Understanding Apache's access log

What do each of the things in this line from my access log mean?

> 127.0.0.1 - - [05/Feb/2012:17:11:55 +0000] "GET / HTTP/1.1" 200 140 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.19 (KHTML, like Gecko) Chrome/18.0.1025.5 Safari/535.19"

You seem to be using the http://httpd.apache.org/docs/current/logs.html#combined">combined log format.

> LogFormat "%h %l %u %t "%r" %>s %b "%{Referer}i" "%{User-agent}i"" combined

• %h is the remote host (ie the client IP)
• %l is the identity of the user determined by identd (not usually used since not reliable)
• %u is the user name determined by HTTP authentication
• %t is the time the request was received.
• %r is the request line from the client. ("GET / HTTP/1.0")
• %>s is the status code sent from the server to the client (200, 404 etc.)
• %b is the size of the response to the client (in bytes)
• Referer is the Referer header of the HTTP request (containing the URL of the page from which this request was initiated) if any is present, and "-" otherwise.
• User-agent is the browser identification string.

The complete(?) list of formatters can be found here. The same section of the documentation also lists other common log formats; readers whose logs don't look quite like this one may find the pattern their Apache configuration is using listed there.

> I also don't under stand what the "-" means after the 200 140 section > of the log

That value corresponds to the referer as described by Joachim. If you see a dash though, that means that there was no referer value to begin with (eg. the user went straight to a specific destination, like if he/she typed a URL in their browser)

And what does "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.19 (KHTML, like Gecko) Chrome/18.0.1025.5 Safari/535.19" means ?

This is the value of User-Agent, the browser identification string.

> For this reason, most Web browsers use a User-Agent string value as > follows: > > Mozilla/[version] ([system and browser information]) [platform] > ([platform details]) [extensions]. For example, Safari on the iPad has > used the following: > > Mozilla/5.0 (iPad; U; CPU OS 3_2_1 like Mac OS X; en-us) > AppleWebKit/531.21.10 (KHTML, like Gecko) Mobile/7B405 The components > of this string are as follows: > > Mozilla/5.0: Previously used to indicate compatibility with the > Mozilla rendering engine. (iPad; U; CPU OS 3_2_1 like Mac OS X; > en-us): Details of the system in which the browser is running. > AppleWebKit/531.21.10: The platform the browser uses. (KHTML, like > Gecko): Browser platform details. Mobile/7B405: This is used by the > browser to indicate specific enhancements that are available directly > in the browser or through third parties. An example of this is > Microsoft Live Meeting which registers an extension so that the Live > Meeting service knows if the software is already installed, which > means it can provide a streamlined experience to joining meetings.

This value will be used to identify what browser is being used by end user.

Refer