Binary Log Format


The Binary Log Format (BLF) is very similar to the NCSA Common Log Format, except that it is more streamlined and generates smaller log files.

In order to read the BLF log files and process them with log analysis tools, there is a supplied program called blf2clf which will convert from BLF to CLF format. The blf2clf program can be found in the $ZEUSHOME/web/bin directory.

blf2clf takes an optional argument, '-d' and an optional filename. If '-d' is specified, then blf2clf will not perform DNS lookups of the client IP addresses; if the filename is not specified, blf2clf will read from stdin.

Examples :

$ blf2clf /tmp/log.20000801
phaedra.cam.zeus.com - - [01/Aug/2000:14:00:28 +0100] "GET / HTTP/1.0" 200 4790
phaedra.cam.zeus.com - - [01/Aug/2000:14:00:28 +0100] "GET /images/google.gif HTTP/1.0" 200 4047
phaedra.cam.zeus.com - - [01/Aug/2000:14:00:28 +0100] "GET /images/zeus.gif HTTP/1.0" 200 1804
phaedra.cam.zeus.com - - [01/Aug/2000:14:00:28 +0100] "GET /images/altavista.gif HTTP/1.0" 200 992
phaedra.cam.zeus.com - - [01/Aug/2000:14:00:28 +0100] "GET /images/tux.gif HTTP/1.0" 200 6058
phaedra.cam.zeus.com - - [01/Aug/2000:14:00:28 +0100] "GET /images/yahoo.gif HTTP/1.0" 200 655

$ blf2clf -d /tmp/log.20000801
10.100.1.122 - - [01/Aug/2000:14:00:28 +0100] "GET / HTTP/1.0" 200 4790
10.100.1.122 - - [01/Aug/2000:14:00:28 +0100] "GET /images/google.gif HTTP/1.0" 200 4047
10.100.1.122 - - [01/Aug/2000:14:00:28 +0100] "GET /images/zeus.gif HTTP/1.0" 200 1804
10.100.1.122 - - [01/Aug/2000:14:00:28 +0100] "GET /images/altavista.gif HTTP/1.0" 200 992
10.100.1.122 - - [01/Aug/2000:14:00:28 +0100] "GET /images/tux.gif HTTP/1.0" 200 6058
10.100.1.122 - - [01/Aug/2000:14:00:28 +0100] "GET /images/yahoo.gif HTTP/1.0" 200 655

$ tail -f /tmp/log.20000801 | blf2clf
phaedra.cam.zeus.com - - [01/Aug/2000:14:00:28 +0100] "GET / HTTP/1.0" 200 4790
phaedra.cam.zeus.com - - [01/Aug/2000:14:00:28 +0100] "GET /images/google.gif HTTP/1.0" 200 4047
phaedra.cam.zeus.com - - [01/Aug/2000:14:00:28 +0100] "GET /images/zeus.gif HTTP/1.0" 200 1804
phaedra.cam.zeus.com - - [01/Aug/2000:14:00:28 +0100] "GET /images/altavista.gif HTTP/1.0" 200 992
phaedra.cam.zeus.com - - [01/Aug/2000:14:00:28 +0100] "GET /images/tux.gif HTTP/1.0" 200 6058
phaedra.cam.zeus.com - - [01/Aug/2000:14:00:28 +0100] "GET /images/yahoo.gif HTTP/1.0" 200 655

Defining BLF in the logging module

The definition of BLF in the logging module is as follows :
%B

Equivalent format string

The output from blf2clf is equivalent to the following format string :
%h %l - %t "%r" %s %b