« back to all changes in this revision
Viewing changes to docs/awstats_faq.html
- browse files at revision 5
- compare with another revision
- download diff
- download tarball
- view history from revision 5
- Committer: Bazaar Package Importer
- Author(s): Jonas Smedegaard, Jonas Smedegaard, Charles Fry
- Date: 2006-01-15 22:35:07 UTC
- mfrom: (1.2.2 upstream)
- Revision ID: james.westby@ubuntu.com-20060115223507-jtn0gtvack1n8qj2
Tags: 6.5-1
[ Jonas Smedegaard ]
* New upstream release.
+ Recognizes GNUTLS from lynx User-Agent header. Closes: #306130
(thanks to Dmitry Baryshkov <mitya@school.ioffe.ru>).
+ Geoip shows countries for resolved hostnames. Closes: #317310
(thanks to Administrator <azhrarn@underhanded.org>).
* Simplify watch file to better work with parser used at qa.d.o.
* Improve cdbs rules:
+ Use quilt (rather than cdbs-internal patch system).
+ Add and enable new local snippets copyright-check and auto-update.
+ Update local snippet buildinfo (fixing its namespace).
* Auto-update debian/control:
+ Tightened build-dependency on cdbs.
+ Added build-dependencies on patchutils and quilt.
* Package is now team-maintained:
+ New maintainer: Debian AWStats Team
<pkg-awstats-devel@lists.alioth.debian.org>.
+ Add myself as uploader.
[ Charles Fry ]
* Use qa.debian.org SF redirector in watch file.
* Use Homepage instead of Website in debian/control, per DDR 6.2.4.
* Removed patches integrated upstream
* New upstream release.
+ Recognizes GNUTLS from lynx User-Agent header. Closes: #306130
(thanks to Dmitry Baryshkov <mitya@school.ioffe.ru>).
+ Geoip shows countries for resolved hostnames. Closes: #317310
(thanks to Administrator <azhrarn@underhanded.org>).
* Simplify watch file to better work with parser used at qa.d.o.
* Improve cdbs rules:
+ Use quilt (rather than cdbs-internal patch system).
+ Add and enable new local snippets copyright-check and auto-update.
+ Update local snippet buildinfo (fixing its namespace).
* Auto-update debian/control:
+ Tightened build-dependency on cdbs.
+ Added build-dependencies on patchutils and quilt.
* Package is now team-maintained:
+ New maintainer: Debian AWStats Team
<pkg-awstats-devel@lists.alioth.debian.org>.
+ Add myself as uploader.
[ Charles Fry ]
* Use qa.debian.org SF redirector in watch file.
* Use Homepage instead of Website in debian/control, per DDR 6.2.4.
* Removed patches integrated upstream
- files added:
- debian/cdbs/1/rules/auto-update.mk
- files removed:
- debian/patches/01_sanitize_more.patch
- files modified:
- README.TXT
added
removed
docs/awstats_faq.html
7
7
<meta name="title" content="AWStats Documentation - FAQs">
8
8
<title>AWStats Documentation - FAQs</title>
9
9
<link rel="stylesheet" href="styles.css" type="text/css">
10
<!-- $Revision: 1.158 $ - $Author: eldy $ - $Date: 2005/02/18 19:39:59 $ -->
10
<!-- $Revision: 1.172 $ - $Author: eldy $ - $Date: 2005/11/23 20:36:51 $ -->
11
11
</head>
12
12
13
13
<body topmargin=10 leftmargin=5>
20
20
<td bgcolor=#9999cc align=center><a href="/"><img src="images/awstats_logo4.png" border=0></a></td>
21
21
<td bgcolor=#9999cc align=center>
22
22
<br>
23
<font style="font: 16pt arial,helvetica,sans-serif" color=#EEEEFF><b>AWStats logfile analyzer 6.4 Documentation</b></font><br>
23
<font style="font: 16pt arial,helvetica,sans-serif" color=#EEEEFF><b>AWStats logfile analyzer 6.5 Documentation</b></font><br>
24
24
<br>
25
25
</td>
26
26
<td bgcolor=#9999cc align=center>
52
52
FAQ-COM090 <a href="#FTP">Setup for FTP server log files (proftpd, vsftpd, ...).</a><br>
53
53
FAQ-COM100 <a href="#MAIL">Setup for MAIL log files (Postfix, Sendmail, QMail, MDaemon, Exchange).</a><br>
54
54
FAQ-COM110 <a href="#MEDIASERVER">Setup for MEDIA SERVER log files (Realmedia, Windows media, Darwin streaming server).</a><br>
55
FAQ-COM120 <a href="#ROTATE">How to rotate my logs without loosing data.</a><br>
55
FAQ-COM115 <a href="#PERSONALIZEDLOG">Setup/Examples for LogFormat parameter.</a><br>
56
FAQ-COM120 <a href="#ROTATE">How to rotate my logs without losing data.</a><br>
56
57
FAQ-COM130 <a href="#CRONTAB">How to run AWStats frequently ?</a><br>
57
58
FAQ-COM140 <a href="#EXCLUDEHOSTS">How to exclude my IP address (or whole subnet mask) from stats ?</a><br>
59
FAQ-COM142 <a href="#SCREENSIZE">How to get the screen size and browser capabilities report working ?</a><br>
58
60
FAQ-COM145 <a href="#EXTRA">How to use the Extra Sections features ?</a><br>
59
61
FAQ-COM150 <a href="#BENCHMARK">Benchmark question.</a><br>
60
62
FAQ-COM200 <a href="#DNS">How reverse DNS Lookup works, unresolved IP Addresses ?</a><br>
61
63
FAQ-COM250 <a href="#DIFFERENT_RESULTS">Different results than other log analyzers (Analog, Webalizer, WUsage, wwwStats...).</a><br>
62
64
FAQ-COM300 <a href="#DIFFERENCE_HOURS">Difference between local hour and AWStats reported hour.</a><br>
65
FAQ-COM320 <a href="#GEOIPEU">What does mean "eu (European country)" in GeoIP country reports.</a><br>
63
66
FAQ-COM350 <a href="#OLDLOG">How can I process old log file ?</a><br>
64
67
FAQ-COM360 <a href="#MULTILOG">How can I process several log files in one run ?</a><br>
65
68
FAQ-COM400 <a href="#LOADLOG">How can I update my statistics when I use a load balancing system that splits my logs ?</a><br>
78
81
FAQ-SET200 <a href="#INTERNAL">"Internal Error" or "Error 500" in a browser connecting to Apache.</a><br>
79
82
FAQ-SET210 <a href="#SPEED">"Internal Error" after a long time in my browser (See FAQ-COM100 "AWStats speed/timeout problems").</a><br>
80
83
FAQ-SET220 <a href="#CRASH">Crash while running awstats.pl or page content only partialy loaded</a><br>
81
FAQ-SET250 <a href="#PERSONALIZEDLOG">Log format setup or errors.</a><br>
82
84
FAQ-SET270 <a href="#CORRUPTEDDROPPED">Only corrupted/dropped records</a><br>
83
85
FAQ-SET280 <a href="#NOTSAMENUMBER">Error "Not same number of records of...".</a><br>
84
86
FAQ-SET300 <a href="#COULDNOTOPEN">Error "Couldn't open file ..."</a><br>
115
117
<li> Most of all others Web/Wap/Proxy/Streaming servers.<br>
116
118
<li> Some FTP, Syslog or Mail log files.<br>
117
119
Because AWStats is in Perl, it can works on all Operating Systems.<br>
120
<br>
118
121
Examples of used platforms (bold means 'tested by author', others were reported by AWStats users to work correctly) :<br>
119
<table bgcolor=#F4F4F4 width="100%" class=CFAQ><tr class=CFAQ><td class=CFAQ>
122
<table width="95%" border=1 cellpadding=0 cellspacing=0 bgcolor=#F4F4F4 class=CFAQ><tr class=CFAQ><td class=CFAQ>
120
123
<u>OS:</u><br>
121
124
<b>Windows 2000</b>, <b>Windows NT 4.0</b>, Windows Me, <b>Linux (RedHat, Mandrake, Debian, Suse...)</b>, Macintosh, <b>Solaris</b>, <b>Aix</b>, BeOS, FreeBSD, ...<br>
122
125
<u>Web/Wap/Proxy/Streaming servers</u><br>
123
<b>Apache 1.3.x and 2.x</b>, <b>IIS 5.0 and 6.0</b>, WebStar, WebLogic, WebSite, <b>Windows Media Server</b>, Tomcat, <b>Squid</b>,
126
<b>Apache 1.3.x and 2.x</b>, <b>IIS 5.0 or higher</b>, ISA, WebStar, WebLogic, WebSite, <b>Windows Media Server</b>, Tomcat, <b>Squid</b>,
124
127
Sambar, Roxen, Resin, RealMedia server, Oracle9iAS, <b>Lotus Notes/Domino</b>, Darwin, IPlanet, IceCast, ZeroBrand, Zeus, Zope, Abyss...<br>
125
128
<u>FTP servers</u><br>
126
129
<b>ProFTPd</b>, vsFTPd...<br>
137
140
you can define your own log format, that's the reason why AWStats can analyze nearly all web, wap
138
141
and proxy server log files. Some FTP servers log files, Syslog or mail logs can also be analyzed.<br>
139
142
The only requirement is "Your log file must contain required information".<br>
143
<br>
140
144
This is very short examples of possible log format:<br>
141
<br>
142
<i>
145
<table width="95%" border=1 cellpadding=0 cellspacing=0 bgcolor=#F4F4F4 class=CFAQ><tr class=CFAQ><td class=CFAQ>
143
146
Apache common log format (see Note*),<br>
144
147
Apache combined log format (known as NCSA combined log format or XLF or ELF format),<br>
145
148
Any other personalized Apache log format,<br>
149
152
ProFTPd server, vsFTPd server,<br>
150
153
Postfix, Sendmail, QMail, Mdaemon<br>
151
154
A lot of web/wap/proxy/streaming servers log format<br>
155
</td></tr></table>
152
156
<br>
153
Note*: Apache common log format (AWStats can now analyze such log files but such log files does not
157
*Note: Apache common log format (AWStats can now analyze such log files but such log files does not
154
158
contain all information AWStats is looking for. The problem is in the content, not in the
155
159
format). I think analyzing common log files is not interesting because there is a lot of
156
160
missing information: no way to filter robots, find search engines, keywords, os, browser.
157
161
But a lot of users asked me for it, so AWStats support it.
158
162
However, a lot of interesting advanced features can't work: browsers, os's, keywords, robot detection...).
159
</i><br>
163
<br>
160
164
See also <a href="#PERSONALIZEDLOG">F.A.Q.: LOG FORMAT SETUP OR ERRORS </a>.<br>
161
165
<br>
162
166
163
167
<a name="LANG"></a><br>
164
168
<b><u>FAQ-ABO200 : WHICH LANGUAGES ARE AVAILABLE ?</u></b><br>
165
AWStats can make reports in 40 languages. This is a list of all of them, for last version, in
169
AWStats can make reports in 41 languages. This is a list of all of them, for last version, in
166
170
alphabetical order (The code you can use for <a href="awstats_config.html#Lang">Lang</a>
167
171
and <a href="awstats_config.html#ShowFlagLinks">ShowFlagLinks</a> parameter are
168
172
the ISO-639-1 language codes):<br>
169
173
<i>
170
<table bgcolor=#F4F4F4 width="100%" class=CFAQ><tr class=CFAQ><td class=CFAQ>
174
<table width="95%" border=1 cellpadding=0 cellspacing=0 bgcolor=#F4F4F4 class=CFAQ><tr class=CFAQ><td class=CFAQ>
171
175
Albanian=al, Bosnian=ba, Bulgarian=bg, Catalan=ca,
172
Chinese (Taiwan)=tw, Chinese (Simpliefied)=cn, Czech=cz, Danish=dk,
173
Dutch=nl, English=en, Estonian=et, Euskara=eu, Finnish=fi,
176
Chinese (Taiwan)=tw, Chinese (Simpliefied)=cn, Croatian=hr, Czech=cz,
177
Danish=dk, Dutch=nl, English=en, Estonian=et, Euskara=eu, Finnish=fi,
174
178
French=fr, Galician=gl, German=de, Greek=gr, Hebrew=he, Hungarian=hu,
175
Icelandic=is, Indonesian=id, Italian=it, Japanese=jp, Korean=kr,
179
Icelandic=is, Indonesian=id, Italian=it, Japanese=jp, Korean=ko,
176
180
Latvian=lv, Norwegian (Nynorsk)=nn, Norwegian (Bokmal)=nb, Polish=pl,
177
181
Portuguese=pt, Portuguese (Brazilian)=br, Romanian=ro, Russian=ru,
178
182
Serbian=sr, Slovak=sk, Solvenian=si, Spanish=es, Swedish=se, Thai=th,
210
214
a tag to call a CGI script like pslogger into each of your web pages. This will
211
215
allow you to have an artificial log file that can be analyzed by AWStats.<br>
212
216
You can find a Perl version of CGI pslogger enhanced by AWStats author <a href="/files/pslogger.pl">here</a>
213
or a php version of CGI pslogger made by Florent CHANTRET <a href="/files/pslogger.phps">here</a>.
