Gecko [ v3.cesa.co.za ]

Name	Size	Permission	Date
core.html	306.8 KB	-rw-r--r--	2026-06-12 05:08
directive-dict.html	18 KB	-rw-r--r--	2026-06-12 05:08
directives.html	57.92 KB	-rw-r--r--	2026-06-12 05:08
event.html	28.64 KB	-rw-r--r--	2026-06-12 05:08
index.html	24.21 KB	-rw-r--r--	2026-06-12 05:08
mod_access_compat.html	28.27 KB	-rw-r--r--	2026-06-12 05:08
mod_actions.html	12.61 KB	-rw-r--r--	2026-06-12 05:08
mod_alias.html	40.63 KB	-rw-r--r--	2026-06-12 05:08
mod_allowmethods.html	7.79 KB	-rw-r--r--	2026-06-12 05:08
mod_asis.html	8.65 KB	-rw-r--r--	2026-06-12 05:08
mod_auth_basic.html	19.39 KB	-rw-r--r--	2026-06-12 05:08
mod_auth_digest.html	20.06 KB	-rw-r--r--	2026-06-12 05:08
mod_auth_form.html	50.26 KB	-rw-r--r--	2026-06-12 05:08
mod_authn_anon.html	16.37 KB	-rw-r--r--	2026-06-12 05:08
mod_authn_core.html	16.45 KB	-rw-r--r--	2026-06-12 05:08
mod_authn_dbd.html	15.01 KB	-rw-r--r--	2026-06-12 05:08
mod_authn_dbm.html	12.48 KB	-rw-r--r--	2026-06-12 05:08
mod_authn_file.html	11.17 KB	-rw-r--r--	2026-06-12 05:08
mod_authn_socache.html	18.79 KB	-rw-r--r--	2026-06-12 05:08
mod_authnz_fcgi.html	26.93 KB	-rw-r--r--	2026-06-12 05:08
mod_authnz_ldap.html	86.06 KB	-rw-r--r--	2026-06-12 05:08
mod_authz_core.html	39.59 KB	-rw-r--r--	2026-06-12 05:08
mod_authz_dbd.html	18.13 KB	-rw-r--r--	2026-06-12 05:08
mod_authz_dbm.html	12.7 KB	-rw-r--r--	2026-06-12 05:08
mod_authz_groupfile.html	10.24 KB	-rw-r--r--	2026-06-12 05:08
mod_authz_host.html	13.12 KB	-rw-r--r--	2026-06-12 05:08
mod_authz_owner.html	11 KB	-rw-r--r--	2026-06-12 05:08
mod_authz_user.html	7.91 KB	-rw-r--r--	2026-06-12 05:08
mod_autoindex.html	63.19 KB	-rw-r--r--	2026-06-12 05:08
mod_brotli.html	22.65 KB	-rw-r--r--	2026-06-12 05:08
mod_buffer.html	8.76 KB	-rw-r--r--	2026-06-12 05:08
mod_cache.html	69.74 KB	-rw-r--r--	2026-06-12 05:08
mod_cache_disk.html	20.06 KB	-rw-r--r--	2026-06-12 05:08
mod_cache_socache.html	18.21 KB	-rw-r--r--	2026-06-12 05:08
mod_cern_meta.html	10.83 KB	-rw-r--r--	2026-06-12 05:08
mod_cgi.html	19.94 KB	-rw-r--r--	2026-06-12 05:08
mod_cgid.html	11.36 KB	-rw-r--r--	2026-06-12 05:08
mod_charset_lite.html	15.11 KB	-rw-r--r--	2026-06-12 05:08
mod_data.html	7.2 KB	-rw-r--r--	2026-06-12 05:08
mod_dav.html	19.88 KB	-rw-r--r--	2026-06-12 05:08
mod_dav_fs.html	10.54 KB	-rw-r--r--	2026-06-12 05:08
mod_dav_lock.html	9.51 KB	-rw-r--r--	2026-06-12 05:08
mod_dbd.html	24.89 KB	-rw-r--r--	2026-06-12 05:08
mod_deflate.html	31.15 KB	-rw-r--r--	2026-06-12 05:08
mod_dialup.html	7.2 KB	-rw-r--r--	2026-06-12 05:08
mod_dir.html	23.75 KB	-rw-r--r--	2026-06-12 05:08
