Gecko [ www.thearyasamaj.org ]

Name	Size	Permission
images	[ DIR ]	drwxr-xr-x
scripts	[ DIR ]	drwxr-xr-x
COPYING.TXT	34.32 KB	-rw-r--r--
LICENSE.TXT	34.32 KB	-rw-r--r--
README.md	6.87 KB	-rw-r--r--
awstats.pdf	325.44 KB	-rw-r--r--
awstats_benchmark.html	13.75 KB	-rw-r--r--
awstats_changelog.txt	56.92 KB	-rw-r--r--
awstats_compare.html	32.49 KB	-rw-r--r--
awstats_config.html	77.15 KB	-rw-r--r--
awstats_contrib.html	28.59 KB	-rw-r--r--
awstats_dev_plugins.html	10.42 KB	-rw-r--r--
awstats_dev_plugins_graphs.htm...	8.89 KB	-rw-r--r--
awstats_dev_plugins_hooks.html	20.72 KB	-rw-r--r--
awstats_dolibarr.html	3.81 KB	-rw-r--r--
awstats_extra.html	19.09 KB	-rw-r--r--
awstats_faq.html	108.56 KB	-rw-r--r--
awstats_glossary.html	39.38 KB	-rw-r--r--
awstats_license.html	3.19 KB	-rw-r--r--
awstats_security.html	9.9 KB	-rw-r--r--
awstats_setup.html	26.08 KB	-rw-r--r--
awstats_tools.html	15.64 KB	-rw-r--r--
awstats_upgrade.html	7.03 KB	-rw-r--r--
awstats_webmin.html	5.02 KB	-rw-r--r--
awstats_what.html	11.71 KB	-rw-r--r--
index.html	5.76 KB	-rw-r--r--
pad_awstats.xml	10.25 KB	-rw-r--r--
styles.css	1.19 KB	-rw-r--r--

Code Editor : awstats_faq.html

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<html>
<head>
<meta name="description" content="AWStats Documentation - FAQ page">
<meta name="keywords" content="awstats, awstat, faq, error, errors, frequently, asked, questions, support, help, problem, solution, troubleshooting, rotate log">
<meta name="robots" content="index,follow">
<meta name="title" content="AWStats Documentation - FAQs">
<meta name="viewport" content="width=device-width, initial-scale=1.0"/>
<title>AWStats Documentation - FAQs</title>
<link rel="stylesheet" href="styles.css" type="text/css">
<link href="https://plus.google.com/+LaurentDestailleur-Open-Source-Expert" rel="publisher" />
</head>

<tr style="font: 10pt arial,helvetica,verdana">
<td bgcolor=#9999cc align=center><a href="/"><img src="images/awstats_logo6.png" border=0></a></td>
<td bgcolor=#9999cc align=center>
 
AWStats logfile analyzer 7.8 Documentation 
 
</td>
<td bgcolor=#9999cc align=center>
&nbsp;
</td>
</tr>

</table>

<H1 style="font: 26px arial,helvetica,sans-serif">Frequently Asked Questions + Troubleshooting</H1>

ABOUT QUESTIONS: 
<ul>
FAQ-ABO100 <a href="#SERVERSOS">Which server log files or operating systems are supported ?</a> 
FAQ-ABO150 <a href="#LOGFORMAT">Which log format can AWStats analyze ?</a> 
FAQ-ABO200 <a href="#LANG">Which languages are available ? How to add my own language ?</a> 
FAQ-ABO250 <a href="#PHPNUKE">Can AWStats be integrated with PHP Nuke ?</a> 
FAQ-ABO300 <a href="#ABOUTHISTORY">About AWStats history</a> 
</ul>

COMMON SETUP/USAGE QUESTIONS: 
Here, you can find the most common questions and answers about AWStats setup/usage process. 
<ul>
FAQ-COM025 <a href="#NOLOG">How to use AWStats with no server log</a> 
FAQ-COM050 <a href="#LIMITLOG">What is the log size limit AWStats can analyze ?</a> 
FAQ-COM090 <a href="#FTP">Setup for FTP server log files (proftpd, vsftpd, ...).</a> 
FAQ-COM100 <a href="#MAIL">Setup for MAIL log files (Postfix, Sendmail, QMail, MDaemon, Exchange).</a> 
FAQ-COM110 <a href="#MEDIASERVER">Setup for MEDIA SERVER log files (Realmedia, Windows media, Darwin streaming server).</a> 
FAQ-COM115 <a href="#PERSONALIZEDLOG">Setup/Examples for LogFormat parameter.</a> 
FAQ-COM120 <a href="#ROTATE">How to rotate my logs without losing data.</a> 
FAQ-COM130 <a href="#CRONTAB">How to run AWStats frequently ?</a> 
FAQ-COM140 <a href="#EXCLUDEHOSTS">How to exclude my IP address (or whole subnet mask) from stats ?</a> 
FAQ-COM142 <a href="#SCREENSIZE">How to get the screen size and browser capabilities report working ?</a> 
FAQ-COM145 <a href="#EXTRA">How to use the Extra Sections features ?</a> 
FAQ-COM150 <a href="#BENCHMARK">Benchmark question.</a> 
FAQ-COM200 <a href="#DNS">How reverse DNS Lookup works, unresolved IP Addresses ?</a> 
FAQ-COM250 <a href="#DIFFERENT_RESULTS">Different results than other log analyzers (Analog, Webalizer, WUsage, wwwStats...).</a> 
FAQ-COM300 <a href="#DIFFERENCE_HOURS">Difference between local hour and AWStats reported hour.</a> 
FAQ-COM320 <a href="#GEOIPEU">What does mean "eu (European country)" in GeoIP country reports.</a> 
FAQ-COM350 <a href="#OLDLOG">How can I process old log file ?</a> 
FAQ-COM360 <a href="#MULTILOG">How can I process several log files in one run ?</a> 
FAQ-COM400 <a href="#LOADLOG">How can I update my statistics when I use a load balancing system that splits my logs ?</a> 
FAQ-COM500 <a href="#RESET">How can I reset all my statistics ?</a> 
FAQ-COM600 <a href="#DAILY">How can I compile and build statistics on a daily basis only ?</a> 
FAQ-COM700 <a href="#EDITHISTORY">Can I safely remove a line in AWStats history files (awstatsMMYYYY*.txt) ?</a> 
</ul>

