Combined Log Format
Definition
An extension of the Common Log Format used as the default by Apache HTTP Server and widely adopted by Nginx. Adds referrer URL and user-agent string to the base six fields of the Common Log Format. The standard starting point for web server access log analysis.
- Base format
- Common Log Format, six fields
- Added fields
- Referrer URL and user-agent string
- Default in
- Apache HTTP Server
- Also used by
- Nginx
Common questions
Why do the added referrer and user-agent fields matter in a forensic web log investigation?+
The referrer field can show what page linked the visitor to the requested resource, and the user-agent string helps identify the browser or automated tool making the request, both of which help distinguish normal traffic from reconnaissance, scraping, or exploit attempts.
Can log format alone be trusted to reconstruct an attacker's actions?+
No. Fields such as user-agent and referrer are client-supplied and can be spoofed, so investigators corroborate Combined Log Format entries with server-side data such as authentication logs, timestamps across systems, and application-level logging before drawing conclusions.
Related terms
- Binary Log (Database)
- A database engine's sequential record of all committed data modification statements, used primarily for replication and point-in-time recovery. In MySQL and MariaDB,...
- Indicator of Compromise (IoC)
- An observable artefact that suggests a system has been involved in a malicious event. Static analysis produces file-based IoCs: cryptographic hashes, embedded...
- Log Rotation
- The scheduled process of closing the current log file, compressing it, renaming it with a date or sequence suffix, and opening a...
- SIEM
- Security Information and Event Management. A platform that ingests log streams from multiple sources, normalises them to a common schema, and applies...
- Syslog (RFC 5424)
- A standard protocol and message format for transmitting log data from Unix-like systems and network devices to a centralised collector. Each message...