Add millisecond timestamps to Apache access logs

Add a fractional-second field to Apache's LogFormat to record more precise timestamps. Use %{msec_frac}t for three millisecond digits or %{usec_frac}t for six microsecond digits. %{ms}T measures request duration; it is not a timestamp.

Configure the access-log format

In httpd.conf or the relevant virtual host, define a format and select it with CustomLog:

# Timestamp with a six-digit microsecond fraction.
LogFormat "%a %l %u %{%Y-%m-%d %H:%M:%S}t.%{usec_frac}t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined_us
CustomLog /var/log/apache2/access.log combined_us

%{%Y-%m-%d %H:%M:%S}t supplies the date and time through seconds. The literal dot and %{usec_frac}t supply the fraction. For millisecond output, replace usec_frac with msec_frac. By default these time fields refer to the beginning of request processing; the begin: and end: prefixes make that choice explicit when needed.

The example omits a timezone offset. Add %{%z}t if downstream systems need to interpret timestamps across timezones.

Check the configuration, then reload the appropriate service:

apachectl configtest
systemctl reload apache2    # Use httpd where that is the service name.

Reload only if the syntax check succeeds and the log directory is valid for your installation.

Example output

192.168.1.1 - - 2024-01-15 10:30:45.123456 "GET /api/users HTTP/1.1" 200 1234 "-" "Mozilla/5.0"

This is a microsecond-format timestamp. Choosing six decimal places describes the recorded format; it does not guarantee equivalent accuracy from the system clock.

Record request duration separately

# %D is elapsed request time in microseconds; %T is seconds.
LogFormat "%a %t \"%r\" %>s %b %D" with_duration

On Apache 2.4.13 and later, %{ms}T records duration in milliseconds. Duration is usually more useful than the timestamp alone when investigating latency.

When collecting these logs in Guance, configure log collection and parsing for the actual format. Preserve the timestamp, request, and duration fields, then verify a known request and its units before building latency queries. A collector cannot reconstruct a duration the application never logged.

Frequently asked questions

What does %t produce?

A timestamp such as [15/Jan/2024:10:30:45 +0800], with second resolution and a timezone offset. Parsers must recognize the month abbreviation.

What happens to old log entries?

They retain their original format. Update the downstream parser to handle the transition, or separate files at the format change.

What is the Nginx equivalent?

$time_iso8601 has second resolution. $msec is an epoch timestamp with a millisecond fraction, such as 1705287045.123; include it in log_format when that representation fits the parser.

See the Apache format-token reference.