Current User: Guest Login Register
Please consider registering


Register? | Lost Your Password?

Search Forums:


 






Minimum search word length is 3 characters – Maximum search word length is 84 characters
Wildcard Usage:
*  matches any number of characters    %  matches exactly one character

Home Forum AWStats & Apache, Installation and Configuration IIS Log format

IIS Log format
Print this Post
Page:   1   Reply to Post Add a New Topic
UserPost

9:24 am
September 22, 2010


ahtshun83

Member

posts 17
  Quote and Reply
  Report Post
Print this Post
1

Hi all,

 

I installed AWStats on CentOs 5.0. It uses to analyse Apache Logs &  Window IIS 6.0 Logs.

 

Only apache on CentOs 5.0 is working properly.

When i tried to analyse  the IIS Log,it throw out error message

Error: Your personalized LogFormat does not include all fields required by AWStats (Add %bytesd in your LogFormat string).
Setup ('/etc/awstats/awstats.kaplan.com.sg.conf' file, web server or permissions) may be wrong.
Check config file, permissions and AWStats documentation (in 'docs' directory).

This is the log format from the IIS

#Fields: date time s-sitename s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) sc-status sc-substatus sc-win32-status
2010-09-22 03:15:35 W3SVC1009109427 192.168.10.20 GET /Library/images/img-visual6.jpg – 80 – 202.172.53.86 Mozilla/4.0+(compatible;+MSIE+8.0;+Windows+NT+5.1;+Trident/4.0;+.NET+CLR+1.1.4322;+.NET+CLR+ 2.0.50727;+.NET+CLR+3.0.04506.648;+.NET+CLR+3.5.21022;+.NET+CLR+3.0.4506.2152;+
.NET+CLR+3.5.30729) 200 0 0

I did change the LogFormat=2 inside the .conf file but it didnt work

 

Anyone can assist me?Urgent..Thank you.

10:49 am
September 22, 2010


Jean-Luc

Admin

posts 1063
  Quote and Reply
  Report Post
Print this Post
2

Hello,

As indicated in the error message, there is no %bytesd field in your log format. The %bytesd  field (called sc-bytes  by IIS) is mandatory.

 

Here is what you can do with existing log files: : you can fool AWStats by calling %bytesd  one of the unused fields at the end of the line. You can try this:

LogFormat="%time2 %other %other %method %url %query %other %logname %host %ua %code %other %bytesd"

You will get valid AWStats reports, but for the "bandwidth" and "number of data bytes" that will not show significant values.

9:47 am
September 23, 2010


ahtshun83

Member

posts 17
  Quote and Reply
  Report Post
Print this Post
3

Hi Jean,

 

Thank you for your reply and i managed to extract the data in a correct format.

I am using the following and it is working well.

LogFormat ="date time s-sitename s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) sc-status sc-substatus sc-bytes"

 

However i got another issue which i need your assistance.

My IIS is generating log daily and the log filename is based on the date itself

for example: ex100922.log ,ex100923.log and etc

 

How to read the log automatically instead of changing the filename manually daily inside the .conf

LogFile="/mnt/kaplanweb_logs/W3SVC1009109427/ex100923.log"

 

Second issue is that the first/last visit time is not correct for IIS…anyway to solve?

Thanks in advanced.

5:29 pm
September 23, 2010


Jean-Luc

Admin

posts 1063
  Quote and Reply
  Report Post
Print this Post
4

Hi,

When the local date of the server is September 23, 2010,

LogFile="/mnt/kaplanweb_logs/W3SVC1009109427/ex%YY%MM%DD.log"

will be converted in ex100923 and

LogFile="/mnt/kaplanweb_logs/W3SVC1009109427/ex%YY-24%MM-24%DD-24.log"

will be converted in ex100922.

This answers your first question.

I did not understand your second one about the "first/last visit time".

10:29 am
September 24, 2010


ahtshun83

Member

posts 17
  Quote and Reply
  Report Post
Print this Post
5

Dear Jean,

 

is there any difference between using ex%YY%MM%DD and ex%YY-24%MM-24%DD-24? Please advise.

 

As for my 2nd question,i am referring to the screenshot below.

When i view my statistics via web, there is a columm as per below. It show the first/last visit time stamp.However mine didnt show correctly.

This is the IIS 6.0 log for Windows. I put a tick on IIS Log (use local server time but it didnt help)

Please assist.

 

Thank you

 

Summary  
Reported period Month Sep 2010
First visit NA
Last visit 24 Sep 2010 – 08:29

11:04 am
September 24, 2010


Jean-Luc

Admin

posts 1063
  Quote and Reply
  Report Post
Print this Post
6

I thought my previous answer showed the difference between ex%YY%MM%DD and ex%YY-24%MM-24%DD-24.Wink

"-24" means "now minus 24 hours", "-37" would mean "now minus 37 hours", if there is no "- something", than the datestamp for today ("now") is used.

