看lighttpd的日志时,对某些字段的含义不太清楚,找到个配置说明如下,希望对分析lighttpd日志有帮助。
lighttpd.conf中的日志格式配置:
accesslog.format = "%{X-Forwarded-For}i %l %u %t "%r" %>s %b mod_gzip: %{gzip_ratio}npct. "%{Referer}i" %{Cookie}i "%{User-Agent}i" model:"%{MM
实际的日志:
xxx.xx.xx.x - - [21/Aug/2013:16:39:39 +0800] "GET /xqsingle/?xxxxx HTTP/1.1" 200 49681 mod_gzip: 100pct. "-" xx "-" model:"-"
问题:49681代表什么?
方法:对照下表,检查日志格式配置
- %% a percent sign
- %h name or address of remote-host
- %l ident name (not supported)
- %u authenticated user
- %t timestamp of the end-time of the request
- %r request-line
- %s status code
- %b bytes sent for the body
- %i HTTP-header field
- %a remote address
- %A local address
- %B same as %b
- %C cookie field (not supported)
- %D time used in ms (not supported)
- %e environment
- %f physical filename
- %H request protocol (HTTP/1.0, ...)
- %m request method (GET, POST, ...)
- %n (not supported)
- %o `response header`_
- %p server port
- %P (not supported)
- %q query string
- %T time used in seconds
- %U request URL
- %v server-name
- %V HTTP request host name
- %X connection status
- %I bytes incomming
- %O bytes outgoing
回答:代表返回的字节大小