mod_dumpio.html	9.41 KB	-rw-r--r--	2026-06-12 05:08
mod_echo.html	7.16 KB	-rw-r--r--	2026-06-12 05:08
mod_env.html	11.48 KB	-rw-r--r--	2026-06-12 05:08
mod_example_hooks.html	11.01 KB	-rw-r--r--	2026-06-12 05:08
mod_expires.html	17.21 KB	-rw-r--r--	2026-06-12 05:08
mod_ext_filter.html	18.05 KB	-rw-r--r--	2026-06-12 05:08
mod_file_cache.html	15.2 KB	-rw-r--r--	2026-06-12 05:08
mod_filter.html	33.35 KB	-rw-r--r--	2026-06-12 05:08
mod_headers.html	34.06 KB	-rw-r--r--	2026-06-12 05:08
mod_heartbeat.html	9.29 KB	-rw-r--r--	2026-06-12 05:08
mod_heartmonitor.html	11.92 KB	-rw-r--r--	2026-06-12 05:08
mod_http2.html	75.84 KB	-rw-r--r--	2026-06-12 05:08
mod_ident.html	9.74 KB	-rw-r--r--	2026-06-12 05:08
mod_imagemap.html	21.06 KB	-rw-r--r--	2026-06-12 05:08
mod_include.html	59.69 KB	-rw-r--r--	2026-06-12 05:08
mod_info.html	14.52 KB	-rw-r--r--	2026-06-12 05:08
mod_isapi.html	23.44 KB	-rw-r--r--	2026-06-12 05:08
mod_lbmethod_bybusyness.html	7.6 KB	-rw-r--r--	2026-06-12 05:08
mod_lbmethod_byrequests.html	12.3 KB	-rw-r--r--	2026-06-12 05:08
mod_lbmethod_bytraffic.html	7.95 KB	-rw-r--r--	2026-06-12 05:08
mod_lbmethod_heartbeat.html	8.02 KB	-rw-r--r--	2026-06-12 05:08
mod_ldap.html	50.89 KB	-rw-r--r--	2026-06-12 05:08
mod_log_config.html	38.27 KB	-rw-r--r--	2026-06-12 05:08
mod_log_debug.html	9.95 KB	-rw-r--r--	2026-06-12 05:08
mod_log_forensic.html	12.64 KB	-rw-r--r--	2026-06-12 05:08
mod_logio.html	10.29 KB	-rw-r--r--	2026-06-12 05:08
mod_lua.html	93.06 KB	-rw-r--r--	2026-06-12 05:08
mod_macro.html	15.29 KB	-rw-r--r--	2026-06-12 05:08
mod_md.html	109.91 KB	-rw-r--r--	2026-06-12 05:08
mod_mime.html	66.05 KB	-rw-r--r--	2026-06-12 05:08
mod_mime_magic.html	16.52 KB	-rw-r--r--	2026-06-12 05:08
mod_negotiation.html	21.68 KB	-rw-r--r--	2026-06-12 05:08
mod_nw_ssl.html	9.27 KB	-rw-r--r--	2026-06-12 05:08
mod_privileges.html	29.36 KB	-rw-r--r--	2026-06-12 05:08
mod_proxy.html	137.06 KB	-rw-r--r--	2026-06-12 05:08
mod_proxy_ajp.html	32.56 KB	-rw-r--r--	2026-06-12 05:08
mod_proxy_balancer.html	23.03 KB	-rw-r--r--	2026-06-12 05:08
mod_proxy_connect.html	9.85 KB	-rw-r--r--	2026-06-12 05:08
mod_proxy_express.html	13.19 KB	-rw-r--r--	2026-06-12 05:08
mod_proxy_fcgi.html	22.14 KB	-rw-r--r--	2026-06-12 05:08
mod_proxy_fdpass.html	7.2 KB	-rw-r--r--	2026-06-12 05:08
mod_proxy_ftp.html	18.84 KB	-rw-r--r--	2026-06-12 05:08
mod_proxy_hcheck.html	17.43 KB	-rw-r--r--	2026-06-12 05:08
mod_proxy_html.html	34.16 KB	-rw-r--r--	2026-06-12 05:08
mod_proxy_http.html	11.63 KB	-rw-r--r--	2026-06-12 05:08
mod_proxy_http2.html	10.05 KB	-rw-r--r--	2026-06-12 05:08