217
or a php version of CGI pslogger made by Florent CHANTRET <a href="/files/pslogger.phps">here</a>.<br>
214
218
<br>
215
219
216
220
<a name="LIMITLOG"></a><br>
226
230
experience size limit errors on files larger than 2 or 4 GB.
227
231
If limit is Perl only, try to use a Perl version compiled with "large file" option.<br>
228
232
If you can't find it nor build it, you can try to use a LogFile parameter that looks like this
229
<i>LogFile="cat /yourlogfilepath/yourlogfile |"</i> instead of
230
<i>LogFile="/yourlogfilepath/yourlogfile"</i><br>
233
<table width="95%" border=1 cellpadding=0 cellspacing=0 bgcolor=#F4F4F4 class=CFAQ><tr class=CFAQ><td class=CFAQ>
234
LogFile="cat /yourlogfilepath/yourlogfile |"
235
</td></tr></table>
236
instead of
237
<table width="95%" border=1 cellpadding=0 cellspacing=0 bgcolor=#F4F4F4 class=CFAQ><tr class=CFAQ><td class=CFAQ>
238
LogFile="/yourlogfilepath/yourlogfile"
239
</td></tr></table>
231
240
<br>
232
241
233
242
<a name="FTP"></a><br>
242
251
1- Setup your server log file format:<br>
243
252
<br>
244
253
Modify the proftpd.conf file to add the following two lines :
245
<table width="95%" border=1 cellpadding=0 cellspacing=0><tr class=CFAQ><td class=CFAQ>
254
<table width="95%" border=1 cellpadding=0 cellspacing=0 bgcolor=#F4F4F4 class=CFAQ><tr class=CFAQ><td class=CFAQ>
246
255
<!--<br>With ProFTPd 1.2.2:-->
247
<i>LogFormat awstats "%t %h %u %m %f %s %b"</i> # WARNING: You must use a tab char between % tags and not a space !
248
<i><br>ExtendedLog /var/log/xferlog read,write awstats</i> # WARNING: ExtendedLog directive might need to be placed inside a virtual host context if you use them.
256
LogFormat awstats "%t %h %u %m %f %s %b"</i> # WARNING: You must use a tab char between % tags and not a space !
257
<br>ExtendedLog /var/log/xferlog read,write awstats</i> # WARNING: ExtendedLog directive might need to be placed inside a virtual host context if you use them.
249
258
<!--<br>With ProFTPd 1.2.6:
250
259
<i><br>LogFormat awstats ""${%F %H-%M-%S}t %h %u %m %F %s %b"</i> # WARNING: You must use a tab char between % tags and not a space !
251
260
<i><br>ExtendedLog /var/log/xferlog read,write awstats</i> # WARNING: ExtendedLog directive might need to be placed inside a virtual host context if you use them.
252
261
-->
253
262
</td></tr></table>
263
<br>
254
264
Then turn off old format Transfer log:
255
<table width="95%" border=1 cellpadding=0 cellspacing=0><tr class=CFAQ><td class=CFAQ>
256
<i>TransferLog none</i> # WARNING: TransferLog directive might need to be placed inside a virtual host context if you use them.
265
<table width="95%" border=1 cellpadding=0 cellspacing=0 bgcolor=#F4F4F4 class=CFAQ><tr class=CFAQ><td class=CFAQ>
266
TransferLog none # WARNING: TransferLog directive might need to be placed inside a virtual host context if you use them.
257
267
</td></tr></table>
258
268
<br>
259
269
To have the change effective, stop your server, remove old log file /var/log/xferlog and restart the server.<br>
260
270
Download a file by FTP and check that your new log file looks like this:<br>
261
<i>[01/Jan/2001:21:49:57 +0200] ftp.server.com user RETR /home/fileiget.txt 226 1499</i><br>
271
<table width="95%" border=1 cellpadding=0 cellspacing=0 bgcolor=#F4F4F4 class=CFAQ><tr class=CFAQ><td class=CFAQ>
272
[01/Jan/2001:21:49:57 +0200] ftp.server.com user RETR /home/fileiget.txt 226 1499
273
</td></tr></table>
262
274
<br>
263
275
2- Then setup AWStats to analyze the FTP log file:<br>
264
276
<br>
265
277
Copy config file "awstats.model.conf" to "awstats.ftp.conf".<br>
266
278
Modify this new config file:
267
<table width="95%" border=1 cellpadding=0 cellspacing=0><tr class=CFAQ><td class=CFAQ>
268
<i>
279
<table width="95%" border=1 cellpadding=0 cellspacing=0 bgcolor=#F4F4F4 class=CFAQ><tr class=CFAQ><td class=CFAQ>
269
280
LogFile="/var/log/xferlog"
270
281
<br>LogType=F
271
282
<br>LogFormat="%time1 %host %logname %method %url %code %bytesd"
302
313
<br>ShowMiscStats=0
303
314
<br>ShowHTTPErrorsStats=0
304
315
<br>ShowSMTPErrorsStats=0
305
</i></td></tr></table>
316
</td></tr></table>
306
317
<br>
307
318
Now you can use AWStats as usual (run the update process and read statistics).<br>
308
319
<br>
313
324
<br>
314
325
Take a look at your FTP server log file. You must have a format that match the following example to
315
326
use this FAQ :<br>
316
<table width="95%" border=1 cellpadding=0 cellspacing=0><tr class=CFAQ><td class=CFAQ>
317
<i>Wed Jan 01 19:29:35 2001 1 192.168.1.1 102 /home/file1.txt b _ o r username ftp 0 * c</i>
327
<table width="95%" border=1 cellpadding=0 cellspacing=0 bgcolor=#F4F4F4 class=CFAQ><tr class=CFAQ><td class=CFAQ>
328
Wed Jan 01 19:29:35 2001 1 192.168.1.1 102 /home/file1.txt b _ o r username ftp 0 * c
318
329
</td></tr></table>
319
330
<br>
320
331
2- Then setup AWStats to analyze the FTP log file:<br>
321
332
<br>
322
333
If your FTP log file format looks good, copy config file "awstats.model.conf" to "awstats.ftp.conf".<br>
323
334
Modify this new config file:
324
<table width="95%" border=1 cellpadding=0 cellspacing=0><tr class=CFAQ><td class=CFAQ>
325
<i>
335
<table width="95%" border=1 cellpadding=0 cellspacing=0 bgcolor=#F4F4F4 class=CFAQ><tr class=CFAQ><td class=CFAQ>
326
336
LogFile="/var/log/xferlog"
327
337
<br>LogType=F
328
338
<br>LogFormat="%time3 %other %host %bytesd %url %other %other %method %other %logname %other %code %other %other"
359
369
<br>ShowMiscStats=0
360
370
<br>ShowHTTPErrorsStats=0
361
371
<br>ShowSMTPErrorsStats=0
362
</i></td></tr></table>
372
</td></tr></table>
363
373
<br>
364
374
Now you can use AWStats as usual (run the update process and read statistics).<br>
365
375
<br>
379
389
into AWStats <i>tools</i> directory, but you can use the one of your choice):<br>
380
390
For this, copy config <i>"awstats.model.conf"</i> file to <i>"awstats.mail.conf"</i>.<br>
381
391
Modify this new config file:
382
<table width="95%" border=1 cellpadding=0 cellspacing=0><tr class=CFAQ><td class=CFAQ>
383
392
For standard Postfix, Sendmail, MDaemon and standard QMail logfiles, set<br>
384
<i>
385
LogFile="perl /path/to/maillogconvert.pl standard < /pathtomaillog/maillog |"<br>
386
</i>
393
<table width="95%" border=1 cellpadding=0 cellspacing=0 bgcolor=#F4F4F4 class=CFAQ><tr class=CFAQ><td class=CFAQ>
394
LogFile="perl /path/to/maillogconvert.pl standard < /pathtomaillog/maillog |"
395
</td></tr></table>
387
396
If the logfiles are compressed, they can be processed this way<br>
388
<i>
397
<table width="95%" border=1 cellpadding=0 cellspacing=0 bgcolor=#F4F4F4 class=CFAQ><tr class=CFAQ><td class=CFAQ>
389
398
LogFile="gzip -cd /var/log/maillog.0.gz | /path/to/maillogconvert.pl standard |"<br>
390
</i>
399
</td></tr></table>
391
400
And for VAdmin QMail logfiles (multi-host/virtualhost mail servers running vadmin software), set<br>
392
<i>
401
<table width="95%" border=1 cellpadding=0 cellspacing=0 bgcolor=#F4F4F4 class=CFAQ><tr class=CFAQ><td class=CFAQ>
393
402
LogFile="perl /path/to/maillogconvert.pl vadmin < /pathtomaillog/maillog |"<br>
394
</i>
403
</td></tr></table>
404
<br>
395
405
Then, whatever is you mail server, you must also change:
396
<i>
397
<br>LogType=M
406
<table width="95%" border=1 cellpadding=0 cellspacing=0 bgcolor=#F4F4F4 class=CFAQ><tr class=CFAQ><td class=CFAQ>
407
LogType=M
398
408
<br>LogFormat="%time2 %email %email_r %host %host_r %method %url %code %bytesd"
399
409
<br>LevelForBrowsersDetection=0
400
410
<br>LevelForOSDetection=0
427
437
<br>ShowMiscStats=0
428
438
<br>ShowHTTPErrorsStats=0
429
439
<br>ShowSMTPErrorsStats=1
430
<br>
431
</i>
432
440
</td></tr></table>
433
441
Warning: For MDaemon mail server, you must use the new MDaemon log file that ends
434
442
with "-Statistics.log".<br>
446
454
enable "Message Tracking" (see article http://support.microsoft.com/default.aspx?scid=kb;EN-US;246856).<br>
447
455
Then copy config awstats.model.conf file to "awstats.mail.conf".<br>
448
456
Modify this new config file:
449
<table width="95%" border=1 cellpadding=0 cellspacing=0><tr class=CFAQ><td class=CFAQ>
450
<i>
457
<table width="95%" border=1 cellpadding=0 cellspacing=0 bgcolor=#F4F4F4 class=CFAQ><tr class=CFAQ><td class=CFAQ>
451
458
LogType=M
452
459
<br>LogFormat="%time2 %email %email_r %host %host_r %method %url %code %bytesd"
453
460
<br>LevelForBrowsersDetection=0
481
488
<br>ShowMiscStats=0
482
489
<br>ShowHTTPErrorsStats=0
483
490
<br>ShowSMTPErrorsStats=1
484
<br>
485
</i>
486
491
</td></tr></table>
487
492
<br>
488
493
Also don't forget that with Exchange, informations in a log analyses can't be exact.
501
506
<u>For Realmedia</u><br>
502
507
<br>
503
508
Your log file will probably looks like this:<br>
504
<i>
509
<table width="95%" border=1 cellpadding=0 cellspacing=0 bgcolor=#F4F4F4 class=CFAQ><tr class=CFAQ><td class=CFAQ>
505
510
216.125.146.50 - - [16/Sep/2002:14:57:21 -0500] "GET cme/rhythmcity/rcitycaddy.rm?cloakport=8080,554,7070 RTSP/1.0" 200 6672 [Win95_4.0_6.0.9.374_play32_NS80_en-US_586] [80d280e1-c9ae-11d6-fa53-d52aaed98681] [UNKNOWN] 281712 141 3 0 0 494<br>
506
</i>
511
</td></tr></table>
507
512
<br>
508
513
Copy config awstats.model.conf file to "awstats.mediaserver.conf".
