describes where that log file is to be generated. And, yes, you could do something similar for acceptable compression types, preferred languages, and much more!
And then stop and restart the server to have the new configuration read and effected (./bin/apachectl stop; ./bin/apachectl start)
Some extra notes:
a) Bare in mind that a nonstandard log file format won't be automatically accepted as an input data source by analog, awstats and all the other web file log analysis packages out there!
b) remember to use crontab or something like it to cycle the log files.
c) There could be privacy issues ... this is JUST an experiment!
Why would I want to note cookies?
• To help tell automata apart from real visitors
• To help establish who's who when I have multiple visitors from the same site
• To help over the long term to trace back multiple accesses from different IP addresses to the same visitor - as will happen from the laptop I'm posting from today for example - which last week was in Melksham, over the weekend was in St Briavels and is now posting from Milton keynes.