mod_proxy_scgi.html	14.49 KB	-rw-r--r--	2026-06-12 05:08
mod_proxy_uwsgi.html	8.15 KB	-rw-r--r--	2026-06-12 05:08
mod_proxy_wstunnel.html	10.73 KB	-rw-r--r--	2026-06-12 05:08
mod_ratelimit.html	6.72 KB	-rw-r--r--	2026-06-12 05:08
mod_reflector.html	8.28 KB	-rw-r--r--	2026-06-12 05:08
mod_remoteip.html	26.54 KB	-rw-r--r--	2026-06-12 05:08
mod_reqtimeout.html	12.49 KB	-rw-r--r--	2026-06-12 05:08
mod_request.html	9.03 KB	-rw-r--r--	2026-06-12 05:08
mod_rewrite.html	82.27 KB	-rw-r--r--	2026-06-12 05:08
mod_sed.html	11.53 KB	-rw-r--r--	2026-06-12 05:08
mod_session.html	35.31 KB	-rw-r--r--	2026-06-12 05:08
mod_session_cookie.html	13.55 KB	-rw-r--r--	2026-06-12 05:08
mod_session_crypto.html	17.73 KB	-rw-r--r--	2026-06-12 05:08
mod_session_dbd.html	25.2 KB	-rw-r--r--	2026-06-12 05:08
mod_setenvif.html	21.77 KB	-rw-r--r--	2026-06-12 05:08
mod_slotmem_plain.html	7.76 KB	-rw-r--r--	2026-06-12 05:08
mod_slotmem_shm.html	8.36 KB	-rw-r--r--	2026-06-12 05:08
mod_so.html	13.5 KB	-rw-r--r--	2026-06-12 05:08
mod_socache_dbm.html	5.82 KB	-rw-r--r--	2026-06-12 05:08
mod_socache_dc.html	5.87 KB	-rw-r--r--	2026-06-12 05:08
mod_socache_memcache.html	8.34 KB	-rw-r--r--	2026-06-12 05:08
mod_socache_redis.html	10 KB	-rw-r--r--	2026-06-12 05:08
mod_socache_shmcb.html	5.9 KB	-rw-r--r--	2026-06-12 05:08
mod_speling.html	12.64 KB	-rw-r--r--	2026-06-12 05:08
mod_ssl.html	200.72 KB	-rw-r--r--	2026-06-12 05:08
mod_status.html	11.84 KB	-rw-r--r--	2026-06-12 05:08
mod_substitute.html	14.37 KB	-rw-r--r--	2026-06-12 05:08
mod_suexec.html	7.89 KB	-rw-r--r--	2026-06-12 05:08
mod_systemd.html	7.57 KB	-rw-r--r--	2026-06-12 05:08
mod_unique_id.html	14.89 KB	-rw-r--r--	2026-06-12 05:08
mod_unixd.html	13.54 KB	-rw-r--r--	2026-06-12 05:08
mod_userdir.html	12.36 KB	-rw-r--r--	2026-06-12 05:08
mod_usertrack.html	19.68 KB	-rw-r--r--	2026-06-12 05:08
mod_version.html	10.05 KB	-rw-r--r--	2026-06-12 05:08
mod_vhost_alias.html	21.12 KB	-rw-r--r--	2026-06-12 05:08
mod_watchdog.html	7.73 KB	-rw-r--r--	2026-06-12 05:08
mod_xml2enc.html	15.3 KB	-rw-r--r--	2026-06-12 05:08
module-dict.html	9.17 KB	-rw-r--r--	2026-06-12 05:08
mpm_common.html	70.04 KB	-rw-r--r--	2026-06-12 05:08
mpm_netware.html	9.82 KB	-rw-r--r--	2026-06-12 05:08
mpm_winnt.html	10.58 KB	-rw-r--r--	2026-06-12 05:08
mpmt_os2.html	7.5 KB	-rw-r--r--	2026-06-12 05:08
overrides.html	69.49 KB	-rw-r--r--	2026-06-12 05:08
prefork.html	15.96 KB	-rw-r--r--	2026-06-12 05:08
quickreference.html	193.62 KB	-rw-r--r--	2026-06-12 05:08
worker.html	15.23 KB	-rw-r--r--	2026-06-12 05:08

