Apache Combined and CombinedIO Logs
The combined log file format in apache combines user agent data, referral data, and regular access into a single file. "Combined Log Format" for the history buffs out there looking to impress the ladies is actually known as the NCSA Extended/Combined Log Format.
The apache combinedio log file format is an add-on in the form of a module named mod_logio. It provides two additional fields you can add to your combined logs--bytes in and bytes out per request.
Logs are defined using the LogFormat directive. A definition of the combined log looks something like this:
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\"" combined
Load up the mod_logio.so module, you can add the two additional fields to this format like so:
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\" %I %O" combined
Note the addition of the %I and %O near the end of the line. Nothing else needs to change.
If you allow (in test) access to content that should otherwise be SSL encrypted over an unencrypted channel, then using the CombinedIO format will give you an accurate comparison of the impact that encryption provides on the size of your content. What it should also provide is an interesting before and after comparison of the impact of compression on content so you can impress your bosses with all that bandwidth savings everyone keeps telling us that compression provides.
Back in the day, we oldy timey webmasters would run these logs through something like HitList or Webalizer or NetGenesis and provide all these prettied up reports for the business users and dream about insidious schemes to charge back our group's costs to the business based upon number of hits. But, alas, Google Analytics, CoreMetrics, and the rest of the hosted solutions killed that dream.