Log Format

Learning Focus

By the end of this lesson you will understand the default access log format and how to customize it.

Default Log Format

OpenLiteSpeed uses a Combined Log Format by default, similar to Apache:

%h %l %u %t "%r" %>s %b "%{Referer}i" "%{User-Agent}i"

Field	Description	Example
%h	Client IP address	203.0.113.50
%t	Timestamp	[10/Mar/2026:14:30:00 +0000]
%r	Request line	GET /page HTTP/1.1
%>s	Status code	200
%b	Response size (bytes)	4523
Referer	Referring URL	https://google.com
User-Agent	Browser/client string	Mozilla/5.0 ...

Reading Access Logs

# View recent entries
tail -20 /usr/local/lsws/logs/access.log

# Count requests by status code
awk '{print $9}' /usr/local/lsws/logs/access.log | sort | uniq -c | sort -rn

# Top 10 requested URLs
awk '{print $7}' /usr/local/lsws/logs/access.log | sort | uniq -c | sort -rn | head -10

# Top 10 client IPs
awk '{print $1}' /usr/local/lsws/logs/access.log | sort | uniq -c | sort -rn | head -10

Customizing in WebAdmin

1. Server Configuration → Log → Access Log
2. Adjust Log Format field
3. Save and Graceful Restart

Key Takeaways

• The Combined Log Format gives you IP, timestamp, URL, status, and user agent per request.
• Use awk and sort commands to quickly analyze log patterns.
• Customize the format if you need additional fields.

What's Next

• Continue to Log Rotation for managing log file sizes.