I frequently see that logging the IP of the user is advised. I thought of attaching this information to the session record in the database but IP can change during the lifetime of a session. And if the user prefers to keep the session open, session may never be renewed.

So, is it best practice to log each and every web request coming from the client?

  • 4
    Your webserver is almost certainly doing this already, it's only worth logging this yourself at an application level if you really need that data for something.
    – iainpb
    Jan 5, 2017 at 13:15
  • 1
    It's common practice to do this, but not for security reasons. Webmasters are usually very interested in knowing which of their pages get how many views by what kind of people. That's because this is the main metric by which their success is measured. Creating those statistics is only possible to do when you log every http request. And if you do that anyway, you can also use that data for security purposes.
    – Philipp
    Jan 5, 2017 at 14:53

1 Answer 1


This is totaly application dependent. As @iain pointed out, your webserver almost certainly logs all requests. E.g. if you use apache, than you can find the logs in the /log/ folder in the apache directory.

application-dependent: if you have tons of requests, you may face problems keeping your logs for a extended amount of time. Check your webservers config for the logging-policy.

here is an example of how apache commonly logs requests: - - [07/Mar/2004:16:05:49 -0800] "GET /twiki/bin/edit/Main/Double_bounce_sender?topicparent=Main.ConfigurationVariables HTTP/1.1" 401 12846 - - [07/Mar/2004:16:06:51 -0800] "GET /twiki/bin/rdiff/TWiki/NewUserTemplate?rev1=1.3&rev2=1.2 HTTP/1.1" 200 4523 - - [07/Mar/2004:16:10:02 -0800] "GET /mailman/listinfo/hsdivision HTTP/1.1" 200 6291 - - [07/Mar/2004:16:11:58 -0800] "GET /twiki/bin/view/TWiki/WikiSyntax HTTP/1.1" 200 7352

the lines are formated like this, though it varies depending on the logformat you configured:


(check out this for more information on the format of the logs)

hope i have helped

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .