[thelist] more fun with AWStats and Apache logs

John DeStefano john.destefano at gmail.com
Fri Jun 13 08:18:08 CDT 2008


Eduardo Kienetz wrote:
> Check for extra LogFormat's later on in your file which might be
> overriding the default one (which I sent), which is the right one to
> use.
> Also, make sure there are no extra CustomLog turning back to common
> instead of Combined.

Here's my entire Apache log section as it stands now; no other  
LogFormat definitions:
LogLevel debug
#warn
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i 
\"" combined
#LogFormat "%h %l %u %t \"%r\" %>s %b" common
# LogFormat "%h %l %u %t \"%r\" %s %b" common
# LogFormat "%{Referer}i -> %U" referer
# LogFormat "%{User-agent}i" agent
# CustomLog /home/sm/monitor/httpd/logs/access_log common
CustomLog /home/sm/monitor/httpd/logs/access_log combined
# ErrorLog /home/sm/monitor/httpd/logs/error_log

And here is the log section from awstats.mysite.conf:
# Examples for Apache combined logs (following two examples are  
equivalent):
# LogFormat = 1
# LogFormat = "%host %other %logname %time1 %methodurl %code %bytesd  
%refererquot %uaquot"
#
# Example for IIS:
# LogFormat = 2
#
LogFormat=1
#LogFormat=4
#LogFormat = "%host %other %logname %time1 %methodurl %code %bytesd"
#LogFormat = "%host %other %logname %time1 %methodurlnoprot %code  
%bytesd"

And here are the results:
# perl /var/www/awstats/awstats.pl -config=mysite -update -showcorrupted
...
Corrupted record line 10 (record format does not match LogFormat  
parameter): somehost.domain.com - - [13/Jun/2008:09:12:03 -0400]  
"GET /" 200 20019 "-" "-"
... etc.

>
> Take a look at:
> http://awstats.sourceforge.net/docs/awstats_faq.html#PERSONALIZEDLOG

I have, many, many times now. :/  None of these match this format,  
since it seems a protocol code is output within the request record,  
for any request to any page *but* the site root, and not for the site  
root itself:
  ... "GET /" 200 ...
  ... "GET /some/site/path HTTP/1.0" 200

How the heck do you match such a pattern?

Thanks,
~John



More information about the thelist mailing list