AWStats LogFormat Explained


AWStats supports the log formats of many different web servers. The log format is defined by the LogFormat and LogSeparator parameters in the AWStats configuration file.

Combined Log Format

The easiest case is the Combined Log Format often used in Apache and other servers. It is defined with:

LogFormat=1

which is a short form for

LogFormat = "%host %other %logname %time1 %methodurl %code %bytesd %refererquot %uaquot"

W3C Extended log file format

There was another short form for the W3C Extended log file format used in IIS and other web servers:

LogFormat=2

We do not recommend this short form as there are many cases where it does not work.

Other log formats

Other log formats should preferably be defined using the AWStats format codes, although some IIS and Apache codes are supported. This is the complete list of AWStats format codes for web servers (AWStats release 6.7).

Date and time

AWStats Description
%time1
 
[dd/mon/yyyy:hh:mm:ss +0000]
= %t (Apache format)
%time1 [dd/mon/yyyy:hh:mm:ss]
%time2
 
yyyy-mm-dd hh:mm:ss
= date time (IIS format)
%time3 Mon dd hh:mm:ss
%time3 Mon dd hh:mm:ss yyyy
%time4 Unix timestamp

Method and URL

AWStats Description
%methodurl
 
“GET /index.html HTTP/x.x”
= \”%r\” (Apache format)
%methodurlnoprot “GET /index.html”
%method
 
 
GET
= cs-method (IIS format)
= s-operation (IIS format)
%url
 
/index.html
= cs-uri-stem (IIS format)
%query
 
Query string (used by URLWithQuery option)
= cs-uri-query (IIS format)

Visitor address and identification

AWStats Description
%host
 
 
Client hostname or IP address
= %h (Apache format)
= c-ip (IIS format)
%logname
 
 
login name
= %u (Apache format)
= cs-user-name (IIS format)
%lognamequot
 
“login name”
= \”%u\” (Apache format)

Mandatory technical data

AWStats Description
%code
 
 
HTTP Status Code (200, 404, 301, 302,…)
= %>s (Apache format)
= sc-status (IIS format)
%bytesd
 
 
 
Number of data bytes sent by server (headers not included)
= %b (Apache format)
= sc-bytes (IIS format)

Referrer

AWStats Description
%refererquot
 
“http://www.example.com/from_this_page.html”
= \”%{Referer}i\” (Apache format)
%referer
 
http://www.example.com/from_this_page.html
= cs(Referer) (IIS format)

User Agent

AWStats Description
%uabracket [Mozilla/4.0 (compatible; MSIE 6.0; NT 5.0)]
%uaquot
 
“Mozilla/4.0 (compatible; MSIE 6.0; NT 5.0)”
= \”%{User-agent}i\” (Apache format)
%ua
 
Mozilla/4.0+(compatible;+MSIE+6.0;+NT+5.0)
= cs(User-Agent) (IIS format)

Virtual Servers and Clusters

AWStats Description
%virtualname
 
 
 
virtual.host.name
= %v (Apache format)
= r-host (IIS format)
= cs-host (IIS format)
%virtualnamequot “virtual.host.name”
%cluster
 
 
Cluster ID field (for use with logresolvemerge.pl)
= cluster-node (IIS format)

Compression

AWStats Description
%gzipin
 
mod_gzip compression input bytes (In:***)
= %{mod_gzip_input_size}n (Apache format)
%gzipout
 
mod_gzip compression output bytes & ratio (Out:***:**pct.)
%{mod_gzip_output_size}n (Apache format)
%gzipratio mod_gzip compression ratio (**pct.)
%deflateratio
 
mod_deflate compression ratio (**)
= (%{ratio}n) (Apache format)

Miscellaneous

AWStats Description
%extra1 User defined field for use in extra sections
%extra2 User defined field for use in extra sections
%extra3 User defined field for use in extra sections
%extra… User defined field for use in extra sections
%other A not used field
%otherquot “A not used field”

About LogSeparator

In most cases, there is no need to modify the default value of LogSeparator:
LogSeparator=" "

When multiple spaces or tabs are used between fields in the log file, use:
LogSeparator="\s+"

Examples

Here are a few examples using AWStats format codes.

Example 1

First a typical line from a Sun iPlanet log file:
2007-05-31 18:19:33 216.104.143.32 GET /some-page/ 200 35384 1 "http://www.example.com/nice_page.htm" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; FunWebProducts; .NET CLR 1.1.4322; .NET CLR 2.0.50727)" "-"

Log format definition:
LogFormat = "%time2 %host %method %url %code %bytesd %other %refererquot %uaquot %otherquot"

Example 2

This line comes form a Microsoft IIS log file:
2007-01-20 00:00:51 65.54.188.60 - W3SVC121 WEB25 64.135.167.51 80 GET /page3.php city=bru 200 10768 242 www.this_domain.com msnbot/1.0+(+http://search.msn.com/msnbot.htm) http://www.example.com/cgi-bin/hello.pl

Log format definition:
LogFormat="%time2 %host %other %other %other %other %other %method %url %query %code %bytesd %other %other %ua %referer"

Example 3

This is another flavor of Microsoft IIS log files:
2007-03-11 02:03:14 GET /page2.php direction=north - 65.54.188.60 - msnbot/1.0+(+http://search.msn.com/msnbot.htm) http://www.example.com/ 200 7438

Log format definition:
LogFormat = "%time2 %method %url %query %logname %host %other %ua %referer %code %bytesd"

Need more help ?

If, in spite of your efforts, your AWStats setup is still not able to process your log file, post a message in our AWStats forum. If you prefer that we log in your system and correct the setup or that we do a complete AWStats installation, please post your requirements in our “AWStats Installation Assistance” form.

2 Responses to “AWStats LogFormat Explained”

  1. Alice says:

    I’m in need of exact defintions that were used in AWstats, any has a list of them?

    Question moved to our AWStats Miscellaneous forum: exact definitions.

  2. anis says:

    Great article, many thanks


 

Leave a Reply

You must be logged in to post a comment.