509
514
Modify this new config file:
510
<table width="95%" border=1 cellpadding=0 cellspacing=0><tr class=CFAQ><td class=CFAQ>
511
<i>
515
<table width="95%" border=1 cellpadding=0 cellspacing=0 bgcolor=#F4F4F4 class=CFAQ><tr class=CFAQ><td class=CFAQ>
512
516
LogFile="/pathtomediaserverlog/mediaserverlog"
513
517
<br>LogType=S
514
518
<br>LogFormat="%host %other %logname %time1 %methodurl %code %bytesd %uabracket %other %other %other %other %other %other %other %other"
537
541
<br>ShowMiscStats=0
538
542
<br>ShowHTTPErrorsStats=1
539
543
<br>ShowSMTPErrorsStats=0
540
</i>
541
544
</td></tr></table>
542
545
<br>
543
546
Now you can use AWStats as usual (run the update process and read statistics).<br>
546
549
<u>For Windows Media Server / Darwin Streaming Server</u><br>
547
550
<br>
548
551
1- If your Windows Media / Darwin streaming Server version allows it, setup your log format to write the following fields:
549
<i>
550
<br>c-ip
552
<table width="95%" border=1 cellpadding=0 cellspacing=0 bgcolor=#F4F4F4 class=CFAQ><tr class=CFAQ><td class=CFAQ>
553
c-ip
551
554
<br>date
552
555
<br>time
553
556
<br>cs-uri-stem
574
577
<br>videocodec
575
578
<br>channelURL
576
579
<br>sc-bytes
577
</i>
580
</td></tr></table>
578
581
<br>
579
582
To have the change effective, stop your server, remove old log files and restart the server.<br>
580
583
Listen to streaming files and check that your new log file looks like this:<br>
581
<i>
584
<table width="95%" border=1 cellpadding=0 cellspacing=0 bgcolor=#F4F4F4 class=CFAQ><tr class=CFAQ><td class=CFAQ>
582
585
80.223.91.37 2002-10-08 14:18:58 mmst://mydomain.com/mystream 0 106 1 200 {F4A826EE-FA46-480F-A49B-76786320FC6B} 8.0.0.4477 fi-FI - - wmplayer.exe 8.0.0.4477 Windows_2000 5.1.0.2600 Pentium 0 0 20702 mms TCP Windows_Media_Audio_9 - - 277721
583
</i>
586
</td></tr></table>
584
587
<br>
585
588
<br>
586
589
If your Windows Media/Darwin Streaming Server version does not allow to define your log format:<br>
587
590
Just follow instructions in step 2 directly but use the log format string found in first lines
588
591
of your log files (Just after the "<i>#Fields:</i>" string) as value for AWStats LogFormat
589
592
parameter. For example, you could have a LogFormat defined like this:<br>
590
<i>
593
<table width="95%" border=1 cellpadding=0 cellspacing=0 bgcolor=#F4F4F4 class=CFAQ><tr class=CFAQ><td class=CFAQ>
591
594
LogFormat="c-ip date time c-dns cs-uri-stem c-starttime x-duration c-rate
592
595
c-status c-playerid c-playerversion c-playerlanguage cs(User-Agent)
593
596
cs(Referer) c-hostexe c-hostexever c-os c-osversion c-cpu filelength
596
599
c-pkts-lost-net c-pkts-lost-cont-net c-resendreqs c-pkts-recovered-ECC
597
600
c-pkts-recovered-resent c-buffercount c-totalbuffertime c-quality s-ip s-dns
598
601
s-totalclients s-cpu-util"
599
</i>
602
</td></tr></table>
600
603
<br>This means you don't use the AWStats tags but AWStats can often also understand all the IIS and/or
601
604
Windows Media Server tags.<br>
602
605
604
607
2- Then setup AWStats to analyze your Media Server log:<br>
605
608
Copy config awstats.model.conf file to "awstats.mediaserver.conf".<br>
606
609
Modify this new config file:
607
<table width="95%" border=1 cellpadding=0 cellspacing=0><tr class=CFAQ><td class=CFAQ>
608
<i>
610
<table width="95%" border=1 cellpadding=0 cellspacing=0 bgcolor=#F4F4F4 class=CFAQ><tr class=CFAQ><td class=CFAQ>
609
611
LogFile="/pathtomediaserver/mediaserverlog"
610
612
<br>LogType=S
611
613
<br>LogFormat="c-ip date time cs-uri-stem c-starttime x-duration c-rate c-status c-playerid c-playerversion c-playerlanguage cs(User-Agent) cs(Referer) c-hostexe c-hostexever c-os c-osversion c-cpu filelength filesize avgbandwidth protocol transport audiocodec videocodec channelURL sc-bytes"
634
636
<br>ShowMiscStats=0
635
637
<br>ShowHTTPErrorsStats=1
636
638
<br>ShowSMTPErrorsStats=0
639
</td></tr></table>
640
<br>
641
Now you can use AWStats as usual (run the update process and read statistics).<br>
642
<br>
643
644
<a name="PERSONALIZEDLOG"></a><br>
645
<b><u>FAQ-COM115 : SETUP/EXAMPLES FOR LOGFORMAT PARAMETER</u></b><br>
646
<font class=CProblem>PROBLEM:</font><br>
647
Which value do I have to put in the LogFormat parameter to make AWStats working with my log
648
file format ?<br>
649
<font class=CSolution>SOLUTION:</font><br>
650
The AWStats config file give you all possible values for LogFormat parameter.
651
To help you, this is some common cases of log file format, and
652
the corresponding value for LogFormat you must use in your AWStats config file:<br>
653
<hr>
654
<u>If your log records are EXACTLY like this (<b>NCSA combined/XLF/ELF</b> log format):</u><br>
655
<i>62.161.78.73 - - [dd/mmm/yyyy:hh:mm:ss +0x00] "GET /page.html HTTP/1.1" 200 1234 "http://www.from.com/from.htm" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)"</i><br>
656
</td></tr></table>
657
You must use : <i>LogFormat=1</i><br>
658
This is same than: <i>LogFormat="%host %other %logname %time1 %methodurl %code %bytesd %refererquot %uaquot"</i><br>
659
660
<hr>
661
<u>If your log records are EXACTLY like this (<b>NCSA combined with several virtualhostname</b> sharing same log file).</u><br>
662
<i>virtualserver1 62.161.78.73 - - [dd/mmm/yyyy:hh:mm:ss +0x00] "GET /page.html HTTP/1.1" 200 1234 "http://www.from.com/from.htm" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)"</i><br>
663
You must use : <i>LogFormat="%virtualname %host %other %logname %time1 %methodurl %code %bytesd %refererquot %uaquot"</i><br>
664
<hr>
665
<u>If your log records are EXACTLY like this (<b>NCSA combined and mod_gzip format 1</b> with <b>Apache 1.x</b>):</u><br>
666
<i>62.161.78.73 - - [dd/mmm/yyyy:hh:mm:ss +0x00] "GET /page.html HTTP/1.1" 200 3904 "http://www.from.com/from.htm" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)" mod_gzip: 66pct.</i><br>
667
You must use : <i>LogFormat="%host %other %logname %time1 %methodurl %code %bytesd %refererquot %uaquot %other %gzipratio"</i><br>
668
669
<hr>
670
<u>If your log records are EXACTLY like this (<b>NCSA combined and mod_gzip format 2</b> with <b>Apache 1.x</b>):</u><br>
671
<i>62.161.78.73 - - [dd/mmm/yyyy:hh:mm:ss +0x00] "GET /page.html HTTP/1.1" 200 3904 "http://www.from.com/from.htm" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)" mod_gzip: DECHUNK:OK In:11393 Out:3904:66pct.</i><br>
672
You must use : <i>LogFormat="%host %other %logname %time1 %methodurl %code %bytesd %refererquot %uaquot %other %other %gzipin %gzipout"</i><br>
673
<hr>
674
<u>If your log records are EXACTLY like this (<b>NCSA combined and mod_deflate</b> with <b>Apache 2</b>):</u><br>
675
<i>62.161.78.73 - - [dd/mmm/yyyy:hh:mm:ss +0x00] "GET /page.html HTTP/1.1" 200 3904 "http://www.from.com/from.htm" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)" (45)</i><br>
676
You must use : <i>LogFormat="%host %other %logname %time1 %methodurl %code %bytesd %refererquot %uaquot %deflateratio"</i><br>
677
678
<hr>
679
<u>If your log records are EXACTLY like this (<b>NCSA combined with 2 spaces between some fields</b> with <b>Zope</b>):</u><br>
680
<i>62.161.78.73 - - [dd/mmm/yyyy:hh:mm:ss +0x00] "GET /page.html HTTP/1.1" 200 3904 "http://www.from.com/from.htm" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)" (45)</i><br>
681
You must use : <i><br>
682
LogFormat="%host %other %logname %time1 %methodurl %code %bytesd %refererquot %uaquot"<br>
683
LogSeparator=" *"<br>
637
684
</i>
638
</td></tr></table>
639
<br>
640
Now you can use AWStats as usual (run the update process and read statistics).<br>
641
<br>
685
<hr>
686
<u>If your log records are EXACTLY like this (<b>NCSA common CLF</b> log format):</u><br>
687
<i>62.161.78.73 - - [dd/mmm/yyyy:hh:mm:ss +0x00] "GET /page.html HTTP/1.1" 200 1234</i><br>
688
You must use : <i>LogFormat=4</i><br>
689
Note: Browsers, OS's, Keywords and Referers features are not available with a such format.<br>
690
691
<hr>
692
<u>If your log records are EXACTLY like this (With some <b>Squid</b> versions, after setting <i>emulate_http_log</i> to on):</u><br>
693
<i>200.135.30.181 - - [dd/mmm/yyyy:hh:mm:ss +0x00] "GET http://www.mydomain.com/page.html HTTP/1.0" 200 456 TCP_CLIENT_REFRESH_MISS:DIRECT</i><br>
694
You must use : <i>LogFormat="%host %other %logname %time1 %methodurl %code %bytesd %other"</i><br>
695
<hr>
696
<u>If your log records are EXACTLY like this (Some old <b>IIS</b> W3C log format):</u><br>
697
<i>yyyy-mm-dd hh:mm:ss 62.161.78.73 - GET /page.html 200 1234 HTTP/1.1 Mozilla/4.0+(compatible;+MSIE+5.01;+Windows+NT+5.0) http://www.from.com/from.html</i><br>
698
You must use : <i>LogFormat=2</i><br>
699
700
<hr>
701
<u>If your log records are EXACTLY like this (Some <b>IIS</b> W3C log format with some <b>.net</b> servers):</u><br>
702
<i>yyyy-mm-dd hh:mm:ss GET /page.html - 62.161.78.73 - Mozilla/4.0+(compatible;+MSIE+5.01;+Windows+NT+5.0) http://www.from.com/from.html 200 1234 HTTP/1.1</i><br>
703
You must use : <i>LogFormat=2 (or LogFormat="%time2 %method %url %logname %host %other %ua %referer %code %bytesd %other")</i><br>
704
<hr>
705
<u>If your log records are EXACTLY like this (Some <b>IIS 6+</b> W3C log format):</u><br>
706
<i>yyyy-mm-dd hh:mm:ss GET /page.html - 62.161.78.73 - Mozilla/4.0+(compatible;+MSIE+5.01;+Windows+NT+5.0) http://www.from.com/from.html 200 1234</i><br>
707
You must use : <i>LogFormat=2 (or LogFormat="date time cs-method cs-uri-stem cs-username c-ip cs-version cs(User-Agent) cs(Referer) sc-status sc-bytes")</i><br>
708
709
<hr>
710
<u>If your log records are EXACTLY like this (Some <b>ISA</b> W3C log format):</u><br>
711
<i>62.161.78.73, anonymous, Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1), N, 1/1/2001, 0:00:16, W3ReverseProxy, HCSERV2, -, www.host.be, 192.168.141.101, 80, 266, 406, 10042, http, TCP, GET, http://192.168.141.101/, text/html, Inet, 200, 0x42330010, -, -</i><br>
712
You must use :<br>
713
<i>LogFile="sed -e 's/, /\t/g' "/yourlogpath/yourlogfile.log" |"</i><br>
714
<i>LogFormat=2</i><br>
715
<i>LogSeparator=" "</i><br>
716
<hr>
717
<u>If your log records are EXACTLY like this (With some <b>WebSite</b> versions):</u><br>
718
<i>yyyy-mm-dd hh:mm:ss 62.161.78.73 - 192.168.1.1 80 GET /page.html - 200 11205 0 0 HTTP/1.1 mydomain.com Mozilla/4.0+(compatible;+MSIE+5.5;+Windows+98) - http://www.from.com/from.html</i><br>
719
You must use : <i>LogFormat="%time2 %host %logname %other %other %method %url %other %code %bytesd %other %other %other %other %ua %other %referer"</i><br>
720
721
<hr>
722
<u>If your log records are EXACTLY like this (<b>Webstar</b> native log format):</u><br>
723
<i>05/21/00 00:17:31 OK 200 212.242.30.6 Mozilla/4.0 (compatible; MSIE 5.0; Windows 98; DigExt) http://www.cover.dk/ "www.cover.dk" :Documentation:graphics:starninelogo.white.gif 1133</i><br>
724
You must use : <i>LogFormat=3</i><br>
725
<hr>
726
<u>If your log records are EXACTLY like this (With some <b>Lotus Notes/Domino</b> versions):</u><br>
727
<i>62.161.78.73 - Name Surname Service [dd/mmm/yyyy:hh:mm:ss +0x00] "GET /page.html HTTP/1.1" 200 1234 "http://www.from.com/from.htm" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)"</i><br>
728
You must use : <i>LogFormat=6</i><br>
729
730
<hr>
731
<u>If your log records are EXACTLY like this (<b>Lotus Notes/Domino 6.x</b> log format):</u><br>
