Guidelines on Securing Public Web Servers

Referrer Log

   Collects information relevant to HTTP access.  This includes the 

URL of the page that contained the link that the user client software followed to 

initiate the access to the Web page. 

Most Web servers support the Transfer Log and it is usually considered the most important.  

Several log formats are available for Transfer Log entries.  Typically, the information is 

presented in plain ASCII without special delimiters to separate the different fields [CERT00]: 

Common Log Format

   This format stores the following information related to one 

transfer (Transfer Log) in the indicated order: 

Remote host 

Remote user identity in accordance with RFC 1413

35

Authenticated user in accordance with the basic authentication scheme (see 

Section 7.3)  

Date 

URL requested 

Status of the request 

Number of bytes actually transferred. 

Combined Log Format

   This format contains the same seven fields above.  It also 

provides information normally stored in the Agent Log and the Referrer Log, along 

with the actual transfer.  Keeping this information in a consolidated log format may 

support more effective administration. 

Extended Log Format

   This format provides a way to describe all items that should 

be collected within the log file.  The first two lines of the log file contain the version 

and the fields to be collected, and they appear in the log file as follows: 

#Version: 1.0 

#Fields: date time c ip sc bytes time taken cs version 

1999 08 01 02:10:57 192.0.0.2 6340 3 HTTP/1.0 

This example contains the date, time, originating address, number of bytes transmitted, time 

taken for transmission, and the HTTP version.  

Other Log File Formats

   Some server software provides log information in 

different file formats, such as database formats or delimiter separated formats.  Other 

server software provides the capability for an administrator to define specific log file 

formats in the Web server configuration file using a particular syntax (if the default 

CLF format is insufficient). 

35

 See the Internet Engineering Task Force Web site: 

http://www.ietf.org/rfc/rfc1413.txt?number=1413

.  

79