谁能解释 Web 服务器日志数据中的字段？

Question

谁能告诉我以下 Web 服务器日志数据中字段的名称？

85.214.57.164 - - [27/Mar/2008:22:46:36 -0400] "GET /LongDistance/ServicesAgreement.html?logo=http%3A%2F%2Fwww.antwerpsupporter.be%2Fsubscribe_2_me_to-delete%2Fsm%2Fexported_files1%2Fmosupoz%2Fadusa%2Fojafujo%2Faweji%2F HTTP/1.0" 404 374 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 1.1.4322)"
85.214.57.164 - - [27/Mar/2008:22:46:36 -0400] "GET /LongDistance/ServicesAgreement.html?logo=http%3A%2F%2Fwww.math.science.cmu.ac.th%2Flms%2Flib%2Fadodb%2Fpear%2Fnoxifi%2Fezogan%2F HTTP/1.0" 404 374 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 1.1.4322)"
85.214.57.164 - - [27/Mar/2008:22:46:37 -0400] "GET /LongDistance/ServicesAgreement.html?logo=http%3A%2F%2Fsans-packing.ru%2Fimg%2Fjipeqap%2Fehudute%2F HTTP/1.0" 404 374 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 1.1.4322)"

解释 -

我知道所有其他字段，即

client IP, 
Date, 
time, 
time zone, 
method, 
URL requested, 
protocol, 
HTTP status, 
bytes sent

但是我没有得到括号中给出的关于浏览器的最后一个字段。

谁能解释一下？

我特别想要括号中的字段，即

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 1.1.4322)

如有任何帮助，我们将不胜感激。

Answer 1

您感兴趣的最后一个字段看起来非常类似于 Web 浏览器和其他 HTTP 客户端在 User-Agent HTTP 请求 header 中发送的用户代理 (UA) 信息（参见例如 MDN, Wikipedia, or the HTTP 1.1 specification).

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 1.1.4322)

您询问的是括号内的用户代理字符串部分。这基本上只是关于用户代理运行的 platform/system 的评论。

一般来说，我不认为这个字符串必须是任何特定的格式（尽管它对于大多数常见的用户代理来说可能看起来很相似）所以要小心尝试解析此字段时。

根据 HTTP 1.1 规范，RFC 7231 section 5.5.3:

User-Agent = product *( RWS ( product / comment ) )
The User-Agent field-value consists of one or more product identifiers, each followed by zero or more comments (Section 3.2 of [RFC7230]), which together identify the user agent software and its significant subproducts. By convention, the product identifiers are listed in decreasing order of their significance for identifying the user agent software. Each product identifier consists of a name and optional version.

关于评论，请参阅RFC 7230 section 3.2.6：

Comments can be included in some HTTP header fields by surrounding the comment text with parentheses. Comments are only allowed in fields containing "comment" as part of their field value definition.

更具体地说， UserAgentString.com keeps a detailed list of user agent strings and what they mean, see e.g. here 与您感兴趣的相似。这是一个简短的例子：

Mozilla/4.0（括号外的产品和产品版本）：“声称是基于 Mozilla 的用户代理，仅适用于 Firefox 和 Netscape 等 Gecko 浏览器。对于所有其他用户agents 这意味着 'Mozilla-compatible'."

（如果您问自己为什么浏览器 self-identify 是 Mozilla，即使它们是其他东西，请参见 this other SO question。）
compatible:同上
MSIE 7.0: 实际用户代理 (Internet Explorer 7)
Windows NT 5.1: 操作系统版本 (Windows XP)
.NET CLR 2.0.50727: 客户端安装了 .NET Framework 2 OS
.NET CLR 1.1.4322: 客户端安装了.NET Framework 1.1 OS

谁能解释 Web 服务器日志数据中的字段？

Can anyone explain the fields in web server log data?

field

weblog