How to Log Cookie Data in Apache Access Logs: A Technical Guide for PHP Applications


3 views


Apache's mod_log_config module allows logging HTTP request headers, including cookies, through the %{VARNAME}i syntax. For cookies specifically, you'll need to reference the Cookie header.

Here's how to extend your current combined log format to include specific cookies:

LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" \"%{Cookie}i\"" combined

If you want to log specific cookie values (like email or username), you'll need to parse them server-side. While Apache can't directly extract individual cookies from the Cookie header, you can use PHP to write custom logs:

<?php
// In your PHP script
$email = $_COOKIE['email'] ?? 'none';
$username = $_COOKIE['username'] ?? 'none';

// Append to Apache's log
file_put_contents(
    '/path/to/access.log',
    sprintf("[%s] email=%s username=%s\n", 
        date('Y-m-d H:i:s'),
        $email,
        $username
    ),
    FILE_APPEND
);
?>

For more advanced logging, enable mod_logio and use:

LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" \"%{Cookie}i\" %I %O" combinedio

When analyzing logs with cookie data, consider these tools:

# Using awk to extract specific cookies
awk -F\" '{print $10}' access.log | grep 'email='

Remember to:

  • Never log sensitive cookie data (like session IDs)
  • Consider GDPR and privacy regulations when logging personal data
  • Rotate and secure log files containing cookie information

Logging additional data increases I/O operations. For high-traffic sites:

  • Use conditional logging with SetEnvIf
  • Consider asynchronous logging solutions
  • Monitor disk space usage


When building web applications, tracking user-specific data in server logs becomes crucial for analytics and debugging. Many developers want to include cookie information (like email or username) directly in Apache access logs, especially when cookies are set by PHP scripts rather than Apache itself.

Apache does provide functionality to log cookie values through its CustomLog directive. The syntax follows the same pattern as other HTTP header logging:


LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" \"%{COOKIE_NAME}C\"" combined

Notice the uppercase 'C' format string for cookies, different from the lowercase 'i' used for request headers.

Let's say your PHP application sets a cookie named 'user_email'. Here's how to log it:


# In your httpd.conf or virtual host configuration
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" \"%{user_email}C\"" combined_with_cookies

CustomLog "/var/log/apache2/access_with_cookies.log" combined_with_cookies

For more complex scenarios where you need to log multiple cookies:


LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" \"%{user_email}C\" \"%{username}C\"" multi_cookie_log

Cookie values may contain special characters that could break your log format. Consider adding quotes around each cookie value:


LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" \"%{user_email}C\" \"%{username}C\"" quoted_cookies

Before implementing cookie logging:

  • Ensure you're not logging sensitive information like passwords or session tokens
  • Consider your privacy policy and data protection regulations
  • Implement proper log file permissions (chmod 640 typically)

If cookie logging doesn't work as expected, you can pass cookie values through environment variables in PHP:


<?php
// In your PHP script
putenv("USER_EMAIL=".$_COOKIE['user_email']);
?>

Then modify your LogFormat:


LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" \"%{USER_EMAIL}e\"" env_log