# Common Log Format (Apache/Nginx)

Key: `datetime.timestamp.clf`

Apache and Nginx Common Log Format timestamp. Note the distinctive colon between date and time with no space, and abbreviated month. Billions of log lines generated daily in this format worldwide.

Page: <https://meridian.online/docs/projects/finetype/types/datetime/timestamp/clf>

Format: `%d/%b/%Y:%H:%M:%S %z`

Alternative format: `[%d/%b/%Y:%H:%M:%S %z]`

Samples: `15/Jan/2024:14:30:00 +0000`, `31/Dec/2023:23:59:59 -0500`, `01/Jun/2024:08:15:30 +0530`

## Background

### Origin

The W3C httpd documentation says that previously every web server had its own logfile format, which made it difficult to write general statistics collectors.[[1]](https://www.w3.org/Daemon/User/Config/Logging.html) W3C httpd generated all of its log files in the common logfile format that several WWW servers use.[[1]](https://www.w3.org/Daemon/User/Config/Logging.html) The W3C httpd documentation lays out a common logfile entry as remotehost rfc931 authuser \[date\] "request" status bytes.[[1]](https://www.w3.org/Daemon/User/Config/Logging.html) Times in a W3C httpd log file are local time by default.[[1]](https://www.w3.org/Daemon/User/Config/Logging.html) The Common Log Format is also known as the NCSA Common log format.[[2]](https://en.wikipedia.org/wiki/Common_Log_Format)

The Apache HTTP Server documentation defines the CLF time field as \[day/month/year:hour:minute:second zone\].[[3]](https://httpd.apache.org/docs/2.4/logs.html) In the Apache definition, the day is two digits, the month is three letters and the year is four digits.[[3]](https://httpd.apache.org/docs/2.4/logs.html) In the Apache definition, the zone is a plus or minus sign followed by four digits.[[3]](https://httpd.apache.org/docs/2.4/logs.html) Apache's example CLF timestamp is \[10/Oct/2000:13:55:36 -0700\].[[3]](https://httpd.apache.org/docs/2.4/logs.html) Wikipedia gives the Common Log Format timestamp in strftime notation as %d/%b/%Y:%H:%M:%S %z.[[2]](https://en.wikipedia.org/wiki/Common_Log_Format)

### Use

Apache's documentation says the Common Log Format can be produced by many different web servers and read by many log analysis programs.[[3]](https://httpd.apache.org/docs/2.4/logs.html) In Apache's log format strings, %t is the time the request was received, and its last number is the timezone offset from GMT.[[4]](https://httpd.apache.org/docs/2.4/mod/mod_log_config.html) Apache can write the time in another format through %{format}t, using an extended strftime(3) format that is potentially localized.[[4]](https://httpd.apache.org/docs/2.4/mod/mod_log_config.html) In nginx, the variable $time\_local holds local time in the Common Log Format.[[5]](https://nginx.org/en/docs/http/ngx_http_log_module.html) The nginx predefined combined log format places $time\_local inside square brackets.[[5]](https://nginx.org/en/docs/http/ngx_http_log_module.html) nginx also offers $time\_iso8601, which holds local time in the ISO 8601 standard format.[[5]](https://nginx.org/en/docs/http/ngx_http_log_module.html) Wikipedia notes that the Combined Log Format extends the Common Log Format with referer and user-agent fields.[[2]](https://en.wikipedia.org/wiki/Common_Log_Format)

If a server may have been set up with a custom time format, check a few lines for the month names before trusting a parse. (Meridian's view)

## Sources

1. [Logging in W3C httpd](https://www.w3.org/Daemon/User/Config/Logging.html) — documentation
2. [Common Log Format - Wikipedia](https://en.wikipedia.org/wiki/Common_Log_Format) — secondary source
3. [Log Files - Apache HTTP Server Version 2.4](https://httpd.apache.org/docs/2.4/logs.html) — documentation
4. [mod\_log\_config - Apache HTTP Server Version 2.4](https://httpd.apache.org/docs/2.4/mod/mod_log_config.html) — documentation
5. [Module ngx\_http\_log\_module](https://nginx.org/en/docs/http/ngx_http_log_module.html) — documentation