I am building a log parser in PHP and have trouble with apache error log format.
With access log, it's easy to see the default LogFormat in apache config file then check in my virtual hosts for any customization.
But with error log, I can't find anything in apache config, and I have no custom ErrorLogFormat directive anywhere.
Why I want to check it is because the documentation confuses me. Here are some examples of ErrorLogFormat directive from apache documentation:
#Simple example
ErrorLogFormat "[%t] [%l] [pid %P] %F: %E: [client %a] %M"
#Example (similar to the 2.2.x format)
ErrorLogFormat "[%t] [%l] %7F: %E: [client\ %a] %M% ,\ referer\ %{Referer}i"
#Example (default format for threaded MPMs)
ErrorLogFormat "[%{u}t] [%-m:%l] [pid %P:tid %T] %7F: %E: [client\ %a] %M% ,\ referer\ %{Referer}i"
And below two examples of logs lines I see on my own server (apache 2.4):
[Sun Sep 27 07:45:01.899495 2020] [ssl:error] [pid 23080] AH01941: stapling_renew_response: responder error
[Wed Sep 30 20:56:31.065219 2020] [reqtimeout:info] [pid 7079] [client x.x.x.x:59452] AH01382: Request header read timeout
This part %F: %E: [client %a] (ie: fileName, errorCode, clientIP), (or at least %E: [client %a], I can't find any example with filename) seems to be inverted. My parser would be able to catch the error code in the two log lines above (AH01941 and AH01382) if I consider my own ErrorLogFormat is [%{u}t] [%-m:%l] [pid %P] [client %a] %F: %E: %M.
But if I follow the documentation and set: [%{u}t] [%-m:%l] [pid %P] %F: %E: [client %a] %M, then the second line (with clientIP) will have no errorCode and a message (%M) containing the error code: AH01382: Request header read timeout.
So how / where can I get the current ErrorLogFormat ?