Since CLF is relatively difficult to parse, I recommend defining a LogFormat
that is better suited to parsing. As of Apache 1.3.6 we can use tab's
in our format strings. Consider the following modifications to httpd.conf:
RewriteEngine On
CookieTracking On
SetEnvIf Request_Method ^GET$ RM=GET
SetEnvIf Request_Method ^POST$ RM=POST
SetEnvIf Request_Method ^HEAD$ RM=HEAD
RewriteCond %{QUERY_STRING} (.+)
RewriteRule .+ - [E=QUERY_STRING:%1]
LogFormat "%{%Y-%m-%d %T %Z}t\t%T\t%U\t%{QUERY_STRING}e\t%>s\t%{RM}e\t%{Content-type}o\t%b\t%v\t%{Referer}i\t%{User-Agent}i\t%a\t%{cookie}n\t%u" fast
Here we've isolated the request method as a separate entity with
mod_setenvif
and captured any query string's with mod_rewrite
and defined a format string with \t's.