732
<i>62.161.78.73 - "Name Surname" Service [dd/mmm/yyyy:hh:mm:ss +0x00] "GET /page.html HTTP/1.1" 200 1234 "http://www.from.com/from.htm" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)"</i><br>
733
You must use : <i>LogFormat="%host %other %lognamequot %time1 %methodurl %code %bytesd %refererquot %uaquot"</i><br>
734
<hr>
735
<u>If your log records are EXACTLY like this (With <b>Oracle9iAS</b>):</u><br>
736
<i>62.161.78.73 - [dd/mmm/yyyy:hh:mm:ss +0x00] GET /page.html HTTP/1.1 200 1234 - "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)"</i><br>
737
Where separators are "tab" characters or several "spaces",
738
You must use : <i>LogFormat="%host %logname %time1 %method %url %other %code %bytesd %referer %uaquot"</i>
739
and <i>LogSeparator="\s+"</i><br>
740
741
<hr>
742
<u>If you use a FTP server like <b>ProFTPd</b>:</u><br>
743
See <a href="#FTP">FAQ-COM090</a>.<br>
744
<hr>
745
<u>If you want to analyze a mail log file (<b>Postfix</b>, <b>Sendmail</b>, <b>QMail</b>, <b>MDaemon</b>, <b>Exchange</b>):</u><br>
746
See <a href="#MAIL">FAQ-COM100</a>.<br>
747
748
<hr>
749
<u>If you use a Media Server (<b>Realmedia</b>, <b>Windows Media Server</b>):</u><br>
750
See <a href="#MEDIASERVER">FAQ-COM110</a>.<br>
751
<hr>
752
<u>If your log records are EXACTLY like this (With some providers):</u><br>
753
<i>62.161.78.73 - - [dd/Month/yyyy:hh:mm:ss +0x00] "GET /page.html HTTP/1.1" "-" 200 1234</i><br>
754
You must use : <i>LogFormat="%host %other %logname %time1 %methodurl %other %code %bytesd"</i><br>
755
Note: Browsers, OS's, Keywords and Referers features are not available with a such format.<br>
756
757
<hr>
758
<u>There is a lot of other possible log formats.</u><br>
759
You must use a personalized log format LogFormat ="..." as described in config file to
760
support other various log formats.<br>
761
<br><br>
642
762
643
763
<a name="ROTATE"></a><br>
644
<b><u>FAQ-COM120 : HOW TO ROTATE MY LOGS WITHOUT LOOSING DATA</u></b><br>
764
<b><u>FAQ-COM120 : HOW TO ROTATE MY LOGS WITHOUT LOSING DATA</u></b><br>
645
765
<font class=CProblem>PROBLEM:</font><br>
646
766
I want to archive/rotate my logs using my server system (for example logrotate) options or a third
647
767
software (rotatelog, cronolog) but I don't want to lose any visits information during the rotate
650
770
<li> If your config file is setup with a <a href="awstats_config.html#LogFile">LogFile</a> parameter
651
771
that point to your current running log file (required if you want to use the
652
772
<a href="awstats_config.html#AllowToUpdateStatsFromBrowser">AllowToUpdateStatsFromBrowser</a>
653
option to have "real-time" statistics), to avoid loosing too much records during the rotate
773
option to have "real-time" statistics), to avoid losing too much records during the rotate
654
774
process, you must run the AWStats update JUST BEFORE the rotate process is done.<br>
655
775
The best way to do that on 'Linux like' OS is to use the linux built-in logrotate feature. You must
656
776
edit the logrotate config file used for your web server log file (usually stored in /etc/logrotate.d
657
777
directory) by adding the AWStats update process as a preprocessor command, like this example (bold
658
lines are lines to add for having a prerotate process):<br><i>
778
lines are lines to add for having a prerotate process):<br>
779
<table width="95%" border=1 cellpadding=0 cellspacing=0 bgcolor=#F4F4F4 class=CFAQ><tr class=CFAQ><td class=CFAQ>
659
780
/usr/local/apache/logs/*log<br>
660
781
{<br>
661
782
notifempty<br>
672
793
/usr/bin/killall -HUP httpd<br>
673
794
endscript<br>
674
795
}<br>
675
</i>
796
</td></tr></table>
676
797
<br>
677
798
If using a such solution, this is sequential steps that happens:<br>
678
<table border=1 cellpadding=1 cellspacing=0 bgcolor=#F4F4F4 width="100%" class=CFAQ>
679
<tr><td<b>Step</b></td><td><b>Description</b></td><td><b>Step name</b></td><td><b>Date/Time example</b></td></tr>
680
<tr valign=top><td>A</td><td>logrotate is started (by cron)</td><td>Start of logrotate</td><td>04:02:00</td></tr>
681
<tr valign=top><td>B</td><td><ul>awstats -update is launched by logrotate</td><td>Start of awstats</td><td>04:02:01</td><tr>
682
<tr valign=top><td>C</td><td><ul><ul>awstats start to read the log file <i>file.log</i></td><td> </td><td>04:02:02</td><tr>
683
<tr valign=top><td>D</td><td><ul>awstats has reached the end of log file so now it starts to save its database on disk.</td><td> </td><td>04:05:00</td><tr>
684
<tr valign=top><td>E</td><td><ul>awstats has finished to save its new database, so it stops</td><td>End of awstats</td><td>04:06:00</td><tr>
685
<tr valign=top><td>F</td><td>logrotate moves old log file <i>file.log</i> to a new name <i>file.log.sav</i>. Apache now logs in this file <i>file.log.sav</i> since log file handle has not been changed (only log file name has been renamed).</td><td>Log move</td><td>04:06:01</td><tr>
686
<tr valign=top><td>G</td><td>logrotate sends the -HUP or -USR1 signal to Apache.<br>With -HUP, Apache immediatly kills all its child process/thread, close log file <i>file.log.sav</i>, and reopen file <i>file.log</i>. So now, ALL hits are written to new file.<br>With -USR1, Apache only ask its child process/thread to stop only when HTTP request will be completely served. However it closes immediatly log file <i>file.log.sav</i>, and reopen file <i>file.log</i>. So only NEW hits are written to new log file. HTTP requests that are still running will write in old one.</td><td>Apache restart</td><td>04:06:02</td><tr>
687
<tr valign=top><td>H</td><td>logrotate starts compress the old log file <i>file.log.sav</i> into <i>file.log.gz</i></td><td>Start compress</td><td>04:06:03</td><tr>
688
<tr valign=top><td>I</td><td><ul>If some apache threads/processes are still running (because the kill sent was -USR1, so child process are waiting end of request before to stop), then those threads/processes are still writing to <i>file.log.sav</i>.<br>If kill -HUP was used, all process are already restarted so all writes in new <i>file.log</i>.</td><td> </td><td> </td><tr>
689
<tr valign=top><td>J</td><td>logrotate has finished to compress log file into <i>file.log.gz</i>. File <i>file.log.sav</i> is deleted.</td><td>End of compress<br>End of logrotate</td><td>04:07:03</td><tr>
690
<tr valign=top><td>K</td><td><ul>If signal was -USR1, some old childs can still run (when serving a very long request for example). So the log writing, still done in same file handle are going to a file that has been removed. So log writing are lost nowhere (this is only if -USR1 was used and if request was very long).</td><td> </td><td> </td><tr>
799
<table border=1 cellpadding=1 cellspacing=0 bgcolor=#F4F4F4 width="95%" class=CFAQ>
800
<tr class=CFAQ><td class=CFAQ><b>Step</b></td><td class=CFAQ><b>Description</b></td><td class=CFAQ><b>Step name</b></td><td class=CFAQ><b>Date/Time example</b></td></tr>
801
<tr class=CFAQ valign=top><td class=CFAQ>A</td><td class=CFAQ>logrotate is started (by cron)</td><td class=CFAQ>Start of logrotate</td><td class=CFAQ>04:02:00</td></tr>
802
<tr valign=top><td class=CFAQ>B</td><td class=CFAQ><ul>awstats -update is launched by logrotate</td><td class=CFAQ>Start of awstats</td><td class=CFAQ>04:02:01</td><tr>
803
<tr valign=top><td class=CFAQ>C</td><td class=CFAQ><ul><ul>awstats start to read the log file <i>file.log</i></td><td class=CFAQ> </td><td class=CFAQ>04:02:02</td><tr>
804
<tr valign=top><td class=CFAQ>D</td><td class=CFAQ><ul>awstats has reached the end of log file so now it starts to save its database on disk.</td><td class=CFAQ> </td><td class=CFAQ>04:05:00</td><tr>
805
<tr valign=top><td class=CFAQ>E</td><td class=CFAQ><ul>awstats has finished to save its new database, so it stops</td><td class=CFAQ>End of awstats</td><td class=CFAQ>04:06:00</td><tr>
806
<tr valign=top><td class=CFAQ>F</td><td class=CFAQ>logrotate moves old log file <i>file.log</i> to a new name <i>file.log.sav</i>. Apache now logs in this file <i>file.log.sav</i> since log file handle has not been changed (only log file name has been renamed).</td><td class=CFAQ>Log move</td><td class=CFAQ>04:06:01</td><tr>
807
<tr valign=top><td class=CFAQ>G</td><td class=CFAQ>logrotate sends the -HUP or -USR1 signal to Apache.<br>With -HUP, Apache immediatly kills all its child process/thread, close log file <i>file.log.sav</i>, and reopen file <i>file.log</i>. So now, ALL hits are written to new file.<br>With -USR1, Apache only ask its child process/thread to stop only when HTTP request will be completely served. However it closes immediatly log file <i>file.log.sav</i>, and reopen file <i>file.log</i>. So only NEW hits are written to new log file. HTTP requests that are still running will write in old one.</td><td class=CFAQ>Apache restart</td><td class=CFAQ>04:06:02</td><tr>
808
<tr valign=top><td class=CFAQ>H</td><td class=CFAQ>logrotate starts compress the old log file <i>file.log.sav</i> into <i>file.log.gz</i></td><td class=CFAQ>Start compress</td><td class=CFAQ>04:06:03</td><tr>
809
<tr valign=top><td class=CFAQ>I</td><td class=CFAQ><ul>If some apache threads/processes are still running (because the kill sent was -USR1, so child process are waiting end of request before to stop), then those threads/processes are still writing to <i>file.log.sav</i>.<br>If kill -HUP was used, all process are already restarted so all writes in new <i>file.log</i>.</td><td class=CFAQ> </td><td class=CFAQ> </td><tr>
810
<tr valign=top><td class=CFAQ>J</td><td class=CFAQ>logrotate has finished to compress log file into <i>file.log.gz</i>. File <i>file.log.sav</i> is deleted.</td><td class=CFAQ>End of compress<br>End of logrotate</td><td class=CFAQ>04:07:03</td><tr>
811
<tr valign=top><td class=CFAQ>K</td><td class=CFAQ><ul>If signal was -USR1, some old childs can still run (when serving a very long request for example). So the log writing, still done in same file handle are going to a file that has been removed. So log writing are lost nowhere (this is only if -USR1 was used and if request was very long).</td><td class=CFAQ> </td><td class=CFAQ> </td><tr>
691
812
</table>
692
813
<br>
693
814
The advantage of this solution is that it is a very common way of working, used by a lot of
720
841
or rotatelog tools to rotate your log files. For example, Apache users can setup their Apache
721
842
httpd config file to write log file through a pipe to cronolog or rotatelog using
722
843
Apache <i>CustomLog</i> directive:<br>
723
<i>CustomLog "|/usr/sbin/cronolog [cronolog_options] /var/logs/access.%Y%m%d.log" combined</i><br>
844
<table border=1 cellpadding=1 cellspacing=0 bgcolor=#F4F4F4 width="95%" class=CFAQ><tr class=CFAQ><td class=CFAQ>
845
CustomLog "|/usr/sbin/cronolog [cronolog_options] /var/logs/access.%Y%m%d.log" combined
846
</td></tr></table>
724
847
If you use a such feature, you can't trigger AWStats update process to be ran just BEFORE the
725
848
rotate is done, so you must run it AFTER the rotate process, so on the archived log file.<br>
726
849
To setup awstats to always point to last archive log file, you can use the 'tags' available for
755
878
The use of this tool is not an AWStats related problem, so please take a look at your Windows manual.
