What is the difference between the Apache Combined and Apache VHost log formats?

Short answer

Both are access log line formats popularized by Apache HTTP Server (Apache HTTP Server · Log Files), and in TR7 they are in the Line Format list of the Logs profile assigned to the vService. Apache Combined Log Format adds the Referer and User-Agent fields to the Standard Log Format line (client IP, time, request line, status code, bytes); since where the visitor came from and which browser the visitor used are seen, it is suitable for traffic analysis. Apache VHost Log Format, in addition to this, writes the Host Header of the request to the start of the line; if more than one domain is published through the same vService, it makes it easier to separate the records by domain. Neither carries WAF attack information; on an L7 TCP vService, both produce the same TCP line as Standard.

Where It Is Used in TR7

Where	Field / label	What for
Load Balancer → Profiles → Logs	Line Format → Apache Combined Log Format ( Standard + Referrer + User Agent )	HTTP access log that contains Referer and User-Agent
Same field	Apache VHost Log Format ( Vhost + Standard + Referrer + User Agent )	HTTP access log that starts with the Host Header
Same field	Standard Log Format	Basic line without Referer, User-Agent and Host

Comparison

	Standard	Apache Combined	Apache VHost
Client IP, time, request line, status code, bytes	Yes	Yes	Yes
Referer, User-Agent	No	Yes	Yes
Host Header (at the start of the line)	No	No	Yes
WAF attack information	No	No	No
Where it fits	Simple access log	Single-domain publishing, traffic analysis	Multiple domains on the same vService

• Sample line comparison: Apache VHost · Standard / Combined / VHost Comparison
• All line formats: Which HTTP and TCP log formats are supported (Standard, Apache Combined, Apache VHost, CEF, TR7 JSON, TR7 WAF, Manual JSON, Manual CEF, Manual log line)?

Common Misconceptions

• "Apache formats also carry WAF attack information." They do not; attack information is in the CEF Format, TR7 JSON Format and TR7 WAF Log formats (What is CEF (Common Event Format); which TR7 logs can be sent in CEF format?).
• "The VHost format applies only to Apache Backend Services." The name of the format comes from Apache; regardless of the software of the Backend Services, it determines the layout of the log line that TR7 sends.
• "On an L7 TCP vService, the Apache formats produce a different line." Since there are no HTTP fields in L7 TCP, Standard and the two Apache formats produce the same TCP line.

How it is done in the documentation

• Apache Combined · About the Format
• Apache VHost · About the Format
• Logs profile · Line Format

Related questions

• Which HTTP and TCP log formats are supported (Standard, Apache Combined, Apache VHost, CEF, TR7 JSON, TR7 WAF, Manual JSON, Manual CEF, Manual log line)?
• What is CEF (Common Event Format); which TR7 logs can be sent in CEF format?
• Can I define my own log format?