InternetOfficer.com

AWStats supports the log formats of many different web servers. The log format is defined by the LogFormat and LogSeparator parameters in the AWStats configuration file.

Combined Log Format

The easiest case is the Combined Log Format often used in Apache and other servers. It is defined with:

LogFormat=1

which is a short form for

LogFormat = "%host %other %logname %time1 %methodurl %code %bytesd %refererquot %uaquot"

W3C Extended log file format

There was another short form for the W3C Extended log file format used in IIS and other web servers:

LogFormat=2

We do not recommend this short form as there are many cases where it does not work.

Other log formats

Other log formats should preferably be defined using the AWStats format codes, although some IIS and Apache codes are supported. This is the complete list of AWStats format codes for web servers (AWStats release 6.7).

Date and time

AWStats	Description
%time1	[dd/mon/yyyy:hh:mm:ss +0000] = %t (Apache format)
%time1	[dd/mon/yyyy:hh:mm:ss]
%time2	yyyy-mm-dd hh:mm:ss = date time (IIS format)
%time3	Mon dd hh:mm:ss
%time3	Mon dd hh:mm:ss yyyy
%time4	Unix timestamp

Method and URL

AWStats	Description
%methodurl	“GET /index.html HTTP/x.x” = \”%r\” (Apache format)
%methodurlnoprot	“GET /index.html”
%method	GET = cs-method (IIS format) = s-operation (IIS format)
%url	/index.html = cs-uri-stem (IIS format)
%query	Query string (used by URLWithQuery option) = cs-uri-query (IIS format)

Visitor address and identification

AWStats	Description
%host	Client hostname or IP address = %h (Apache format) = c-ip (IIS format)
%logname	login name = %u (Apache format) = cs-user-name (IIS format)
%lognamequot	“login name” = \”%u\” (Apache format)

Mandatory technical data

AWStats	Description
%code	HTTP Status Code (200, 404, 301, 302,…) = %>s (Apache format) = sc-status (IIS format)
%bytesd	Number of data bytes sent by server (headers not included) = %b (Apache format) = sc-bytes (IIS format)

Referrer

AWStats	Description
%refererquot	“http://www.example.com/from_this_page.html” = \”%{Referer}i\” (Apache format)
%referer	http://www.example.com/from_this_page.html = cs(Referer) (IIS format)

User Agent

AWStats	Description
%uabracket	[Mozilla/4.0 (compatible; MSIE 6.0; NT 5.0)]
%uaquot	“Mozilla/4.0 (compatible; MSIE 6.0; NT 5.0)” = \”%{User-agent}i\” (Apache format)
%ua	Mozilla/4.0+(compatible;+MSIE+6.0;+NT+5.0) = cs(User-Agent) (IIS format)

Virtual Servers and Clusters

AWStats	Description
%virtualname	virtual.host.name = %v (Apache format) = r-host (IIS format) = cs-host (IIS format)
%virtualnamequot	“virtual.host.name”
%cluster	Cluster ID field (for use with logresolvemerge.pl) = cluster-node (IIS format)

Compression

AWStats	Description
%gzipin	mod_gzip compression input bytes (In:***) = %{mod_gzip_input_size}n (Apache format)
%gzipout	mod_gzip compression output bytes & ratio (Out:***:**pct.) %{mod_gzip_output_size}n (Apache format)
%gzipratio	mod_gzip compression ratio (**pct.)
%deflateratio	mod_deflate compression ratio (**) = (%{ratio}n) (Apache format)

Miscellaneous

AWStats	Description
%extra1	User defined field for use in extra sections
%extra2	User defined field for use in extra sections
%extra3	User defined field for use in extra sections
%extra…	User defined field for use in extra sections
%other	A not used field
%otherquot	“A not used field”

About LogSeparator

In most cases, there is no need to modify the default value of LogSeparator:
LogSeparator=" "

When multiple spaces or tabs are used between fields in the log file, use:
LogSeparator="\s+"

Examples

Here are a few examples using AWStats format codes.

Example 1

First a typical line from a Sun iPlanet log file:
2007-05-31 18:19:33 216.104.143.32 GET /some-page/ 200 35384 1 "http://www.example.com/nice_page.htm" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; FunWebProducts; .NET CLR 1.1.4322; .NET CLR 2.0.50727)" "-"

Log format definition:
LogFormat = "%time2 %host %method %url %code %bytesd %other %refererquot %uaquot %otherquot"

Example 2

This line comes form a Microsoft IIS log file:
2007-01-20 00:00:51 65.54.188.60 - W3SVC121 WEB25 64.135.167.51 80 GET /page3.php city=bru 200 10768 242 www.this_domain.com msnbot/1.0+(+http://search.msn.com/msnbot.htm) http://www.example.com/cgi-bin/hello.pl

Log format definition:
LogFormat="%time2 %host %other %other %other %other %other %method %url %query %code %bytesd %other %other %ua %referer"

Example 3

This is another flavor of Microsoft IIS log files:
2007-03-11 02:03:14 GET /page2.php direction=north - 65.54.188.60 - msnbot/1.0+(+http://search.msn.com/msnbot.htm) http://www.example.com/ 200 7438

Log format definition:
LogFormat = "%time2 %method %url %query %logname %host %other %ua %referer %code %bytesd"

Need more help ?

If, in spite of your efforts, your AWStats setup is still not able to process your log file, post a message in our AWStats forum. If you prefer that we log in your system and correct the setup or that we do a complete AWStats installation, please post your requirements in our “AWStats Installation Assistance” form.