756
879
Warning, if you use <i>"awstats.pl -config=mysite -update"</i> in your scheduled task, you might
757
880
experience problem of failing task. Try this instead<br>
758
<i>"C:\WINNT\system32\CMD.EXE /C C:\[awstats_path]\awstats.pl -config=mysite -update"</i><br>
881
<table border=1 cellpadding=1 cellspacing=0 bgcolor=#F4F4F4 width="95%" class=CFAQ><tr class=CFAQ><td class=CFAQ>
882
"C:\WINNT\system32\CMD.EXE /C C:\[awstats_path]\awstats.pl -config=mysite -update"
883
</td></tr></table>
759
884
or<br>
760
<i>"C:\[perl_path]\perl.exe C:\[awstats_path]\awstats.pl -config=mysite -update"</i><br>
761
A lot of other scheduler (sharewares/freewares) are very good.<br>
885
<table border=1 cellpadding=1 cellspacing=0 bgcolor=#F4F4F4 width="95%" class=CFAQ><tr class=CFAQ><td class=CFAQ>
886
"C:\[perl_path]\perl.exe C:\[awstats_path]\awstats.pl -config=mysite -update"
887
</td></tr></table>
888
A lot of other open source schedulers are often better (otherwise there is also good sharewares or freewares).<br>
762
889
<br>
763
890
<u>With unix-like operating systems</u>, you can use the "<b>crontab</b>".<br>
764
891
This is examples of lines you can add in the cron file (see your unix reference manual for cron) :<br>
765
892
To run update every day at 03:50, use :<br>
766
<i>50 3 * * * /usr/local/awstats/wwwroot/cgi-bin/awstats.pl -config=mysite -update >/dev/null</i><br>
893
<table border=1 cellpadding=1 cellspacing=0 bgcolor=#F4F4F4 width="95%" class=CFAQ><tr class=CFAQ><td class=CFAQ>
894
50 3 * * * /usr/local/awstats/wwwroot/cgi-bin/awstats.pl -config=mysite -update >/dev/null<br>
895
</td></tr></table>
767
896
To run update every hour, use :<br>
768
<i>0 * * * * /usr/local/awstats/wwwroot/cgi-bin/awstats.pl -config=mysite -update >/dev/null</i><br>
897
<table border=1 cellpadding=1 cellspacing=0 bgcolor=#F4F4F4 width="95%" class=CFAQ><tr class=CFAQ><td class=CFAQ>
898
0 * * * * /usr/local/awstats/wwwroot/cgi-bin/awstats.pl -config=mysite -update >/dev/null<br>
899
</td></tr></table>
769
900
<br>
770
901
771
902
<a name="EXCLUDEHOSTS"></a><br>
781
912
log file).<br>
782
913
<br>
783
914
915
<a name="SCREENSIZE"></a><br>
916
<b><u>FAQ-COM142 : HOW TO GET THE SCREEN SIZE AND BROWSER CAPABILITIES REPORT WORKING ?</u></b><br>
917
<font class=CProblem>PROBLEM:</font><br>
918
I see in the AWStats features list that it can report the screen size used by visitors and also if its browser
919
support Flash, java, etc... How can I do that ?<br>
920
<font class=CSolution>SOLUTION:</font><br>
921
AWStats is a log analyzer, so to report the screen size of your visitor, we need to have information inside the log file.
922
For this, the only way to do that is to add some HTML tags inside some of your pages (the home page is enoough to
923
get screen size use ratios). This tag will add call to a javascript that ask your browser to call of an URL that
924
includes in its parameters, the screen size resolution and other informations about browser capabilities.<br>
925
<br>
926
This is the code you must add (at bottom of your home page for example) :<br>
927
<table border=1 cellpadding=1 cellspacing=0 bgcolor=#F4F4F4 width="95%" class=CFAQ><tr class=CFAQ><td class=CFAQ>
928
<script language="javascript" type="text/javascript" src="/js/awstats_misc_tracker.js" ></script><br>
929
<noscript><img src="/js/awstats_misc_tracker.js?nojs=y" height="0" width="0" border="0" style="display: none"></noscript><br>
930
</td></tr></table>
931
<br>
932
Note that you must also place the <i>awstats_misc_tracker.js</i> script (provided in /js directory with AWStats) inside
933
a js directory stored in your web root.<br>
934
Once this is done, load your home page with your browser and go to check that inside your log file
935
if you can see a line that looks like that:<br>
936
<table border=1 cellpadding=1 cellspacing=0 bgcolor=#F4F4F4 width="95%" class=CFAQ><tr class=CFAQ><td class=CFAQ>
937
123.123.123.123 - - [24/Apr/2005:16:09:38 +0200] "GET /js/awstats_misc_tracker.js?screen=800x600&win=724x517&...&sid=awssession_id123 HTTP/1.1" 200 6237 "http://therefererwebsite.com/index.php" "Mozilla/5.0 (Linux) Gecko/20050414 Firefox/1.0.3"
938
</td></tr></table>
939
<br>
940
If yes, you can then run the AWStats update process. Screen sizes information will be analyzed. All you have to do
941
now is to edit your config file to tell AWStats to add the report on html output. For this, change
942
the <a href="awstats_config.html#Show">ShowMiscStats</a> parameter.<br>
943
<table border=1 cellpadding=1 cellspacing=0 bgcolor=#F4F4F4 width="95%" class=CFAQ><tr class=CFAQ><td class=CFAQ>
944
ShowMiscStats=anjdfrqwp
945
</td></tr></table>
946
<br>
947
Note: If you change directory where <i>awstats_misc_tracker.js</i> is stored (somewhere else than the /js directory),
948
you must modify, according to your change:<br>
949
- the html tags added<br>
950
- the line: <i>var awstatsmisctrackerurl="/js/awstats_misc_tracker.js";</i> inside the awstats_misc_tracker.js script<br>
951
- the parameter <a href="awstats_config.html#MiscTrackerUrl">MiscTrackerUrl</a> inside AWStats configuration file.<br>
952
<br>
953
784
954
<a name="EXTRA"></a><br>
785
955
<b><u>FAQ-COM145 : HOW TO USE THE EXTRA SECTIONS FEATURES ?</u></b><br>
786
956
<font class=CProblem>PROBLEM:</font><br>
806
976
The reported page AWStats shows me has no hostnames, only IP addresses, countries reported are all "unknown".<br>
807
977
<font class=CSolution>SOLUTION:</font><br>
808
978
When AWStats find an IP address in your log file, it tries a reverse DNS lookup to find
809
the hostname and domain if the <a href="awstats_tools.html#DNSLookup">DNSLookup</a> parameter, in your AWStats config file, is <a href="awstats_config.html#DNSLookup">DNSLookup</a>=1
979
the hostname and domain if the <a href="awstats_config.html#DNSLookup">DNSLookup</a> parameter, in your AWStats config file, is <a href="awstats_config.html#DNSLookup">DNSLookup</a>=1
810
980
(Default value). So, first, check if you have the good value. The <a href="awstats_config.html#DNSLookup">DNSLookup</a>=0
811
981
must be used only if your log file contains already resolved IP address. For example,
812
982
when you set up Apache with the <i>HostNameLookups=on</i> directive. When you
906
1076
<br># 80.8.55.9 not a visit (but a worm attack)
907
1077
<br># 80.8.55.10 1 visit that come from a web page that is not a search engine
908
1078
<br>
1079
<br>#
1080
<br># TOTAL YOU MUST GET: 6 visits made by 5 different human visitors that viewed 21 pages and
1081
<br># 15 not pages (36 hits). Others 7 pages/hits are "not viewed" traffic.
1082
<br>
909
1083
<br>80.8.55.1 - - [01/Jan/2001:00:00:10 +0100] "GET /page1.html HTTP/1.0" 200 7009 "-" "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0)"
910
1084
<br>80.8.55.1 - - [01/Jan/2001:00:00:00 +0100] "GET / HTTP/1.0" 200 7009 "http://www.sitereferer/cgi-bin/search.pl?q=a" "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0)"
911
1085
<br>80.8.55.1 - - [01/Jan/2001:00:00:20 +0100] "GET /page2.cgi HTTP/1.0" 200 7009 "http://localhost/page1.html" "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0)"
914
1088
<br>80.8.55.1 - - [01/Jan/2001:00:00:35 +0100] "GET /image2.png HTTP/1.0" 200 7009 "-" "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0)"
915
1089
<br>80.8.55.1 - - [01/Jan/2001:00:00:40 +0100] "GET /dir/favicon.ico HTTP/1.0" 404 299 "-" "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0)"
916
1090
<br>80.8.55.1 - - [01/Jan/2001:00:00:40 +0100] "GET /favicon.ico HTTP/1.0" 200 299 "-" "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0)"
1091
<br>
917
1092
<br>80.8.55.1 - - [01/Jan/2001:12:00:00 +0100] "GET / HTTP/1.0" 200 7009 "http://WWW.SiteRefereR:80/cgi-bin/azerty.pl?q=a" "Mozilla/4.7 [fr] (Win95; I)"
918
1093
<br>80.8.55.1 - - [01/Jan/2001:12:00:10 +0100] "GET /page1.html HTTP/1.0" 200 7009 "-" "Mozilla/4.7 [fr] (Win95; I)"
919
1094
<br>80.8.55.1 - - [01/Jan/2001:12:00:20 +0100] "GET /page2.cgi HTTP/1.0" 200 7009 "-" "Mozilla/4.7 [fr] (Win95; I)"
921
1096
<br>80.8.55.1 - - [01/Jan/2001:12:00:30 +0100] "GET /image.gif HTTP/1.0" 200 7009 "-" "Mozilla/4.7 [fr] (Win95; I)"
922
1097
<br>80.8.55.1 - - [01/Jan/2001:12:00:35 +0100] "GET /image2.png HTTP/1.0" 200 7009 "-" "Mozilla/4.7 [fr] (Win95; I)"
923
1098
<br>80.8.55.1 - - [01/Jan/2001:12:00:40 +0100] "GET /js/awstats_misc_tracker.js HTTP/1.1" 200 4998 "-" "Mozilla/4.7 [fr] (Win95; I)"
924
<br>80.8.55.1 - - [01/Jan/2001:12:00:45 +0100] "GET /js/awstats_misc_tracker.js?SCREEN=1024x768&CDI=32&JAVA=true&UC=UserCode1056710428488r6832&SC=SessionCode1056710428488r6832&SHK=N&FLA=Y&RP=N&MOV=N&WMA=Y&PDF=Y HTTP/1.1" 200 4998 "-" "Mozilla/4.7 [fr] (Win95; I)"
1099
