MELTr
Home Vendors Search Download
Login
Vendors / Apache Software Foundation / Apache HTTP Server / Apache Forensic Log
Apache Software Foundation logo

Event type

Apache Forensic Log

Detailed request/response logging for security analysis

Apache HTTP Server forensic logs from mod_log_forensic, providing detailed request/response logging with unique request IDs for security analysis and debugging. Forensic logs contain two log lines per request (before and after processing) with strict formatting.

PLAIN TEXT 11 fields Medium Generator

forensic security debugging request-logging mod_log_forensic
Preview Sample View Schema
CLI Install
meltr templates install apache

Overview

What this event covers

Apache forensic logs from mod_log_forensic module provide detailed request and response logging with unique request IDs. Each request generates two log entries: one before processing (marked with '+') and one after processing (marked with '-'), enabling correlation and security analysis.

When generated

  • ›When mod_log_forensic module is enabled in Apache configuration
  • ›For every HTTP request processed by the server
  • ›Before and after request processing for debugging and security analysis

Security relevance

High

Compliance

NIST 800-53 (AU-2, AU-6) ISO 27001 (A.12.4.1) PCI-DSS (10.2) SOC 2 (CC7.2)

Frequency notes

Forensic logs generate two entries per request (before and after processing), effectively doubling the log volume compared to standard access logs. Typically enabled for security-sensitive environments or during troubleshooting. Frequency matches HTTP request patterns with higher volume during business hours.

Resources

Docs and tools

Apache Forensic Logging official mod_log_forensic Documentation official Apache Log Files Overview official

Generation

Configuration

Base frequency
150 events/hour
Time patterns
business_hours night_hours weekend
Business hours
2.5x
Night hours
0.5x
Weekend
0.4x

Schema

Field definitions

Field reference for this event type — types, requirements, examples, and allowed values.

Request ID
String Required

Unique identifier for correlating request/response pairs

Source: random_hex(16)

Format Hexadecimal string (16 characters)
Example a1b2c3d4e5f6g7h8
Client IP
String Required

IP address of the client making the request

Source: random_private_ip()

Format IPv4 address
Example 192.168.1.100
Timestamp
DateTime Required

Timestamp when the request was logged

Source: now() | format_datetime('%Y-%m-%d %H:%M:%S')

Format YYYY-MM-DD HH:MM:SS
Example 2025-01-15 14:23:45
HTTP Method
String Required

HTTP request method

Example GET
Values
  • GET
  • POST
  • PUT
  • DELETE
  • HEAD
  • OPTIONS
Request URI
String Required

Requested URI path

Source: random_choice of common paths

Example /api/users
HTTP Version
String Required

HTTP protocol version

Example HTTP/1.1
Values
  • HTTP/1.1
  • HTTP/2.0
Status Code
Integer Required

HTTP response status code

Source: random_choice of common status codes

Example 200
Response Size
Integer Required

Size of response in bytes

Source: random_int(0, 500000)

Example 12345
User Agent
String Required

Client user agent string

Source: random_choice of common user agents

Example Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Server IP
String Required

IP address of the server handling the request

Source: random_private_ip()

Format IPv4 address
Example 10.0.0.1
Server Port
Integer Required

Port number the server is listening on

Example 443
Values
  • 80
  • 443
  • 8080
  • 8443