I'm curious if there is a program that runs on a console window and displays a new line for every request made to your web server. On each line is information about the request, i.e. their IP address, etc.

Is there such a thing out there?

More details:

  • I'm running Apache.
  • Ideally it should update in real-time.
  • Preferably free.
  • Can run it on the machine the server is running on.
  • 1
    What server software? remote or local to server? what pricing? all would be good to know for best answering ability. (Welcome to SR :)) Aug 16, 2014 at 9:41
  • Packet capture software would be able to do this as well (for small pages.. otherwise it would split into multiple packets) and could be filtered easily by IP address and port Aug 16, 2014 at 14:23
  • 1
    Related: Question for a Linux tool with GUI: Apache Log Viewer alternative for Linux
    – unor
    Aug 18, 2014 at 0:32

1 Answer 1


It depends on your web server and how it is configured but they are called logs - if you find out where the logs are produced and then use tail you can view them as they are happening. Most web servers allow the amount of detail in the logs to be varied enormously.

For Apache the details that can be captured can be controlled in a number of ways but the custom log format is detailed below:

Custom Log Formats

The format argument to the LogFormat and CustomLog directives is a string. This string is used to log each request to the log file. It can contain literal characters copied into the log files and the C-style control characters "\n" and "\t" to represent new-lines and tabs. Literal quotes and back-slashes should be escaped with back-slashes.

The characteristics of the request itself are logged by placing "%" directives in the format string, which are replaced in the log entry by the values as follows:

%...a:          Remote IP-address 
%...A:          Local IP-address 
%...B:          Bytes sent, excluding HTTP headers. 
%...b:          Bytes sent, excluding HTTP headers. In CLF format
                i.e. a '-' rather than a 0 when no bytes are sent. 
%...c:          Connection status when response was completed.
                'X' = connection aborted before the response completed.
                '+' = connection may be kept alive after the response is sent.
                '-' = connection will be closed after the response is sent. 
%...{FOOBAR}e:  The contents of the environment variable FOOBAR 
%...f:          Filename 
%...h:          Remote host 
%...H           The request protocol 
%...{Foobar}i:  The contents of Foobar: header line(s) in the request
                sent to the server. 
%...l:          Remote logname (from identd, if supplied) 
%...m           The request method 
%...{Foobar}n:  The contents of note "Foobar" from another module. 
%...{Foobar}o:  The contents of Foobar: header line(s) in the reply. 
%...p:          The canonical Port of the server serving the request 
%...P:          The process ID of the child that serviced the request. 
%...q           The query string (prepended with a ? if a query string exists, otherwise an empty string) 
%...r:          First line of request 
%...s:          Status.  For requests that got internally redirected, this is
                the status of the *original* request --- 
%...>s for the last. 
%...t:          Time, in common log format time format (standard english format) %...{format}t:  The time, in the form given by format, which should
                be in strftime(3) format. (potentially localized) 
%...T:          The time taken to serve the request, in seconds. 
%...u:          Remote user (from auth; may be bogus if return status (%s) is 401) 
%...U:          The URL path requested, not including any query string. 
%...v:          The canonical ServerName of the server serving the request. 
%...V:          The server name according to the UseCanonicalName setting. The "..." can be nothing at all (e.g., "%h %u %r %s %b"), or it can indicate conditions for inclusion of the item (which will cause it to be replaced with "-" if the condition is not met). The forms of condition are a list of HTTP status codes, which may or may not be preceded by "!". Thus, "%400,501{User-agent}i" logs User-agent: on 400 errors and 501 errors (Bad Request, Not Implemented) only; "%!200,304,302{Referer}i" logs Referer: on all requests which did not return some sort of normal status.

There are also a number of free and paid for analysers available.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.