Accurate traffic log in Apache

Apache module mod_logio provides the logging of input and output number of bytes received/sent per request. The numbers reflect the actual bytes as received on the network, which then takes into account the headers and bodies of requests and responses. The counting is done before SSL/TLS on input and after SSL/TLS on output, so the numbers will correctly reflect any changes made by encryption.

The module requires mod_log_config and when enabled provide two new parameters for LogFormat:

%...I Bytes received, including request and headers.
%...O Bytes sent, including headers.

If you run Awstats or something similar this might be useful to measure the real bandwidth usage of your web site.

It could also be useful to monitor file uploads, incomplete/dropped downloads and, I guess, to detect dos attacks like Slowloris.

If you intend to detect incomplete downloads, bear in mind that %O will be the total bytes sent, including headers, not just the file size.

And if you use both %B and %O, you will be also able to calculate you header size (%O minus %B), ie in case in you pass data in HTTP headers.

© 2012 Devis Lucato @itbus.