AWStats LogFormat Explained
AWStats supports the log formats of many different web servers. The log format is defined by the LogFormat and LogSeparator parameters in the AWStats configuration file.
Combined Log Format
The easiest case is the Combined Log Format often used in Apache and other servers. It is defined with:
LogFormat=1
which is a short form for
LogFormat = "%host %other %logname %time1 %methodurl %code %bytesd %refererquot %uaquot"
W3C Extended log file format
There was another short form for the W3C Extended log file format used in IIS and other web servers:
LogFormat=2
We do not recommend this short form as there are many cases where it does not work.
Other log formats
Other log formats should preferably be defined using the AWStats format codes, although some IIS and Apache codes are supported. This is the complete list of AWStats format codes for web servers (AWStats release 6.7).
Date and time
AWStats Description %time1
[dd/mon/yyyy:hh:mm:ss +0000]
= %t (Apache format)%time1 [dd/mon/yyyy:hh:mm:ss] %time2
yyyy-mm-dd hh:mm:ss
= date time (IIS format)%time3 Mon dd hh:mm:ss %time3 Mon dd hh:mm:ss yyyy %time4 Unix timestamp
Method and URL
AWStats Description %methodurl
“GET /index.html HTTP/x.x”
= \”%r\” (Apache format)%methodurlnoprot “GET /index.html” %method
GET
= cs-method (IIS format)
= s-operation (IIS format)%url
/index.html
= cs-uri-stem (IIS format)%query
Query string (used by URLWithQuery option)
= cs-uri-query (IIS format)
Visitor address and identification
AWStats Description %host
Client hostname or IP address
= %h (Apache format)
= c-ip (IIS format)%logname
login name
= %u (Apache format)
= cs-user-name (IIS format)%lognamequot
“login name”
= \”%u\” (Apache format)
Mandatory technical data
AWStats Description %code
HTTP Status Code (200, 404, 301, 302,…)
= %>s (Apache format)
= sc-status (IIS format)%bytesd
Number of data bytes sent by server (headers not included)
= %b (Apache format)
= sc-bytes (IIS format)
Referrer
AWStats Description %refererquot
“http://www.example.com/from_this_page.html”
= \”%{Referer}i\” (Apache format)%referer
http://www.example.com/from_this_page.html
= cs(Referer) (IIS format)
User Agent
AWStats Description %uabracket [Mozilla/4.0 (compatible; MSIE 6.0; NT 5.0)] %uaquot
“Mozilla/4.0 (compatible; MSIE 6.0; NT 5.0)”
= \”%{User-agent}i\” (Apache format)%ua
Mozilla/4.0+(compatible;+MSIE+6.0;+NT+5.0)
= cs(User-Agent) (IIS format)
Virtual Servers and Clusters
AWStats Description %virtualname
virtual.host.name
= %v (Apache format)
= r-host (IIS format)
= cs-host (IIS format)%virtualnamequot “virtual.host.name” %cluster
Cluster ID field (for use with logresolvemerge.pl)
= cluster-node (IIS format)
Compression
AWStats Description %gzipin
mod_gzip compression input bytes (In:***)
= %{mod_gzip_input_size}n (Apache format)%gzipout
mod_gzip compression output bytes & ratio (Out:***:**pct.)
%{mod_gzip_output_size}n (Apache format)%gzipratio mod_gzip compression ratio (**pct.) %deflateratio
mod_deflate compression ratio (**)
= (%{ratio}n) (Apache format)
Miscellaneous
AWStats Description %extra1 User defined field for use in extra sections %extra2 User defined field for use in extra sections %extra3 User defined field for use in extra sections %extra… User defined field for use in extra sections %other A not used field %otherquot “A not used field”
About LogSeparator
In most cases, there is no need to modify the default value of LogSeparator:
LogSeparator=" "
When multiple spaces or tabs are used between fields in the log file, use:
LogSeparator="\s+"
Examples
Here are a few examples using AWStats format codes.
Example 1
First a typical line from a Sun iPlanet log file:
2007-05-31 18:19:33 216.104.143.32 GET /some-page/ 200 35384 1 "http://www.example.com/nice_page.htm" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; FunWebProducts; .NET CLR 1.1.4322; .NET CLR 2.0.50727)" "-"
Log format definition:
LogFormat = "%time2 %host %method %url %code %bytesd %other %refererquot %uaquot %otherquot"
Example 2
This line comes form a Microsoft IIS log file:
2007-01-20 00:00:51 65.54.188.60 - W3SVC121 WEB25 64.135.167.51 80 GET /page3.php city=bru 200 10768 242 www.this_domain.com msnbot/1.0+(+http://search.msn.com/msnbot.htm) http://www.example.com/cgi-bin/hello.pl
Log format definition:
LogFormat="%time2 %host %other %other %other %other %other %method %url %query %code %bytesd %other %other %ua %referer"
Example 3
This is another flavor of Microsoft IIS log files:
2007-03-11 02:03:14 GET /page2.php direction=north - 65.54.188.60 - msnbot/1.0+(+http://search.msn.com/msnbot.htm) http://www.example.com/ 200 7438
Log format definition:
LogFormat = "%time2 %method %url %query %logname %host %other %ua %referer %code %bytesd"
Need more help ?
If, in spite of your efforts, your AWStats setup is still not able to process your log file, post a message in our AWStats forum. If you prefer that we log in your system and correct the setup or that we do a complete AWStats installation, please post your requirements in our “AWStats Installation Assistance” form.
December 15th, 2008 at 3:40 pm
I’m in need of exact defintions that were used in AWstats, any has a list of them?
Question moved to our AWStats Miscellaneous forum: exact definitions.
June 4th, 2010 at 4:19 pm
Great article, many thanks