Module 09 - Apache Web Server Logs

Apache Web Server Architecture: The Apache web server follows a modular approach. It consists of two

major components, the _________, and ________.

Apache core & Apache modules

Apache Web Server Architecture: The Apache core addresses the basic functionalities of the server, such as the ________________ and _______________

Allocation of requests and the maintenance & pooling of connections

Apache Web Server Architecture: The Apache modules, which are simply add-ons used for extending the core functionality of the server, handles other functions, such as _____________

Obtaining the user ID from the HTTP request, validating the user, and authorizing the user

Apache Web Server Architecture: What are the elements of the Apache core?

http_protocol

Apache Web Server Architecture: What are the elements of the Apache core?

http_main

Apache Web Server Architecture: What are the elements of the Apache core?

http_request

Apache Web Server Architecture: What are the elements of the Apache core?

http_core

Apache Web Server Architecture: What are the elements of the Apache core?

Alloc.c

Apache Web Server Architecture: What are the elements of the Apache core?

http_config

Apache Web Server Architecture: Apache Web Server Logs: True or False: Apache HTTP Server is a web server that supports many OSs, such as Unix, GNU, FreeBSD, Linux, Solaris, Novell NetWare, AmigaOS, macOS, Microsoft Windows, OS/2 and TPF.

True

Apache Web Server Architecture: Apache Web Server Logs: True or False: Apache HTTP Servers can work under different OSes such as Mac and Windows. As it is a multi-threaded web server, it can perform various functions requested by the client web browsers and implement multiple tasks simultaneously. Apache HTTP Server utilizes modules and extensions to support various environments.

True

Apache Web Server Architecture: Apache Web Server Logs: Apache server generates two log types. Which of the following is one of the two types?

Access log

Apache Web Server Architecture: Apache Web Server Logs: Apache server generates two log types. Which of the following is one of the two types?

Error log

Apache Web Server Architecture: Apache Web Server Logs: True or False: During auditing and forensic investigations, Apache logs provide very important information about all the operations performed on the web server. This information includes client IP addresses, the identity of a client machine, time, client user ID, request line from a client, status code, and the size of the object returned to the client.

True

Apache Web Server Architecture: Apache Access Logs: True or False: All HTTP requests processed by the Apache server are recorded in the access log and has a record of every request that passes through the server.

True

Apache Web Server Architecture: Apache Access Logs: True or False: The CustomLog directive sets the location and content of the access log and it also contains information to configure the server in such a manner that the server can maintain access-log records.

True

Apache Web Server Architecture: Apache Access Logs: Where are the Apache access logs stored?

In the Common Log Format by default and are highly configurable.

Apache Web Server Architecture: Apache Access Logs: Which of the following are default locations for acess logs?

RHEL/Red Hat/CentOS/Fedora Linux: /var/log/httpd/access_log

Apache Web Server Architecture: Apache Access Logs: Which of the following are default locations for acess logs?

Debian/Ubuntu Linux: /var/log/apache2/access.log

Apache Web Server Architecture: Apache Access Logs: Which of the following are default locations for acess logs?

FreeBSD Linux: /var/log/httpd-access.log

Apache Web Server Architecture: Analyzing Apache Access logs: What is the common percent directive log format for Apache access logs?

%h %l %u %t \"%r\" %>s %b

Apache Web Server Architecture: Analyzing Apache Access logs: What is the parameter for “%h” from the common log format for Apache access logs from %h %l %u %t \"%r\" %>s %b?

%h represents the client’s IP address.

Apache Web Server Architecture: Analyzing Apache Access logs: What is the parameter for “%l” from the common log format for Apache access logs from %h %l %u %t \"%r\" %>s %b?

%l represents the remote log name. The latter returns a dash unless mod_ident is present and IdentityCheck is enabled.

Apache Web Server Architecture: Analyzing Apache Access logs: What is the parameter for “%u” from the common log format for Apache access logs from %h %l %u %t \"%r\" %>s %b?

%u is the client user ID

Apache Web Server Architecture: Analyzing Apache Access logs: What is the parameter for “%t” from the common log format for Apache access logs from %h %l %u %t \"%r\" %>s %b?

%t represents the time when the server received the request in the following format: [day/month/year:hour:minute:second zone].

Apache Web Server Architecture: Analyzing Apache Access logs: What is the parameter for “%>s” from the common log format for Apache access logs from %h %l %u %t \"%r\" %>s %b?

\"%r\" indicates the methods used for a request-response between a client and server, the resource requested by a client (apache_pb.gif), and the protocol used (HTTP/1.0).

Apache Web Server Architecture: Analyzing Apache Access logs: What is the parameter for “\%r\” from the common log format for Apache access logs from %h %l %u %t \"%r\" %>s %b?

%>s represents the status code sent by the server to the client.

Apache Web Server Architecture: Analyzing Apache Access logs: What is the parameter for “%b” from the common log format for Apache access logs from %h %l %u %t \"%r\" %>s %b?

%b represents the size of the object transferred from the server to the client.