<br>80.8.55.1 - - [01/Jan/2001:12:00:45 +0100] "GET /js/awstats_misc_tracker.js?screen=1024x768&cdi=32&java=true&shk=n&fla=y&rp=y&mov=n&wma=y&pdf=y&uid=awsuser_id1073036758306r9417&sid=awssession_id1073036758306r9417 HTTP/1.1" 200 4998 "-" "Mozilla/4.7 [fr] (Win95; I)"
925
1100
<br>
926
<br>80.8.55.2 - - [01/Jan/2001:12:01:00 +0100] "GET /hitfromothersitetoimage.gif HTTP/1.0" 200 7009 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.3) Gecko/20030312"
1101
<br>80.8.55.2 - - [01/Jan/2001:12:01:00 +0100] "GET /hitfromothersitetoimage.gif HTTP/1.0" 200 7009 "-" "Mozilla/5.0+(Macintosh;+U;+PPC+Mac+OS+X+Mach-O;+en-US;+rv:1.4)+Gecko/20030624+Netscape/7.1"
927
1102
<br>
928
1103
<br>80.8.55.3 - - [01/Jan/2001:12:01:10 +0100] "GET / HTTP/1.0" 200 7009 "http://www.sitereferer:81/cgi-bin/azerty.pl" "Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.5a) Gecko/20030728 Mozilla Firebird/0.6.1"
929
1104
<br>80.8.55.3 - - [01/Jan/2001:12:01:15 +0100] "GET /page1.html HTTP/1.0" 200 7009 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.5a) Gecko/20030728 Mozilla Firebird/0.6.1"
934
1109
<br>
935
1110
<br>80.8.55.4 - - [01/Jan/2001:12:01:45 +0100] "GET /samevisitorthan80.8.55.3usingaolproxy.gif HTTP/1.0" 200 7009 "-" "Mozilla/3.0 (Windows 98; U) Opera 6.03"
936
1111
<br>
1112
<br>80.8.55.5 - - [01/Jan/2001:12:02:00 +0200] "GET /robots.txt HTTP/1.0" 200 299 "-" "Unknown bot"
937
1113
<br>80.8.55.5 - - [01/Jan/2001:12:02:00 +0200] "GET /robots.txt HTTP/1.0" 200 299 "-" "GoogleBot"
938
<br>80.8.55.5 - - [01/Jan/2001:12:02:05 +0200] "GET / HTTP/1.0" 200 7009 "-" "GoogleBot"
939
<br>
940
<br>80.8.55.6 - john [01/Jan/2001:13:00:00 +0100] "GET /cgi-bin/order.cgi?x=a&family=a&productId=998&titi=i&y=b&y=b HTTP/1.0" 200 7009 "http://www.google.com/search?sourceid=navclient&ie=utf-8&oe=utf-8&q=ma%C3%AEtre" "SAGEM-myX-5m/1.0_UP.Browser/6.1.0.6.1.103_(GUI)_MMP/1.0_(Google_WAP_Proxy/1.0)"
941
<br>80.8.55.6 - john [01/Jan/2001:13:00:00 +0100] "GET /cgi-bin/order.cgi?x=a&family=a&productId=998&titi=i&y=b&y=b HTTP/1.0" 200 7009 "http://www.google.com/search?sourceid=navclient&ie=utf-8&oe=utf-8&q=�l�ve" "SAGEM-myX-5m/1.0_UP.Browser/6.1.0.6.1.103_(GUI)_MMP/1.0_(Google_WAP_Proxy/1.0)"
942
<br>
943
<br>80.8.55.7 - John Begood [01/Jan/2001:13:01:00 +0100] "GET /cgi-bin/order.cgi;family=f&type=t&productId=999&titi=i#BIS HTTP/1.0" 200 7009 "-" "Mozilla/3.01 (compatible;)"
1114
<br>80.8.55.5 - - [01/Jan/2001:12:02:05 +0200] "GET /page2.cgi HTTP/1.0" 200 7009 "-" "GoogleBot"
1115
<br>
1116
<br>80.8.55.6 - john [01/Jan/2001:13:00:00 +0100] "GET /cgi-bin/order.cgi?x=a&family=a&productId=998&titi=i&y=b&y=b HTTP/1.0" 200 7009 "http://www.google.com/search?sourceid=navclient&ie=utf-8&oe=utf-8&q=ma%C3%AEtre+�l�ve" "SAGEM-myX-5m/1.0_UP.Browser/6.1.0.6.1.103_(GUI)_MMP/1.0_(Google_WAP_Proxy/1.0)"
1117
<br>80.8.55.6 - john [01/Jan/2001:13:00:00 +0100] "GET /images/image1.gif HTTP/1.0" 200 364 "http://www.google.fr/search?q=cache:dccTQ_Zn4isJ:www.chiensderace.com/cgi-bin/liste_annonces.pl%3FTYPE%3D5%26ORIGINE%3Dchiensderace+labrador+chiensderace&hl=en&lr=lang_en|lang_fr&ie=UTF-8" "SAGEM-myX-5m/1.0_UP.Browser/6.1.0.6.1.103_(GUI)_MMP/1.0_(Google_WAP_Proxy/1.0)"
1118
<br>80.8.55.6 - john [01/Jan/2001:13:00:00 +0100] "GET /images/image2.gif HTTP/1.0" 200 364 "http://www.google.fr/search?q=cache:dccTQ_Zn4isJ:www.chiensderace.com/cgi-bin/liste_annonces.pl%3FTYPE%3D5%26ORIGINE%3Dchiensderace+labrador+chiensderace&hl=en&lr=lang_en|lang_fr&ie=UTF-8" "SAGEM-myX-5m/1.0_UP.Browser/6.1.0.6.1.103_(GUI)_MMP/1.0_(Google_WAP_Proxy/1.0)"
1119
<br>80.8.55.6 - john [01/Jan/2001:13:00:00 +0100] "GET /images/image3.gif HTTP/1.0" 200 364 "http://www.google.fr/search?q=cache:dccTQ_Zn4isJ:www.chiensderace.com/cgi-bin/liste_annonces.pl%3FTYPE%3D5%26ORIGINE%3Dchiensderace+labrador+chiensderace&hl=en&lr=lang_en|lang_fr&ie=UTF-8" "SAGEM-myX-5m/1.0_UP.Browser/6.1.0.6.1.103_(GUI)_MMP/1.0_(Google_WAP_Proxy/1.0)"
1120
<br>80.8.55.6 - john [01/Jan/2001:13:00:00 +0100] "GET /images/image4.gif HTTP/1.0" 200 364 "http://www.google.fr/search?q=cache:dccTQ_Zn4isJ:www.chiensderace.com/cgi-bin/liste_annonces.pl%3FTYPE%3D5%26ORIGINE%3Dchiensderace+labrador+chiensderace&hl=en&lr=lang_en|lang_fr&ie=UTF-8" "SAGEM-myX-5m/1.0_UP.Browser/6.1.0.6.1.103_(GUI)_MMP/1.0_(Google_WAP_Proxy/1.0)"
1121
<br>80.8.55.6 - john [01/Jan/2001:13:00:00 +0100] "GET /images/image5.gif HTTP/1.0" 200 364 "http://www.google.fr/search?q=cache:dccTQ_Zn4isJ:www.chiensderace.com/cgi-bin/liste_annonces.pl%3FTYPE%3D5%26ORIGINE%3Dchiensderace+labrador+chiensderace&hl=en&lr=lang_en|lang_fr&ie=UTF-8" "SAGEM-myX-5m/1.0_UP.Browser/6.1.0.6.1.103_(GUI)_MMP/1.0_(Google_WAP_Proxy/1.0)"
1122
<br>
1123
<br>80.8.55.7 - John Begood [01/Jan/2001:13:01:00 +0100] "GET /cgi-bin/order.cgi;family=f&type=t&productId=999&titi=i#BIS HTTP/1.0" 200 7009 "http://www.a9.com/searchkeyfroma9" "Mozilla/3.01 (compatible;)"
1124
<br>80.8.55.7 - John Begood [01/Jan/2001:13:01:00 +0100] "GET /do/Show;jsessionid=6BEF030AB1677BEC333FFCC7BF4DF564?param=1477 HTTP/1.0" 200 7009 "-" "Mozilla/3.01 (compatible;)"
944
1125
<br>
945
1126
<br>80.8.55.8 - - [01/Jan/2001:14:01:20 +0100] "GET /404notfoundpage.html?paramnotpagefound=valparamnotpagefound HTTP/1.0" 404 0 "http://refererto404nofoundpage/pageswithbadlink.html?paramrefnotpagefound=valparamrefnotpagefound" "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0)"
946
1127
<br>80.8.55.8 - - [01/Jan/2001:14:01:20 +0100] "GET /405error.html HTTP/1.0" 405 0 "http://refererto405error/pagesfrom405.html" "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0)"
947
1128
<br>
948
<br>80.8.55.9 - - [01/Jan/2001:15:00:00 +0200] "GET /default.ida?XXXXXXXXXXXXXXXXXX%u6858%ucbd3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a HTTP/1.0" 404 299 "-" "-"
949
<br>
950
<br>80.8.55.10 - - [01/Jan/2001:16:00:00 -0300] "GET / HTTP/1.1" 200 70476 "http://us.f109.mail.yahoo.com/ym/ShowLetter?box=Inbox&MoreYahooParams..." "Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; Win 9x 4.90; Hotbar 4.2.8.0)"
951
<br>80.8.55.10 - - [01/Jan/2001:17:00:00 -0300] "GET /page1.html HTTP/1.1" 200 70476 "http://www.freeweb.hu/icecat/filmek/film04.html" "Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; Win 9x 4.90; Hotbar 4.2.8.0)"
952
<br>80.8.55.10 - - [01/Jan/2001:18:00:00 -0300] "GET /cgi-bin/awredir.pl?url=http://xxx.com/aa.html HTTP/1.1" 302 70476 "http://us.f109.mail.yahoo.com/ym/ShowLetter?box=Inbox&MoreYahooParams..." "Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; Win 9x 4.90; Hotbar 4.2.8.0)"
1129
<br>80.8.55.9 - - [01/Jan/2001:15:00:00 +0200] "GET /default.ida?XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a HTTP/1.0" 404 299 "-" "-"
1130
<br>80.8.55.9 - - [01/Jan/2001:15:00:00 +0200] "SEARCH / -" 411 - "-" "-"
1131
<br>
1132
<br>80.8.55.10 - - [01/Jan/2001:16:00:00 -0300] "GET / HTTP/1.1" 200 70476 "http://us.f109.mail.yahoo.com/ym/ShowLetter?box=Inbox&MoreYahooParams..." "Mozilla/5.0 (Windows; U; Windows NT 5.0; fr-FR; rv:1.7.5) Gecko/20041108 Firefox/1.0"
1133
<br>80.8.55.10 - - [01/Jan/2001:16:00:00 -0300] "GET / HTTP/1.1" 200 70476 "http://us.f109.mail.yahoo.com/ym/ShowLetter?box=Inbox&MoreYahooParams..." "Mozilla/5.0 (Windows; U; Windows NT 5.0; fr-FR; rv:1.7.5) Gecko/20041108 Firefox/1.0"
1134
<br>80.8.55.10 - - [01/Jan/2001:16:00:00 -0300] "GET / HTTP/1.1" 200 70476 "http://us.f109.mail.yahoo.com/ym/ShowLetter?box=Inbox&MoreYahooParams..." "Mozilla/5.0 (Windows; U; Windows NT 5.0; fr-FR; rv:1.7.5) Gecko/20041108 Firefox/1.0"
1135
<br>80.8.55.10 - - [01/Jan/2001:16:00:00 -0300] "GET / HTTP/1.1" 200 70476 "http://us.f109.mail.yahoo.com/ym/ShowLetter?box=Inbox&MoreYahooParams..." "Mozilla/5.0 (Windows; U; Windows NT 5.0; fr-FR; rv:1.7.5) Gecko/20041108 Firefox/1.0"
1136
<br>
1137
<br>80.8.55.10 - - [01/Jan/2001:16:00:00 -0300] "GET / HTTP/1.1" 200 70476 "http://us.f109.mail.yahoo.com/ym/ShowLetter?box=Inbox&MoreYahooParams..." "Mozilla/5.0 (Windows; U; Windows NT 5.0; fr-FR; rv:1.7.5) Gecko/20041108 Firefox/1.0"
1138
<br>80.8.55.10 - - [01/Jan/2001:16:30:00 -0300] "GET /page1.html HTTP/1.1" 200 70476 "http://www.freeweb.hu/icecat/filmek/film04.html" "Mozilla/5.0 (Windows; U; Windows NT 5.0; fr-FR; rv:1.7.5) Gecko/20041108 Firefox/1.0"
1139
<br>80.8.55.10 - - [01/Jan/2001:17:00:00 -0300] "GET /cgi-bin/awredir.pl?url=http://xxx.com/aa.html HTTP/1.1" 302 70476 "http://us.f109.mail.yahoo.com/ym/ShowLetter?box=Inbox&MoreYahooParams..." "Mozilla/5.0 (Windows; U; Windows NT 5.0; fr-FR; rv:1.7.5) Gecko/20041108 Firefox/1.0"
953
1140
</i>
954
1141
</td></tr></table><br>
955
1142
<u>This is what you should find:</u><br>
983
1170
So this means this way of working might never be changed, so another chance is to use the AWStats plugin 'timezone'.
