Show TOC

Defining Your Own Log File FormatsLocate this document in the navigation structure

Context

You can select a format for log file entries or define one yourself. Log file formats are defined using subparameter LOGFORMAT of profile paramater icm/HTTP/logging_<xx> for inbound requests, or subparameter LOGFORMAT of profile parameter icm/HTTP/logging_client_<xx> for outbound requests. This section explains how you can define your own log file format.

Note Performance is significantly better when predefined log file formats are used rather than your own format strings, as with predefined formats each element of the format string has to be determined and output separately.

Procedure

Define LOGFORMAT in profile parameter icm/HTTP/logging_<xx> or in profile parameter icm/HTTP/logging_client_<xx> using the available placeholders.
You can use the following placeholders:

%b

Length of the response in bytes

%r0 or %r

1. Line of an HTTP request with the original path and form fields: For example, GET /sap(bD1kZSZjPTAwMA==)/bc/ping?lang=de HTTP/1.0 .

%r1

1. Line of an HTTP request with the original path without form fields: For example, GET /sap(bD1kZSZjPTAwMA==)/bc/ping HTTP/1.0

%r2

1. Line of an HTTP request with URL-decoded path without form fields: For example, GET /sap/bc/ping HTTP/1.0

%f

Name of requested object without form fields.

%U

Whole URI of a request (with form fields).

%s

OK code of the response.

%p0

Whole original URI of a request (with form fields), equivalent to %U.

%p1

Whole original URI of a request (without form fields).

%p2

URL-decoded path without form fields, equivalent to %f.

%p3

URL-decoded path with form fields.

%{name}i

Name of a request header field, e.g. %{user-agent}i.

%{[?]}i

Output of all request header fields in format [name1 : value1][name2 : valuet2]...

%{?;}i

Output of all request header fields in format name1 : value1;name2 : value2; … ;name_n : value_n.

You are free to choose the separators between each header field.

%{name}o

Name of a response header field, e.g. %{server}o.

%{[?]}o

Output of all response header fields in format [name1 : value1][name2 : valuet2]...

%{?;}o

Output of all response header fields in format name1 : value1;name2 : value2; … ;name_n : value_n.

You are free to choose the separators between each header field.

%{cookie}c

Output of a request cookie.

%{cookie}C

Output of a response cookie.

%{formfield}F

Name of a request form field, for example, %{sap-client{F.

%{semfield}E

Name of a semicolon field.

%T

Duration of a request in seconds.

%L

The duration of a request in milliseconds.

%j

Log: HTTP or HTTPS.

%h

Name of the remote host (the client, such as the browser)

%h0

Like %h

%h1

If the header field x-forwarded-for is set, this is the value of the header field, otherwise it is the name of the host directly in front of the ICM (or the Web dispatcher), that is, the client, for example, the browser.

%H

Name of local host

%V

Fully-qualified host name (FQHN) of the server (value of parameter icm/host_name_full or FQHN of the operating system).

%v

Name of the virtual host (IP address or name of the server with which the client is linked)

%a

IP address of the remote host

%S

Local port name or service

%l

Specifies the “remote log name”. This name is the result of an IDENT query to the client. This only works if the identity check is activated there.

%u

User name of 401 authentication

Caution

If single sign-on is active, you will only see a - here.

%t

Time specification in CLF format: [15/Dec/2007:16:18:35 +0100]

%q

HTTP request ID in following notation: <conn slot>/<conn uid>/<rq id>

The following applies here: <conn slot>/<conn uid> describes the ICM connection.

<rq id> is the sequential number of the HTTP request in the connection. The HTTP request ID is unique for the life span of the ICM process.

%M1

Recording of HTTP requests in microseconds, in the form

t0(pfclock):…;dt1(us):…;dt2(us):…;dt3(us):…;dt4(us):-;total(us):

The times of the recording are:

  • 0: Start of HTTP request processing

  • 1: Request is sent to the server

  • 2: End of HTTP request processing

  • 3: Start of HTTP response processing

  • 4: End of HTTP response processing

    Since this time point comes after the HTTP log entry has been written, it is not recorded in the HTTP log.

The absolute value of the time point 0 is the value of the ABAP command GET RUN TIME. The remaining values are recorded as delta values.

%M2

Recording of HTTP requests in microseconds, in the form

t0(timeofday):…;dt1(us):…;dt2(us):…;dt3(us):…;dt4(us):-;total(us):…

As with placeholder %M1, the absolute value of the time point 0 is the value of the operating system function gettimeofday.

%m1

Like %M1, but in milliseconds.

%m2

Like %M2, but in milliseconds.

%B1

Back-end type, possible values: ABAP, JAVA, NET.

  • ABAP: Logging is active in the ICM and the request is forwarded to AS ABAP.

  • JAVA: Logging is active in the ICM and the request is forwarded to AS JAVA.

  • NET: Logging is active in the Web Dispatcher. The request is sent through the network to an ICM of the SAP system.

%B2

Backend information is output; the WP number is output for ABAP and the cluster ID for JAVA.

Example

With the format: %h %l %u %t "%r" %s %b %B1:%B2 the following entries are written:

127.0.0.1 - - [08/Mar/2007:21:19:25 +0100] "GET /sap/public/icf_info/icr_urlprefix HTTP/1.0" 200 11376 ABAP:1

10.18.203.72 - - [08/Mar/2007:21:20:03 +0100] "GET /images/title.gif HTTP/1.1" 304 - JAVA:606993150

In the first case, the request went from the ICM to the AS ABAP and was processed there by work process 1. In the second case, the request went from the ICM to the AS Java and was processed by the server process with the cluster ID 606993150.

%w1 SID of the back-end system (from wdisp/system) to which an HTTP request was sent.
%w2 Instance of the back-end system to which an HTTP request was sent.
Example

You can reproduce the “NCSA Combined Log Format” known to other Web servers by using the following format string:

LOGFORMAT=%h %l %u %t "%r" %s %b "%{referer}i" "%{user-agent}i"