Apache VHost Log Format (HTTP)

About the Format

Apache VHost Log Format is an extended format that adds the Virtual Host information to the Combined format. It takes place in the Line Format list in the profile form with the Apache VHost Log Format ( Vhost + Standard + Referrer + User Agent ) option.

This format is used to distinguish to which virtual host every request was made when more than one domain or service is hosted on the same TR7.

Use cases

• Multi-tenant environments.
• The systems that host more than one domain.
• Virtual hosting configurations.
• Host-based log parsing.

Supported Features

HTTP vService

L7 TCP vService

WAF Information

SSL Information

WARNING

If this format is assigned to an L7 TCP vService, the Virtual Host/Referer/User-Agent fields are not produced; the line silently turns into the Standard (L7 TCP) format.

Example Log

test.tr7.com 172.16.101.42 - - [09/Sep/2026:17:39:57 +0000] "GET /login.php HTTP/1.1" 200 1011 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36"

Field Descriptions

Field	Example Value	Description
Virtual Host	test.tr7.com	The host information to which the request was made. It is written at the very beginning of the line and without quotes.
Client IP	172.16.101.42	The client IP address
Ident	-	RFC 1413 ident information; it is not filled under any condition in this format.
User	-	The HTTP Auth username; it is not carried in this format.
Timestamp	09/Sep/2026:17:39:57 +0000	The time at which the request was received (GMT)
Request Line	"GET /login.php HTTP/1.1"	The HTTP request line (method, path, version); it is enclosed in double quotes
Status Code	200	The HTTP response status code
Bytes	1011	The total size of the response served to the client (bytes). The response headers are also included in this number; for this reason the value is greater than the Content-Length header.
Referer	""	The address of the page from which the request came; it is taken from the Referer header sent by the client. In the example it is empty because the client did not send this header.
User-Agent	"Mozilla/5.0 (Windows NT 10.0; ..."	The client browser or application information; it is taken from the User-Agent header

Virtual Host Field

The Virtual Host field is taken in its raw form from the HTTP Host header sent by the client; TR7 does not normalize this value. For this reason its form changes according to what the client that makes the request writes in the address bar:

Form	Example	When it is seen
Domain	test.tr7.com	When the request is made to the default port (80 on HTTP, 443 on HTTPS); the browser does not write the port in the Host header. The example log above is in this situation.
Domain:Port	api.example.com:8443	On the requests made to a port other than the default
IP (with the port if necessary)	172.16.102.98:8022	On the requests made directly with the IP address instead of the domain name; on a request made to the default port, the port is not written

The client IP address changes with Trusted Proxy

If a Trusted Proxy profile is assigned to the vService, the Client IP field carries the real client address resolved from the header defined in the profile instead of the address of the proxy. If no profile is assigned, the address of the side that connects to TR7, that is, the outgoing address of the proxy/CDN, appears in the field.

The field can remain empty

If the client does not send a Host header (old HTTP/1.0 clients, rough tools), the field is produced empty and the line starts with a space. Since the field is not enclosed in quotes, the number of fields shifts in this situation; the parsers that rely on a fixed field order mistake the Client IP for the Virtual Host.

WARNING

Since the value comes from the client, it is not a reliable identity; requests can be sent to the same vService with different Host headers. If host-based distinction is really required, the Virtual Hosting configuration at the vService level is used.

Use Example: Host-Based Filtering

This format is ideal for filtering the logs on a host basis.

The examples assume a raw log line

The commands below assume that the file consists of the raw log lines. If local (default), rfc3164, rfc5424 or priority is selected as the Log Standard in the log profile, a syslog prefix (priority, date, process name) is added to the beginning of every line and the field orders shift. In this case, either the collector must strip the prefix or raw must be selected in the profile.

# Filter the logs of a specific host
grep "^test.tr7.com" access.log

# The number of logs on a host basis
awk '{print $1}' access.log | sort | uniq -c | sort -rn

Standard / Combined / VHost Comparison

Feature	Standard	Apache Combined	VHost
Client IP	✓	✓	✓
Timestamp	✓	✓	✓
Request Line	✓	✓	✓
Status Code	✓	✓	✓
Response Size (Bytes)	✓	✓	✓
Referer	✗	✓	✓
User-Agent	✗	✓	✓
Virtual Host (Domain)	✗	✗	✓