 

I have never seen this "First visit: not available" message. It is weird, it looks like an AWStats bug.

11:37 am
September 24, 2010


ahtshun83

Member

posts 17
  Quote and Reply
  Report Post
Print this Post
7

Dear jean

 

It is not a message. This first visit and last visit is under the Summary columms.

 

I did a search about timezone plugins….+8

 

i also did a check on my IIS Log…the time format in GMT format  HK Time

 

Please help

11:50 am
September 24, 2010


Jean-Luc

Admin

posts 1063
  Quote and Reply
  Report Post
Print this Post
8

You are right: it is not a "message", but I understood what you mean with the Summary at the top.

 

If it is a bug in AWStats, you have to report it in the AWStats Bugs Trackers. I don't see this "First visit: not available" as an important issue though.

11:58 am
September 24, 2010


ahtshun83

Member

posts 17
  Quote and Reply
  Report Post
Print this Post
9

Alright.

 

However the last visit time isnt correct.

 

i also monitor linux web server log.. here is the screenshot and it is correct

Reported period Month Sep 2010
First visit 01 Sep 2010 – 00:00
Last visit 24 Sep 2010 – 18:29

 

But IIS log,it shows as below

Reported period Month Sep 2010
First visit NA
Last visit 24 Sep 2010 – 10:29

 

How to solve it?

12:46 pm
September 24, 2010


Jean-Luc

Admin

posts 1063
  Quote and Reply
  Report Post
Print this Post
10

I guess that your IIS logs are showing GMT time while the Linux system is showing the Hong Kong local time. This can explain the 8 hours difference. It is not really an error, but a different way to present the data.

The timezone plugin does not change the data which are already in the AWStats database, as it recalculates all dates and times when running the AWStats updates.

8:12 am
September 27, 2010


ahtshun83

Member

posts 17
  Quote and Reply
  Report Post
Print this Post
11

Hi Jean,

 

so is there a way to resolve it?i need the time to show correctly.

 

can i delete away the awstats database for the IIS log,enable the plugin and then rerun the awstats update again?

 

please assist.

8:19 am
September 27, 2010


Jean-Luc

Admin

posts 1063
  Quote and Reply
  Report Post
Print this Post
12

Hi,

You can do that, but I would first move the existing AWStats database to another directory (just in case). Then you enable the plugin and rerun the stats updates from the beginning and you will get the stats based on the time zone of your choice.

8:58 am
September 27, 2010


ahtshun83

Member

posts 17
  Quote and Reply
  Report Post
Print this Post
13

Hi Jean,

 

quick question..once i enabled the timezone plugins, how should place the value ….timezone + 8 ?

 

where is the awstats database for a site? /var/www/html/awstats/xx.txt?

9:19 am
September 27, 2010


Jean-Luc

Admin

posts 1063
  Quote and Reply
  Report Post
Print this Post
14

LoadPlugin="timezone +8"

can be added anywhere in the AWStats config file. This will enable the plugin for the following stats updates.

 

The AWStats database files are in the DirData  directory defined in the AWStats config file.

9:45 am
September 27, 2010


ahtshun83

Member

posts 17
  Quote and Reply
  Report Post
Print this Post
15

Hi Jean,

 

Finally….it is working perfectly well….

 

Thank you very much for your assistance..
Page:   1   Reply to Post

Reply to Topic:
IIS Log format

Guest Name (Required):

Guest Email (Required):

NOTE: New Posts are subject to administrator approval before being displayed

Smileys
Confused Cool Cry Embarassed Frown Kiss Laugh Smile Surprised Wink Yell
Post New Reply

Guest URL (required)

Math Required!
What is the sum of:
11 + 1    

Topic RSS

About the InternetOfficer.com Forum

Forum Timezone: UTC 1

Most Users Ever Online: 201

Currently Online:
17 Guests

Currently Browsing this Topic:
1 Guest

Forum Stats:

Groups: 2
Forums: 9
Topics: 513
Posts: 2447

Membership:

There are 4127 Members
There have been 254 Guests

There is 1 Admin
There is 1 Moderator

Top Posters:

cssfsu – 55
albert_newton – 30
deepakgupta – 28
cosminpana – 20
DTNMike – 19
ahtshun83 – 17

Recent New Members: eniko, leptserkhan, JohnnyB, dweb3d, buck, newtoawstat

Administrators: Jean-Luc (1063 Posts)

Moderators: Jean-Luc (1063 Posts)