When working with any a file, the first task is to become familiar with the file schema. In simple terms, we need to know what is represented by each field and what is used to delimit the fields. We will be working with the access log file from an Apache HTTPD web server. The location of the log file can be controlled from the httpd.conf file. The default log file location on a Debian based system is /var/log/apache2/access.log; other systems may use the httpd directory in place of apache2.

To demonstrate the layout of the file, I have installed a brand new instance of Apache2 on an Ubuntu 15.10 system. Once the web server was installed, we made a single access from the Firefox browser to the server from the local host.

Using the tail command we can display the content of the log file. Although, to be fair, the use of cat will do just as well with this file, as it will have just a few lines:

# tail /var/log/apache2/access.log

The output of the command and the contents...