# What information does a serverlong contain?

**URL:** <https://boards.straightdope.com/t/what-information-does-a-serverlong-contain/291609>\
**Category:** Factual Questions\
**Created:** [February 24, 2005, 12:19am UTC](https://boards.straightdope.com/t/what-information-does-a-serverlong-contain/291609 "2005-02-24T00:19:12Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Chairman\_Pow](https://avatars.discourse-cdn.com/v4/letter/c/838e76/32.png) [@Chairman\_Pow](https://boards.straightdope.com/u/Chairman_Pow)\
**Post date:** [February 24, 2005, 12:19am UTC](https://boards.straightdope.com/t/what-information-does-a-serverlong-contain/291609/1 "2005-02-24T00:19:12Z")

</div>

You know, when the feds raid an ISP for the information on P2P network users, I read aboout them getting the “logs” from the server.

I assume the information is something like:

Account, Time, IP, Connected to IP, Time.

Is that it or are they much more sinister?

---

<div class="post-metadata">

**Author:** ![MC\_E](https://avatars.discourse-cdn.com/v4/letter/m/c77e96/32.png) [@MC\_E](https://boards.straightdope.com/u/MC_E)\
**Post date:** [February 24, 2005, 12:48am UTC](https://boards.straightdope.com/t/what-information-does-a-serverlong-contain/291609/2 "2005-02-24T00:48:35Z")

</div>

It can be pretty much anything the administrator chooses to log. It could be every single packet (unlikely) to nothing (keeping no log make complying with requests very easy).

To be safe, always assume everything is logged, and will be kept forever. That way you will never be surprised.

---

<div class="post-metadata">

**Author:** ![FyreFiend](https://avatars.discourse-cdn.com/v4/letter/f/919ad9/32.png) [@FyreFiend](https://boards.straightdope.com/u/FyreFiend)\
**Post date:** [February 24, 2005, 6:12am UTC](https://boards.straightdope.com/t/what-information-does-a-serverlong-contain/291609/3 "2005-02-24T06:12:10Z")

</div>

Depending on the type of server software and admin the logs can show:

IP address  
Access time  
Version of the software used to access the server and OS type and version  
File accessed  
User name used to connect (if any)

For example: If I read over my webserver logs I could see that someone from the IP address 1.2.3.4, which is on [foobar.com](http://foobar.com)’s network, looked at every file in my “picture” directory starting at 3:15 am on jan 1, 2005 using Internet Explorer 6.5 from a machine running Windows PX SP2.

---

<div class="post-metadata">

**Author:** ![ultrafilter](https://avatars.discourse-cdn.com/v4/letter/u/3d9bf3/32.png) [@ultrafilter](https://boards.straightdope.com/u/ultrafilter)\
**Post date:** [February 24, 2005, 5:35pm UTC](https://boards.straightdope.com/t/what-information-does-a-serverlong-contain/291609/4 "2005-02-24T17:35:18Z")

</div>

For the server I’ve been working with as of late, there are two logs: the access log, which tracks http requests and whatever info goes with them; and the server log, which tracks pretty much everything that happens on the server. The access log for a day might be 50-200 kB, whereas the server log for that same day would be 30-50 MB.