984
1171
Warning, this plugin need the perl module Time::Local and it reduces seriously AWStats speed.<br>
985
1172
To enable the plugin, uncomment the following line in your config file.<br>
986
<i>LoadPlugin="timezone TZ"</i><br>
1173
<table border=1 cellpadding=1 cellspacing=0 bgcolor=#F4F4F4 width="95%" class=CFAQ><tr class=CFAQ><td class=CFAQ>
1174
LoadPlugin="timezone TZ"<br>
1175
</td></tr></table>
987
1176
where TZ is value of your signed timezone (+2 for Paris, -8 for ...)<br>
988
1177
<br>
989
1178
1179
<a name="GEOIPEU"></a><br>
1180
<b><u>FAQ-COM320 : WHAT DOES MEAN "EU" (EUROPEAN COUNTRY)" IN GEOIP COUNTRY REPORTS ?</u></b><br>
1181
<font class=CProblem>PROBLEM:</font><br>
1182
I use the <a href="awstats_contrib.html#geoip">AWStats GeoIp country plugins</a> to report countries according
1183
to geolocalisation of IP address.
1184
In country report, I have some visitors said to come from "eu (European country)". If this visitor
1185
come from France, does this means it is reported twice ?<br>
1186
<font class=CSolution>SOLUTION:</font><br>
1187
No.<br>
1188
"eu (European country)" means we are sure that visitor come from an european country but we can't tell
1189
wich one. It might be a major country like France, Great Britain, Spain, Germany... like a very small one.<br>
1190
So, in the country report, each visitor is in one and only one group. If reported in "eu (European country)",
1191
it is not counted in another country, and if reported in a particular country, it is not counted in "eu (European country)",
1192
even if this country is in Europe.<br>
1193
<br>
1194
990
1195
<a name="OLDLOG"></a><br>
991
1196
<b><u>FAQ-COM350 : HOW CAN I PROCESS AN OLD LOG FILE ?</u></b><br>
992
1197
<font class=CProblem>PROBLEM:</font><br>
1024
1229
<i>LogFile=mylog*.log</i><br>
1025
1230
However, with such a syntax, AWStats can't know in wich order processing log files (wich log file is the first, next or last). So
1026
1231
to work like this you must use the following syntax:<br>
1027
<i>LogFile="/pathto/logresolvemerge.pl mylog*.log |"</i><br>
1232
<table border=1 cellpadding=1 cellspacing=0 bgcolor=#F4F4F4 width="95%" class=CFAQ><tr class=CFAQ><td class=CFAQ>
1233
LogFile="/pathto/logresolvemerge.pl mylog*.log |"<br>
1234
</td></tr></table>
1235
<br>
1028
1236
<a href="awstats_tools.html#logresolvemerge">Logresolvemerge</a> is a tool provided with
1029
AWStats (in tools directory) that merge several log files on the fly sending line by line always the older record
1030
from a list of several log files. Using such a tool as a pipe source for AWStats <a href="awstats_config.html#LogFile">LogFile</a>
1237
AWStats (in tools directory) that merge several log files on the fly. It opens pointer on each files
1238
and sends, line by line, the oldest record from this. Using such a tool as a pipe source for AWStats <a href="awstats_config.html#LogFile">LogFile</a>
1031
1239
parameter is a very good solution because, it allows you to merge log files whatever their size
1032
1240
with no memory use, no hard disk use (no temporary files built), it is fast, it prevents
1033
1241
you from a bad order if your log files are not correctly ordered, etc...<br>
1041
1249
<font class=CSolution>SOLUTION:</font><br>
1042
1250
First solution is to merge all split log files resulted from all your load balanced servers into one. For this, you can use
1043
1251
the <a href="awstats_tools.html#logresolvemerge">logresolvemerge</a> tool provided with AWStats :<br>
1044
<i>logresolvemerge.pl file1.log file2.log ... filen.log > newfiletoprocess.log</i><br>
1252
<table border=1 cellpadding=1 cellspacing=0 bgcolor=#F4F4F4 width="95%" class=CFAQ><tr class=CFAQ><td class=CFAQ>
1253
logresolvemerge.pl file1.log file2.log ... filen.log > newfiletoprocess.log
1254
</td></tr></table>
1045
1255
And setup the <a href="awstats_config.html#LogFile">LogFile</a> parameter in your config file to process the <i>newfiletoprocess.log</i> file or use
1046
1256
the <i>-LogFile</i> command line option to overwrite <a href="awstats_config.html#LogFile">LogFile</a> value.<br>
1257
<br>
1047
1258
As an other solution, if you miss disk space, or to save time, you can ask <a href="awstats_tools.html#logresolvemerge">logresolvemerge</a>
1048
1259
to merge log files on the fly during the AWStats update process. For this, you can use the following syntax in your AWStats config file:<br>
1049
<i>LogFile="/pathto/logresolvemerge.pl file*.log |"</i><br>
1260
<table border=1 cellpadding=1 cellspacing=0 bgcolor=#F4F4F4 width="95%" class=CFAQ><tr class=CFAQ><td class=CFAQ>
1261
LogFile="/pathto/logresolvemerge.pl file*.log |"<br>
1262
</td></tr></table>
1263
<br>
1050
1264
See also <a href="awstats_faq.html#MULTILOG">FAQ-COM360</a> for explanation on logresolvemerge use.<br>
1051
1265
<br>
1052
1266
1070
1284
How can I compile and build statistics on a daily basis. I mean i want to have a full report
1071
1285
with all charts with data for a particular day only and want one report for each day of month.<br>
1072
1286
<font class=CSolution>SOLUTION:</font><br>
1287
<b>If you use version 6.5 or higher:</b><br>
1288
What you can do is rerun the update process by adding the parameter -databasebreak=hour or -databasebreak=day.
1289
No option is same than -databasebreak=month, the default and old behaviour of AWStats.<br>
1290
Using this hidden option will ask AWStats to build a different database file for each break,
1291
this means that several reports are done for each hour or day.<br>
1292
To call a report add same option -databasebreak=hour or -databasebreak=day with option -output
1293
when AWStats report is staticaly built from command line or add &databasebreak=hour or
1294
&databasebreak=day if AWStats is called as a CGI.<br>
1295
This feature is recent so may have results not completely reliable, that's why it is not yet
1296
fully documented.<br>
1297
<b>If you use version 6.4 or older:</b><br>
1073
1298
This is an non documented and not supported trick, as this is not the standard way of working:<br>
1074
1299
First, run the update process at midnight (or on a log file that was rotated at midnight so that
1075
1300
it contains only data for this particular day (you can choose another hour in night if you want
1149
1374
tell Apache where is your external Perl interpreter.<br>
1150
1375
<u>For this, you have 2 solutions:</u><br>
1151
1376
1) Add the following directive in your Apache <b>httpd.conf</b> config (or remove the # to uncomment it if line is already available)<br>
1152
<b><i>ScriptInterpreterSource registry</i></b><br>
1377
<table border=1 cellpadding=1 cellspacing=0 bgcolor=#F4F4F4 width="95%" class=CFAQ><tr class=CFAQ><td class=CFAQ>
1378
ScriptInterpreterSource registry
1379
</td></tr></table>
1153
1380
Then restart Apache. This will tell Apache to look into the registry to find the program associated to .pl extension.<br>
1154
1381
2) Other solution (not necessary if first solution works): Change the first line of awstats.pl file with the full path of your Perl interpreter.<br>
1155
1382
Example with Windows OS and ActivePerl Perl interpreter (installed in C:\Program Files\ActiveState\ActivePerl),
1156
1383
you must change the first line of awstats.pl file with:<br>
1157
<i>#!c:/program files/activestate/activeperl/bin/perl</i><br>
1384
<table border=1 cellpadding=1 cellspacing=0 bgcolor=#F4F4F4 width="95%" class=CFAQ><tr class=CFAQ><td class=CFAQ>
1385
#!c:/program files/activestate/activeperl/bin/perl
1386
</td></tr></table>
1158
1387
<br>
1159
1388
1160
1389
<a name="CRASH"></a><a name="CRASH"></a><br>
1175
1404
one of the best and most popular web browser.<br>
1176
1405
<br>
1177
1406
1178
<a name="PERSONALIZEDLOG"></a><br>
1179
<b><u>FAQ-SET250 : LOG FORMAT SETUP OR ERRORS</u></b><br>
1180
<font class=CProblem>PROBLEM:</font><br>
1181
Which value do I have to put in the LogFormat parameter to make AWStats working with my log
1182
file format ?<br>
1183
<font class=CSolution>SOLUTION:</font><br>
1184
The AWStats config file give you all possible values for LogFormat parameter.
1185
To help you, this is some common cases of log file format, and
1186
the corresponding value for LogFormat you must use in your AWStats config file:<br>
1187
1188
<table bgcolor=#F4F4F4 width="100%" class=CFAQ><tr class=CFAQ><td class=CFAQ>
1189
<u>If your log records are EXACTLY like this (<b>NCSA combined/XLF/ELF</b> log format):</u><br>
1190
<i>62.161.78.73 - - [dd/mmm/yyyy:hh:mm:ss +0x00] "GET /page.html HTTP/1.1" 200 1234 "http://www.from.com/from.htm" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)"</i><br>
1191
You must use : <i>LogFormat=1</i><br>
1192
This is same than: <i>LogFormat="%host %other %logname %time1 %methodurl %code %bytesd %refererquot %uaquot"</i><br>
1193
</td></tr></table>
1194
1195
<u>If your log records are EXACTLY like this (<b>NCSA combined with several virtualhostname</b> sharing same log file).</u><br>
1196
<i>virtualserver1 62.161.78.73 - - [dd/mmm/yyyy:hh:mm:ss +0x00] "GET /page.html HTTP/1.1" 200 1234 "http://www.from.com/from.htm" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)"</i><br>
1197
You must use : <i>LogFormat="%virtualname %host %other %logname %time1 %methodurl %code %bytesd %refererquot %uaquot"</i><br>
1198
1199
<table bgcolor=#F4F4F4 width="100%" class=CFAQ><tr class=CFAQ><td class=CFAQ>
1200
<u>If your log records are EXACTLY like this (<b>NCSA combined and mod_gzip format 1</b> with <b>Apache 1.x</b>):</u><br>
1201
<i>62.161.78.73 - - [dd/mmm/yyyy:hh:mm:ss +0x00] "GET /page.html HTTP/1.1" 200 3904 "http://www.from.com/from.htm" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)" mod_gzip: 66pct.</i><br>
1202
You must use : <i>LogFormat="%host %other %logname %time1 %methodurl %code %bytesd %refererquot %uaquot %other %gzipratio"</i><br>
1203
</td></tr></table>
1204
1205
<u>If your log records are EXACTLY like this (<b>NCSA combined and mod_gzip format 2</b> with <b>Apache 1.x</b>):</u><br>
1206
<i>62.161.78.73 - - [dd/mmm/yyyy:hh:mm:ss +0x00] "GET /page.html HTTP/1.1" 200 3904 "http://www.from.com/from.htm" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)" mod_gzip: DECHUNK:OK In:11393 Out:3904:66pct.</i><br>
1207
You must use : <i>LogFormat="%host %other %logname %time1 %methodurl %code %bytesd %refererquot %uaquot %other %other %gzipin %gzipout"</i><br>
1208
1209
<table bgcolor=#F4F4F4 width="100%" class=CFAQ><tr class=CFAQ><td class=CFAQ>
1210
<u>If your log records are EXACTLY like this (<b>NCSA combined and mod_deflate</b> with <b>Apache 2 </b>):</u><br>
1211
