Smarter by Design.Simpler for Business
Apache Combined Log Format (HTTP)
About the Format
Apache Combined Log Format is an extended format that adds the Referer and User-Agent information to the Standard Log Format. It takes place in the Line Format list in the profile form with the Apache Combined Log Format ( Standard + Referrer + User Agent ) option.
Since this format records where the users come from (referer) and which browser/client they use (user agent), it is ideal for traffic analysis and user behavior monitoring.
Use cases
- Traffic source analysis (referer tracking).
- Browser and device statistics.
- Bot and crawler detection.
- Marketing and SEO analysis.
Supported Features
HTTP vService
L7 TCP vService
WAF Information
SSL Information
WARNING
If this format is assigned to an L7 TCP vService, the Referer/User-Agent fields are not produced; the line silently turns into the Standard (L7 TCP) format.
Example Log
text
172.16.101.42 - - [09/Sep/2026:17:37:06 +0000] "GET /login.php HTTP/1.1" 200 1011 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36"Field Descriptions
| Field | Example Value | Description |
|---|---|---|
| Client IP | 172.16.101.42 | The client IP address |
| Ident | - | RFC 1413 ident information; it is not filled under any condition in this format. |
| User | - | The HTTP Auth username; it is not carried in this format. |
| Timestamp | 09/Sep/2026:17:37:06 +0000 | The time at which the request was received (GMT) |
| Request Line | "GET /login.php HTTP/1.1" | The HTTP request line (method, path, version); it is enclosed in double quotes |
| Status Code | 200 | The HTTP response status code |
| Bytes | 1011 | The total size of the response served to the client (bytes). The response headers are also included in this number; for this reason the value is greater than the Content-Length header. |
| Referer | "" | The address of the page from which the request came; it is taken from the Referer header sent by the client |
| User-Agent | "Mozilla/5.0 (Windows NT 10.0; ..." | The client browser or application information; it is taken from the User-Agent header |
Where do the Referer and User-Agent values come from?
These two fields are taken directly from the Referer and User-Agent headers sent by the client. The value is the raw form of the header; no shortening or normalization is applied on the TR7 side.
The client IP address changes with Trusted Proxy
If a Trusted Proxy profile is assigned to the vService, the Client IP field carries the real client address resolved from the header defined in the profile instead of the address of the proxy. If no profile is assigned, the address of the side that connects to TR7, that is, the outgoing address of the proxy/CDN, appears in the field.
Referer Field
The Referer field shows from which page the user came. The field is always written in double quotes; for this reason it keeps its place in the line even if the value is empty.
| Value | Meaning |
|---|---|
"https://example.com/page" | The user came from this address |
"" | The client did not send a Referer header. The requests typed directly into the address bar, the bookmarks and the first page openings fall into this situation; the example log above is also this. |
INFO
Some browsers do not send the referer information at all for privacy reasons, or send it by shortening it only to the source domain name. In the first case the field becomes "", in the second it carries the shortened value in quotes.
User-Agent Analysis
Example User-Agent:
text
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36| Component | Value | Description |
|---|---|---|
| Platform | Windows NT 10.0 | The operating system and its version |
| Architecture | Win64; x64 | The 64-bit processor architecture |
| Engine | AppleWebKit/537.36 | The browser rendering engine |
| Browser | Chrome/152.0.0.0 | The browser and version |
Common Bot User-Agents
| Bot | User-Agent Content |
|---|---|
| Googlebot | Googlebot/2.1 |
| Bingbot | bingbot/2.0 |
| curl | curl/ |
| wget | Wget/ |
| Python | python-requests/ |
Standard / Combined / VHost Comparison
| Feature | Standard | Combined | Apache VHost |
|---|---|---|---|
| Client IP | ✓ | ✓ | ✓ |
| Timestamp | ✓ | ✓ | ✓ |
| Request Line | ✓ | ✓ | ✓ |
| Status Code | ✓ | ✓ | ✓ |
| Response Size (Bytes) | ✓ | ✓ | ✓ |
| Referer | ✗ | ✓ | ✓ |
| User-Agent | ✗ | ✓ | ✓ |
| Virtual Host (Domain) | ✗ | ✗ | ✓ |