Rename

<!DOCTYPE html SYSTEM "about:legacy-compat">
<html lang="en"><head><META http-equiv="Content-Type" content="text/html; charset=UTF-8">
<meta content="width=device-width, initial-scale=1" name="viewport">

<title>mod_log_forensic - Apache HTTP Server Version 2.4</title>
<link href="../../style/css/manual.css" rel="stylesheet" media="all" type="text/css" title="Main stylesheet">
<link href="../../style/css/manual-loose-100pc.css" rel="alternate stylesheet" media="all" type="text/css" title="No Sidebar - Default font size">
<link href="../../style/css/manual-print.css" rel="stylesheet" media="print" type="text/css"><link rel="stylesheet" type="text/css" href="../../style/css/prettify.css">
<script src="../../style/scripts/prettify.min.js">
</script>

<p>This module provides for forensic logging of client
    requests. Logging is done before and after processing a request, so the
    forensic log contains two log lines for each request.
    The forensic logger is very strict, which means:</p>

<ul>
    <li>The format is fixed. You cannot modify the logging format at
    runtime.</li>
    <li>If it cannot write its data, the child process
    exits immediately and may dump core (depending on your
    <code class="directive"><a href="../mod/mpm_common.html#coredumpdirectory">CoreDumpDirectory</a></code>
    configuration).</li>
    </ul>

<p>The <code>check_forensic</code> script, which can be found in the
    distribution's support directory, may be helpful in evaluating the
    forensic log output.</p>
</div>
<div id="quickview"><h3>Topics</h3>
<ul id="topics">
<li><img alt="" src="../../images/down.gif"> <a href="#formats">Forensic Log Format</a></li>
<li><img alt="" src="../../images/down.gif"> <a href="#security">Security Considerations</a></li>
</ul><h3 class="directives">Directives</h3>
<ul id="toc">
<li><img alt="" src="../../images/down.gif"> <a href="#forensiclog">ForensicLog</a></li>
</ul>
<h3>Bugfix checklist</h3><ul class="seealso"><li><a href="https://www.apache.org/dist/httpd/CHANGES_2.4">httpd changelog</a></li><li><a href="https://bz.apache.org/bugzilla/buglist.cgi?bug_status=__open__&amp;list_id=144532&amp;product=Apache%20httpd-2&amp;query_format=specific&amp;order=changeddate%20DESC%2Cpriority%2Cbug_severity&amp;component=mod_log_forensic">Known issues</a></li><li><a href="https://bz.apache.org/bugzilla/enter_bug.cgi?product=Apache%20httpd-2&amp;component=mod_log_forensic">Report a bug</a></li></ul><h3>See also</h3>
<ul class="seealso">
<li><a href="../logs.html">Apache Log Files</a></li>
<li><code class="module"><a href="../mod/mod_log_config.html">mod_log_config</a></code></li>
</ul></div>
<div class="top"><a href="#page-header"><img alt="top" src="../../images/up.gif"></a></div>
<div class="section">
<h2 id="formats">Forensic Log Format <a title="Permanent link" href="#formats" class="permalink">&para;</a></h2>
    <p>Each request is logged two times. The first time is <em>before</em> it's
    processed further (that is, after receiving the headers). The second log
    entry is written <em>after</em> the request processing at the same time
    where normal logging occurs.</p>

<p>In order to identify each request, a unique request ID is assigned.
    This forensic ID can be cross logged in the normal transfer log using the
    <code>%{forensic-id}n</code> format string. If you're using
    <code class="module"><a href="../mod/mod_unique_id.html">mod_unique_id</a></code>, its generated ID will be used.</p>

<p>The first line logs the forensic ID, the request line and all received
    headers, separated by pipe characters (<code>|</code>). A sample line
    looks like the following (all on one line):</p>

<div class="example"><p><code>
        +yQtJf8CoAB4AAFNXBIEAAAAA|GET /manual/de/images/down.gif
        HTTP/1.1|Host:localhost%3a8080|User-Agent:Mozilla/5.0 (X11;
        U; Linux i686; en-US; rv%3a1.6) Gecko/20040216
        Firefox/0.8|Accept:image/png, <var>etc...</var>
    </code></p></div>

<p>The plus character at the beginning indicates that this is the first log
    line of this request. The second line just contains a minus character and
    the ID again:</p>

<div class="example"><p><code>
      -yQtJf8CoAB4AAFNXBIEAAAAA
    </code></p></div>