<i>62.161.78.73 - - [dd/mmm/yyyy:hh:mm:ss +0x00] "GET /page.html HTTP/1.1" 200 3904 "http://www.from.com/from.htm" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)" (45)</i><br>
1212
You must use : <i>LogFormat="%host %other %logname %time1 %methodurl %code %bytesd %refererquot %uaquot %deflateratio"</i><br>
1213
</td></tr></table>
1214
1215
<u>If your log records are EXACTLY like this (<b>NCSA combined with 2 spaces between some fields</b> with <b>Zope</b>):</u><br>
1216
<i>62.161.78.73 - - [dd/mmm/yyyy:hh:mm:ss +0x00] "GET /page.html HTTP/1.1" 200 3904 "http://www.from.com/from.htm" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)" (45)</i><br>
1217
You must use : <i><br>
1218
LogFormat="%host %other %logname %time1 %methodurl %code %bytesd %refererquot %uaquot"<br>
1219
LogSeparator=" *"<br>
1220
</i>
1221
1222
<table bgcolor=#F4F4F4 width="100%" class=CFAQ><tr class=CFAQ><td class=CFAQ>
1223
<u>If your log records are EXACTLY like this (<b>NCSA common CLF</b> log format):</u><br>
1224
<i>62.161.78.73 - - [dd/mmm/yyyy:hh:mm:ss +0x00] "GET /page.html HTTP/1.1" 200 1234</i><br>
1225
You must use : <i>LogFormat=4</i><br>
1226
Note: Browsers, OS's, Keywords and Referers features are not available with a such format.<br>
1227
</td></tr></table>
1228
1229
<u>If your log records are EXACTLY like this (With some <b>Squid</b> versions, after setting <i>emulate_http_log</i> to on):</u><br>
1230
<i>200.135.30.181 - - [dd/mmm/yyyy:hh:mm:ss +0x00] "GET http://www.mydomain.com/page.html HTTP/1.0" 200 456 TCP_CLIENT_REFRESH_MISS:DIRECT</i><br>
1231
You must use : <i>LogFormat="%host %other %logname %time1 %methodurl %code %bytesd %other"</i><br>
1232
1233
<table bgcolor=#F4F4F4 width="100%" class=CFAQ><tr class=CFAQ><td class=CFAQ>
1234
<u>If your log records are EXACTLY like this (Some old <b>IIS</b> W3C log format):</u><br>
1235
<i>yyyy-mm-dd hh:mm:ss 62.161.78.73 - GET /page.html 200 1234 HTTP/1.1 Mozilla/4.0+(compatible;+MSIE+5.01;+Windows+NT+5.0) http://www.from.com/from.html</i><br>
1236
You must use : <i>LogFormat=2</i><br>
1237
</td></tr></table>
1238
1239
<u>If your log records are EXACTLY like this (Some <b>IIS</b> W3C log format with some <b>.net</b> servers):</u><br>
1240
<i>yyyy-mm-dd hh:mm:ss GET /page.html - 62.161.78.73 - Mozilla/4.0+(compatible;+MSIE+5.01;+Windows+NT+5.0) http://www.from.com/from.html 200 1234 HTTP/1.1</i><br>
1241
You must use : <i>LogFormat="%time2 %method %url %logname %host %other %ua %referer %code %bytesd %other"</i><br>
1242
1243
<table bgcolor=#F4F4F4 width="100%" class=CFAQ><tr class=CFAQ><td class=CFAQ>
1244
<u>If your log records are EXACTLY like this (Some <b>IIS 6+</b> W3C log format):</u><br>
1245
<i>yyyy-mm-dd hh:mm:ss GET /page.html - 62.161.78.73 - Mozilla/4.0+(compatible;+MSIE+5.01;+Windows+NT+5.0) http://www.from.com/from.html 200 1234</i><br>
1246
You must use : <i>LogFormat="date time cs-method cs-uri-stem cs-username c-ip cs-version cs(User-Agent) cs(Referer) sc-status sc-bytes"</i><br>
1247
</td></tr></table>
1248
1249
<u>If your log records are EXACTLY like this (With some <b>WebSite</b> versions):</u><br>
1250
<i>yyyy-mm-dd hh:mm:ss 62.161.78.73 - 192.168.1.1 80 GET /page.html - 200 11205 0 0 HTTP/1.1 mydomain.com Mozilla/4.0+(compatible;+MSIE+5.5;+Windows+98) - http://www.from.com/from.html</i><br>
1251
You must use : <i>LogFormat="%time2 %host %logname %other %other %method %url %other %code %bytesd %other %other %other %other %ua %other %referer"</i><br>
1252
1253
<table bgcolor=#F4F4F4 width="100%" class=CFAQ><tr class=CFAQ><td class=CFAQ>
1254
<u>If your log records are EXACTLY like this (<b>Webstar</b> native log format):</u><br>
1255
<i>05/21/00 00:17:31 OK 200 212.242.30.6 Mozilla/4.0 (compatible; MSIE 5.0; Windows 98; DigExt) http://www.cover.dk/ "www.cover.dk" :Documentation:graphics:starninelogo.white.gif 1133</i><br>
1256
You must use : <i>LogFormat=3</i><br>
1257
</td></tr></table>
1258
1259
<u>If your log records are EXACTLY like this (With some <b>Lotus Notes/Domino</b> versions):</u><br>
1260
<i>62.161.78.73 - Name Surname Service [dd/mmm/yyyy:hh:mm:ss +0x00] "GET /page.html HTTP/1.1" 200 1234 "http://www.from.com/from.htm" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)"</i><br>
1261
You must use : <i>LogFormat=6</i><br>
1262
1263
<table bgcolor=#F4F4F4 width="100%" class=CFAQ><tr class=CFAQ><td class=CFAQ>
1264
<u>If your log records are EXACTLY like this (<b>Lotus Notes/Domino 6.x</b> log format):</u><br>
1265
<i>62.161.78.73 - "Name Surname" Service [dd/mmm/yyyy:hh:mm:ss +0x00] "GET /page.html HTTP/1.1" 200 1234 "http://www.from.com/from.htm" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)"</i><br>
1266
You must use : <i>LogFormat="%host %other %lognamequot %time1 %methodurl %code %bytesd %refererquot %uaquot"</i><br>
1267
</td></tr></table>
1268
1269
<u>If your log records are EXACTLY like this (With <b>Oracle9iAS</b>):</u><br>
1270
<i>62.161.78.73 - [dd/mmm/yyyy:hh:mm:ss +0x00] GET /page.html HTTP/1.1 200 1234 - "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)"</i><br>
1271
Where separators are <tab> chars or several spaces,
1272
You must use : <i>LogFormat="%host %logname %time1 %method %url %other %code %bytesd %referer %uaquot"</i>
1273
and <i>LogSeparator="\s+"</i><br>
1274
1275
<table bgcolor=#F4F4F4 width="100%" class=CFAQ><tr class=CFAQ><td class=CFAQ>
1276
<u>If you use a FTP server like <b>ProFTPd</b>:</u><br>
1277
See <a href="#FTP">FAQ-COM090</a>.<br>
1278
</td></tr></table>
1279
1280
<u>If you want to analyze a mail log file (<b>Postfix</b>, <b>Sendmail</b>, <b>QMail</b>, <b>MDaemon</b>, <b>Exchange</b>):</u><br>
1281
See <a href="#MAIL">FAQ-COM100</a>.<br>
1282
1283
<table bgcolor=#F4F4F4 width="100%" class=CFAQ><tr class=CFAQ><td class=CFAQ>
1284
<u>If you use a Media Server (<b>Realmedia</b>, <b>Windows Media Server</b>):</u><br>
1285
See <a href="#MEDIASERVER">FAQ-COM110</a>.<br>
1286
</td></tr></table>
1287
1288
<u>If your log records are EXACTLY like this (With some providers):</u><br>
1289
<i>62.161.78.73 - - [dd/Month/yyyy:hh:mm:ss +0x00] "GET /page.html HTTP/1.1" "-" 200 1234</i><br>
1290
You must use : <i>LogFormat="%host %other %logname %time1 %methodurl %other %code %bytesd"</i><br>
1291
Note: Browsers, OS's, Keywords and Referers features are not available with a such format.<br>
1292
1293
<table bgcolor=#F4F4F4 width="100%" class=CFAQ><tr class=CFAQ><td class=CFAQ>
1294
<u>There is a lot of other possible log formats.</u><br>
1295
You must use a personalized log format LogFormat ="..." as described in config file to
1296
support other various log formats.<br>
1297
</td></tr></table>
1298
<br>
1299
1300
1301
1407
<a name="CORRUPTEDDROPPED"></a><br>
1302
1408
<b><u>FAQ-SET270 : ONLY CORRUPTED OR DROPPED RECORDS</u></b><br>
1303
1409
<font class=CProblem>PROBLEM:</font><br>
1350
1456
First try to update to last version. Then check in your disk that you have only ONE of those files. They should be
1351
1457
in '<b>lib</b>' directory ('db' with 4.0) where awstats.pl is installed:<br>
1352
1458
<i>browsers.pm</i><br>
1459
<i>browsers_phone.pm</i><br>
1353
1460
<i>domains.pm</i><br>
1354
1461
<i>operating_systems.pm</i><br>
1355
1462
<i>robots.pm</i><br>
1452
1559
<b><u>FAQ-SET400 : PIPE REDIRECTION TO A FILE GIVE ME AN EMPTY FILE</u></b><br>
1453
1560
<font class=CProblem>PROBLEM:</font><br>
1454
1561
I want to redirect awstats.pl output to a file with the following command :<br>
1455
<i>> awstats.pl -config=... [other_options] > myfile.html</i><br>
1562
>awstats.pl -config=... [other_options] > myfile.html<br>
1456
1563
But myfile.html is empty (size is 0). If i remove the redirection, everythings works correctly.<br>
1457
1564
<font class=CSolution>SOLUTION:</font><br>
1458
This is not an AWStats bug but a problem between perl and Windows.<br>
1565
This is not an AWStats bug but a problem between Perl and Windows.<br>
1459
1566
You can easily solve this running the following command instead:<br>
1460
<i>> perl awstats.pl -config=... [other_options] > myfile.html</i><br>
1567
<table border=1 cellpadding=1 cellspacing=0 bgcolor=#F4F4F4 width="95%" class=CFAQ><tr class=CFAQ><td class=CFAQ>
1568
perl awstats.pl -config=... [other_options] > myfile.html
1569
</td></tr></table>
1461
1570
<br>
1462
1571
1463
1572
<a name="NO_ICON"></a><br>
1485
1594
<i>YYYYMM00 999 999 999 999</i><br>
1486
1595
where YYYY and MM are year and month of config file and 999 are numerical values.<br>
1487
1596
<br>
1488
<u>So if your OS is Unix/Linux</u><br>
1597
<b>So if your OS is Unix/Linux</b><br>
1489
1598
<i>
1599
<table border=1 cellpadding=1 cellspacing=0 bgcolor=#F4F4F4 width="95%" class=CFAQ><tr class=CFAQ><td class=CFAQ>
1490
1600
grep -vE '^[0-9]{6}00' oldhistoryfile > newhistoryfile<br>
1491
1601
mv newhistoryfile oldhistoryfile<br>
1602
</td></tr></table>
1492
1603
</i>
1493
1604
And then run the migrate process again on the file.<br>
1494
1605
<br>
1495
<u>If your OS is windows and got cygwin</u><br>
1606
<b>If your OS is windows and got cygwin</b><br>
1496
1607
You must follow same instructions than if OS is Unix/Linux BUT
1497
1608
you must do this from a cygwin 'sh' shell and not from the DOS
1498
1609
prompt (because the ^ is not understanded by DOS).<br>
1499
1610
And then run the migrate process again on the file.<br>
1500
1611
<br>
1501
<u>In any other case (in fact works for every OS)</u><br>
1612
<b>In any other case (in fact works for every OS)</b><br>
1502
1613
You must remove manually the line <i>YYYYMM00 999 999 999 999</i> (must find one and only
1503
1614
one such line) and then run the migrate process again on the file.<br>
1504
1615
<br>
1570
1681
all worms signatures. So if you still have rubish hits, you can modify the worms.pm file yourself or
1571
1682
edit your config file to add in the <a href="awstats_config.html#SkipFiles">SkipFiles</a> parameter some
1572
1683
values to discard the not required records, using a regex syntax like example :<br>
1573
<i>SkipFiles="REGEX[^\/default\.ida] REGEX[\/winnt\/system32\/cmd\.exe]"</i><br>
1684
<table border=1 cellpadding=1 cellspacing=0 bgcolor=#F4F4F4 width="95%" class=CFAQ><tr class=CFAQ><td class=CFAQ>
1685
SkipFiles="REGEX[^\/default\.ida] REGEX[\/winnt\/system32\/cmd\.exe]"<br>
1686
</td></tr></table>
1574
1687
<br>
1575
1688
1576
1689
<hr>
1577
1690
1578
1691
<script language=javascript>
1579
var date='$Date: 2005/02/18 19:39:59 $';
1692
var date='$Date: 2005/11/23 20:36:51 $';
1580
1693
document.writeln("Last revision: "+date);
1581
1694
</script>
1582
1695
Loggerhead is a web-based interface for Breezy
Version: 2.0.1