Deutsch
Log data & formats

Combined Log Format

The Combined Log Format is a line format for web server access logs. It is the Common Log Format plus two fields, the referer and the user agent.

Field order

Apache defines it like this:

Apache
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\"" combined
  • %h client IP address
  • %l client identity per RFC 1413, which Apache calls very unreliable (usually -)
  • %u authenticated user, otherwise -
  • %t timestamp in square brackets
  • %r request line with method, path and protocol
  • %>s final HTTP status code
  • %b response size in bytes, without headers
  • referer and user agent, each in quotes

nginx ships a predefined format called combined with the same content: $remote_addr, $remote_user, $time_local, $request, $status, $body_bytes_sent, $http_referer and $http_user_agent. It applies to access_log when no other format is named.

IP addresses can be personal data (CJEU, judgment of 19 October 2016, C-582/14, Breyer).

This is not legal advice.

One log line in Combined Log Format, field by fieldSample line from an access log in Combined Log Format, split into IP address, identity and user, timestamp, request line, status code, bytes, referrer and user agent. The user agent claims to be Googlebot, but the IP address comes from a range reserved for documentation. Only a DNS or IP list check shows whether Google made the request.access.log, one line (wrapped)203.0.113.7 - - [08/Oct/2026:10:15:32 +0200] "GET /en/glossary/ HTTP/1.1" 200 5120 "-""Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"IP address203.0.113.7client, or the proxy in betweenIdentity, user- -“-” means not availableTimestamp[08/Oct/2026:10:15:32 +0200]when the request arrivedRequest"GET /en/glossary/ HTTP/1.1"method, path, protocolStatus200status code of the responseBytes5120size without headers, “-” if emptyReferrer"-"referring page, none hereUser agentline 2what the client says about itselfThe user agent claims to be Googlebot, but the IP is in a range reserved for documentation (RFC 5737).Only a DNS or IP list check shows whether Google made the request.
Apache and nginx write the same fields in the same order in the “combined” format. IP addresses can be personal data (CJEU, judgment of 19 October 2016, C-582/14). Not legal advice. Sources: Apache HTTP Server: Log Files (Combined Log Format); nginx: Module ngx_http_log_module (log_format combined); RFC 5737: IPv4 Address Blocks Reserved for Documentation; CJEU: Press release 112/16 on judgment C-582/14.

Use in SEO

The user agent lets you separate search engine and AI bot requests from other traffic, and the status code shows how the server responded. The format has no field for response time. If you need one, define a custom format, because a field that was never logged cannot be added to old lines.

Example

Text
66.249.66.1 - - [10/Oct/2026:13:55:36 +0000] "GET /products/ HTTP/1.1" 200 2326 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"

The referer is - because no referring page was sent. The example is invented.

Sources

  1. Log Files - Apache HTTP Server 2.4httpd.apache.org
  2. Module ngx_http_log_module - nginxnginx.org
  3. CJEU, judgment of 19 October 2016, C-582/14 (Breyer) – EUR-Lexeur-lex.europa.eu

Last updated: