MELTr
Home Vendors Search Download
Login
Vendors / Apache Software Foundation / Apache HTTP Server / Apache Common Log Format
Apache Software Foundation logo

Event type

Apache Common Log Format

Standard HTTP access logs with basic request information

Apache HTTP Server Common Log Format (CLF) access logs recording basic HTTP request information including client IP, authenticated user, timestamp, request details, and response status

PLAIN TEXT 9 fields High Generator

access-log http web-server common-format clf traffic
Preview Sample View Schema
CLI Install
meltr templates install apache

Overview

What this event covers

Records all HTTP requests to the Apache web server in the standardized Common Log Format (CLF), including client IP, authenticated user (if any), timestamp, HTTP request method and URI, status code, and response size. This is the most widely-used and standardized Apache log format.

When generated

  • ›Every HTTP/HTTPS request received by the Apache web server
  • ›GET, POST, PUT, DELETE, HEAD, OPTIONS, and other HTTP methods
  • ›Both successful requests and errors (2xx, 3xx, 4xx, 5xx status codes)
  • ›Requests to static content, dynamic pages, and APIs
  • ›Legacy systems and simple web servers often use CLF instead of Combined format

Security relevance

High

Compliance

PCI DSS (Requirement 10.2 - Audit logging) HIPAA (Access logging requirements) SOX (Access audit trails) GDPR (Access logging for personal data) ISO 27001 (A.12.4.1 - Event logging) NIST SP 800-53 (AU-2, AU-3 - Audit events)

Frequency notes

High-frequency events during business hours (900 events/hour or ~4 per second) with reduced activity during nights (120 events/hour) and weekends (150 events/hour). Common Log Format is typically used for simpler web servers, static content servers, or legacy applications.

Resources

Docs and tools

Apache HTTP Server Documentation - Log Files official Apache Module mod_log_config official Common Log Format Specification official W3C Common Logfile Format reference HTTP Status Codes Reference reference GoAccess Real-time web log analyzer and interactive viewer for Apache logs AWStats Advanced web statistics analyzer for Apache access logs Webalizer Fast web server log file analysis program Analog Fast log file analyzer with extensive reporting options

Generation

Configuration

Base frequency
300 events/hour
Time patterns
business_hours night_hours weekend
Business hours
3.0x
Night hours
0.4x
Weekend
0.5x

Schema

Field definitions

Field reference for this event type — types, requirements, examples, and allowed values.

client_ip
String Required

IP address of the client making the request

Source: random_private_ip()

Format IPv4 or IPv6
Example 192.168.1.100
ident
String Required

RFC 1413 identity of the client (typically '-' as ident lookups are rarely used)

Source: random_choice(['-', registry.get_random_user().username])

Format Identity string or '-'
Example -
authenticated_user
String Required

Username of authenticated user, or '-' if not authenticated via HTTP Basic Authentication

Source: random_choice(['-', registry.get_random_user().username])

Format Username or '-'
Example jsmith
timestamp
DateTime Required

Date and time of the request in Apache's standard format

Source: now() | format_datetime('%d/%b/%Y:%H:%M:%S %z')

Format DD/Mon/YYYY:HH:MM:SS Timezone
Example 20/Dec/2025:15:31:10 -0600
request_method
String Required

HTTP request method

Source: random_choice(['GET', 'POST', 'PUT', 'DELETE', 'HEAD', 'OPTIONS'])

Format HTTP method verb
Example GET
Values
  • GET Retrieve resource
  • POST Submit data to server
  • PUT Update existing resource
  • DELETE Remove resource
  • HEAD Retrieve headers only
  • OPTIONS Check allowed methods
request_uri
String Required

URI path and query string of the request

Source: random_choice of common web paths

Format URI path
Example /index.html
http_version
String Required

HTTP protocol version used for the request

Source: random_choice(['1.1', '2.0'])

Format HTTP/x.x
Example HTTP/1.1
Values
  • HTTP/1.1 HTTP version 1.1 (most common)
  • HTTP/2.0 HTTP version 2.0
status_code
Integer Required

HTTP response status code returned by the server

Source: random_weighted selection favoring successful responses

Format 3-digit HTTP status code
Example 200
Values
  • 200 OK - Successful request
  • 201 Created - Resource created successfully
  • 204 No Content - Successful with no response body
  • 301 Moved Permanently - Resource moved
  • 302 Found - Temporary redirect
  • 304 Not Modified - Cached resource still valid
  • 400 Bad Request - Invalid request syntax
  • 401 Unauthorized - Authentication required
  • 403 Forbidden - Access denied
  • 404 Not Found - Resource not found
  • 500 Internal Server Error - Server error
  • 502 Bad Gateway - Upstream server error
  • 503 Service Unavailable - Server temporarily unavailable
response_size
Integer Required

Size of response in bytes, not including HTTP headers (0 or '-' if no content sent)

Source: random_int(0, 500000)

Format Bytes
Example 2326