<p>The <code>check_forensic</code> script takes as its argument the name
    of the logfile. It looks for those <code>+</code>/<code>-</code> ID pairs
    and complains if a request was not completed.</p>
</div><div class="top"><a href="#page-header"><img alt="top" src="../../images/up.gif"></a></div>
<div class="section">
<h2 id="security">Security Considerations <a title="Permanent link" href="#security" class="permalink">&para;</a></h2>
    <p>See the <a href="../misc/security_tips.html#serverroot">security tips</a>
    document for details on why your security could be compromised
    if the directory where logfiles are stored is writable by
    anyone other than the user that starts the server.</p>
    <p>The log files may contain sensitive data such as the contents of 
    <code>Authorization:</code> headers (which can contain passwords), so
    they should not be readable by anyone except the user that starts the
    server.</p>
</div>
<div class="top"><a href="#page-header"><img alt="top" src="../../images/up.gif"></a></div>
<div class="directive-section"><h2 id="forensiclog"><span id="ForensicLog">ForensicLog</span> Directive <a title="Permanent link" href="#forensiclog" class="permalink">&para;</a></h2>
<table class="directive">
<tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Sets filename of the forensic log</td></tr>
<tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code>ForensicLog <var>filename</var>|<var>pipe</var></code></td></tr>
<tr><th><a href="directive-dict.html#Context">Context:</a></th><td>server config, virtual host</td></tr>
<tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Extension</td></tr>
<tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_log_forensic</td></tr>
</table>
    <p>The <code class="directive">ForensicLog</code> directive is used to
    log requests to the server for forensic analysis. Each log entry
    is assigned a unique ID which can be associated with the request
    using the normal <code class="directive"><a href="../mod/mod_log_config.html#customlog">CustomLog</a></code>
    directive. <code class="module"><a href="../mod/mod_log_forensic.html">mod_log_forensic</a></code> creates a token called
    <code>forensic-id</code>, which can be added to the transfer log
    using the <code>%{forensic-id}n</code> format string.</p>

<p>The argument, which specifies the location to which
    the logs will be written, can take one of the following two
    types of values:</p>

<dl>
      <dt><var>filename</var></dt>
      <dd>A filename, relative to the <code class="directive"><a href="../mod/core.html#serverroot">ServerRoot</a></code>.</dd>

<dt><var>pipe</var></dt>
      <dd>The pipe character "<code>|</code>", followed by the path
      to a program to receive the log information on its standard
      input. The program name can be specified relative to the <code class="directive"><a href="../mod/core.html#serverroot">ServerRoot</a></code> directive.

<div class="warning"><h3>Security:</h3>
      <p>If a program is used, then it will be run as the user who
      started <code class="program"><a href="../programs/httpd.html">httpd</a></code>. This will be root if the server was
      started by root; be sure that the program is secure or switches to a
      less privileged user.</p>
      </div>

<div class="note"><h3>Note</h3>
        <p>When entering a file path on non-Unix platforms, care should be taken
        to make sure that only forward slashes are used even though the platform
        may allow the use of back slashes. In general it is a good idea to always
        use forward slashes throughout the configuration files.</p>
      </div></dd>
    </dl>

</div>
</div>
<div class="bottomlang">
<p><span>Available Languages: </span><a href="../../en/mod/mod_log_forensic.html" title="English">&nbsp;en&nbsp;</a> |
<a href="../../fr/mod/mod_log_forensic.html" hreflang="fr" rel="alternate" title="Fran&ccedil;ais">&nbsp;fr&nbsp;</a> |
<a href="../../ja/mod/mod_log_forensic.html" hreflang="ja" rel="alternate" title="Japanese">&nbsp;ja&nbsp;</a> |
<a href="../../tr/mod/mod_log_forensic.html" hreflang="tr" rel="alternate" title="T&uuml;rk&ccedil;e">&nbsp;tr&nbsp;</a></p>
</div><div id="footer">
<p class="apache">Copyright 2026 The Apache Software Foundation.<br>Licensed under the <a href="https://www.apache.org/licenses/LICENSE-2.0">Apache License, Version 2.0</a>.</p>
<p class="menu"><a href="../mod/index.html">Modules</a> | <a href="../mod/quickreference.html">Directives</a> | <a href="https://cwiki.apache.org/confluence/display/httpd/FAQ">FAQ</a> | <a href="../glossary.html">Glossary</a> | <a href="../sitemap.html">Sitemap</a> | <a href="https://bz.apache.org/bugzilla/enter_bug.cgi?product=Apache%20httpd-2">Report a bug</a></p></div><script><![CDATA[//><!]]></script>
</body></html>