B211 Lab Week 4 (2)

Laboratory Week 4 part II - Web Server Logs

Learning Objectives:

Learn how to make use of Apache web server log files to get information about web access to a certain site.

Before doing the tutorial, please read:

Topic 2 lectures on "What in the world is the World Wide Web?" and "Internals of the Web Server".

Software required:

This lab only requires a SSH or TELNET session to red.murdoch.edu.au. Students in the internal labs may make use of the PuTTY application to do so. External students may download the same software from the unit's downloads page.

Exercises:

These exercises requires the use of the Linux command line on red.murdoch.edu.au. Refer to lab week 3 on how to log onto red. Those who do not know Linux can try the commands below as instructed. Those wishing to do more will need to learn how to use Linux command. If you haven't had any prior experience with Linux, and would like to start, look through my brief introduction to linux commands.

All web servers keep logs of some kind regarding requests that it receives. Exactly what and how much is logged depends on how the system administrator configures the server.

In the standard installation of Apache, there are two log files which the server dumps information on requests it successfully serves (access_log), and request which caused errors (error_log). Using logs such as these, you can calculate some basic statistics.

Our linux server red has an Apache server running, handling access to red's web site, which includes your web pages in your public_html directories. Apache's logs are stored in /var/log/httpd/ of the file system. You can try the following commands (the characters in bold is what you type in, but use your own student number and password):

Red Hat Linux release 6.1 (Cartman)
Kernel 2.2.12-20 on an i686
login: s202020A
password:

[s202020A@red s202020A]$ ls /var/log/httpd/
This command shows a listing of the files in the Apache log directory.

[s202020A@red s202020A]$ tail -10 /var/log/httpd/access_log
This command shows the last 10 requests served by red's webserver. An example line:
61.9.173.196 - - [22/Jul/2001:18:36:48 +0800] "GET /manual/index.html HTTP/1.1" 404 298
means the request came from machine with IP address 61.9.173.196; the request was made on 22nd July 2001 6:36pm local time; the requested file is in manual/index.html of the server's root directory; the status code sent back to the browser is 404; the number of bytes sent back is 298.

[s202020A@red s202020A]$ cat /var/log/httpd/access_log | grep hiew | wc -lThis line

gets the contents of the access_log file, then

sends it to the grep program which extracts all the lines containing the phrase 'hiew', then

sends it to the wc program which counts the number of lines.

In effect, this line shows how many hits pages in hiew's directories have received.

There are many more things you can do with the information. It will depend on your familiarity with Linux commands. If you are not familiar with Linux, you can even FTP the file down to your local machine, and use programs like EXCEL to do further analysis.

Note: the purpose of this exercise is to raise your awareness on what is commonly logged by web servers, and what you can do with it. Please use such information with consideration, and respect other people privacy if you do happen to be able to gain access to it. This applies not only to this server, but to other servers you have access to as well.

Remember to read the week's development on the Internet by scanning through relevant articles in the IT section of Tuesday's the Australian newspaper - use the online version or the physical copy in the University library. Get into the habit of keeping up with current developments. Test your knowledge of major developments by going through the Good News Week self-tests.

H.L. Hiew
Unit Coordinator