Configuring Jetty 10/11 Request Logs

Question

I am going through the post jetty logging and trying to figure out what is meaning of every attribute that prints

123.4.5.6 - - [27/Aug/2004:10:16:17 +0000] "GET /jetty/tut/XmlConfiguration.html HTTP/1.1" 200 76793 "http://localhost:8080/jetty/tut/logging.html" "Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.6) Gecko/20040614 Firefox/0.8"

I am got the answers for some but still not able to figure out for some as mentioned below.

1. 123.4.5.6 : request.getRemoteAddr()
2. dash(-) : not able to figure out
3. dash(-) : not able to figure out
4. [27/Aug/2004:10:16:17 +0000] : timestamp
5. GET : request.getMethod()
6. jetty/tut/XmlConfiguration.html : request.getRequestURI()
7. HTTP/1.1 : request.getProtocol()
8. 200 : response.getStatus()
9. 76793 : response.getHttpChannel().getBytesWritten()
10. http://localhost:8080/jetty/tut/logging.html : not able to figure out
11. Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.6) Gecko/20040614 Firefox/0.8 : request.getHeader("User-Agent")

Please correct me if I am wrong for other attributes as well.

Answer 1

Recent versions of Jetty log requests with the CustomRequestLog format.

Which has 2 default "NCSA" formats for output (along with a few others and the ability to customize the format)

1. NCSA_FORMAT - syntax declaration of "%{client}a - %u %t \"%r\" %s %O"
2. EXTENDED_NCSA_FORMAT - syntax of NCSA_FORMAT + " \"%{Referer}i\" \"%{User-Agent}i\""

So, according to the documentation on CustomRequestLog, that means that the following output ...

123.4.5.6 - - [27/Aug/2004:10:16:17 +0000] "GET /jetty/tut/XmlConfiguration.html HTTP/1.1" 200 76793 "http://localhost:8080/jetty/tut/logging.html" "Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.6) Gecko/20040614 Firefox/0.8"

is actually one of the extended NCSA formats.

Broken down like this ...

1. 123.4.5.6 : the %{client}a which is the request.getRemoteHost()
2. - : the - a hardcoded string of - in Jetty, that entry would have been the "remote log name user", but since Jetty doesn't support identd, we don't have a means to fill this value out (identd is old school tech that never saw a big adoption for http)
3. - : the %u which is the authenticated user name, which comes from Jetty internal APIs (eg: Request.getAuthentication() or Authentication.getUserIdentity() - this only works if your webapp is using Servlet security / authentication / authorization - custom authentication techniques will not have this entry filled out.
4. [27/Aug/2004:10:16:17 +0000] : the %t which is the Jetty API Request.getTimeStamp() which is set in stone when the request was finished being parsed, but before its dispatched to a handler or webapp for processing.
5. "GET /jetty/tut/XmlConfiguration.html HTTP/1.1" : the \"%r\" which is the raw "Request Line" used in HTTP. Which is the first line of the HTTP request. (or request.getMethod() + request.getOriginalURI() + request.getProtocol())
6. 200 : the %s which is the status as committed on the response obtained from the Jetty internal API response.getCommittedMetadata().getStatus() (this API exists because the HttpServletResponse is mutable, and many webapps tend to modify it after it's been sent which would mean we log a value that wasn't actually sent if we used the standard servlet API here)
7. 76793 : the %O which is the bytes sent on the network as part of the response which comes from the Jetty internal APIs response.getHttpChannel().getBytesWritten()
8. "http://localhost:8080/jetty/tut/logging.html" : the \"%{Referer}i\" which is request Referer line (yes, it's spelled incorrectly, but there's ancient HTTP history here for why that's the case). It comes from request.getHeader("Referer"), which can be empty in many cases.
9. "Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.6) Gecko/20040614 Firefox/0.8" : the \"%{User-Agent}i\" is the same as above, but for the User-Agent request header.

You can customize this output in countless ways, just read the CustomRequestLog apidoc and create a format of your own that has what you want and/or what you are looking for.

https://javadoc.io/doc/org.eclipse.jetty/jetty-server/latest/org.eclipse.jetty.server/org/eclipse/jetty/server/CustomRequestLog.html

Answer 2

Jetty logs in the NCSA format by default. According to that,

• (2) would be the RFC 931 "remote log name of the user"
• (3) would be the "The username as which the user has authenticated himself"

Not sure, but I don't think that any of these will have a value anytime.

• (10) this is the referrer (the page which led to this request via a hyperlink), the data is in the header - see Stack Overflow question 2648984