ERRORS/TROUBLESHOOTING QUESTIONS: 
Here, you can find the most common questions and answers about errors or problems using AWStats. 
<ul>
FAQ-SET050 <a href="#MISSINGDOLLAR">Error "Missing $ on loop variable ..."</a> 
FAQ-SET100 <a href="#CGISOURCE">I see Perl script's source instead of its execution in my browser.</a> 
FAQ-SET150 <a href="#SPAWNERROR">Error "...couldn't create/spawn child process..." with Apache for windows.</a> 
FAQ-SET200 <a href="#INTERNAL">"Internal Error" or "Error 500" in a browser connecting to Apache.</a> 
FAQ-SET210 <a href="#SPEED">"Internal Error" after a long time in my browser (See FAQ-COM100 "AWStats speed/timeout problems").</a> 
FAQ-SET220 <a href="#CRASH">Crash while running awstats.pl or page content only partialy loaded</a> 
FAQ-SET270 <a href="#CORRUPTEDDROPPED">Only corrupted/dropped records</a> 
FAQ-SET280 <a href="#NOTSAMENUMBER">Error "Not same number of records of...".</a> 
FAQ-SET300 <a href="#COULDNOTOPEN">Error "Couldn't open file ..."</a> 
FAQ-SET320 <a href="#MALFORMEDUTF8">Error "Malformed UTF-8 character (unexpected..."</a> 
FAQ-SET350 <a href="#EMPTY_STATS">Empty or null statistics reported.</a> 
FAQ-SET360 <a href="#PARTIAL_STATS">Statistics reported except for os, browsers, robots and keywords/keyphrases.</a> 
FAQ-SET400 <a href="#REDIRECT">Pipe redirection to a file give me an empty file.</a> 
FAQ-SET450 <a href="#NO_ICON">No pictures/graphics shown.</a> 
FAQ-SET700 <a href="#MIGRATEDOUBLED">My visits are doubled for old month I migrated from 3.2 to 5.x</a> 
FAQ-SET750 <a href="#OUTOFMEMORYCYGWIN">AWStats run out of memory during update process with cygwin Perl.</a> 
FAQ-SET800 <a href="#SPEED">AWStats speed/timeout problems.</a> 
</ul>

SECURITY QUESTIONS: 
Here, you can find the common questions about security problems when setting or using AWStats. 
<ul>
FAQ-SEC100 <a href="#CSSATTACK">Can AWStats be used to make Cross Site Scripting Attacks ?</a> 
FAQ-SEC150 <a href="#SECUSER">How can I prevent some users to see statistics of other users ?</a> 
FAQ-SEC200 <a href="#WORMS">How to manage log files (and statistics) corrupted by worms attacks like 'Code Red Virus like'.</a> 
</ul>

<hr>

<a name="SERVERSOS"></a> 
FAQ-ABO100 : WHICH SERVER LOG FILES OR OS ARE SUPPORTED ? 
AWStats can works with : 
<li> All web server able to write log file with a combined log format (XLF/ELF) like Apache,
a common log format (CLF) like Apache or Squid, a W3C log format like IIS 5.0 or higher,
or any other log format that contains all information AWStats expect to find. 
<li> Most of all others Web/Wap/Proxy/Streaming servers. 
<li> Some FTP, Syslog or Mail log files. 
Because AWStats is in Perl, it can works on all Operating Systems. 
 
Examples of used platforms (bold means 'tested by author', others were reported by AWStats users to work correctly) : 
<table width="95%" border=1 cellpadding=0 cellspacing=0 bgcolor=#F4F4F4 class=CFAQ><tr class=CFAQ><td class=CFAQ>
OS: 
Windows 2000, Windows NT 4.0, Windows Me, Linux (RedHat, Mandrake, Debian, Suse...), Macintosh, Solaris, Aix, BeOS, FreeBSD, ... 
Web/Wap/Proxy/Streaming servers 
Apache 1.3.x and 2.x, IIS 5.0 or higher, ISA, WebStar, WebLogic, WebSite, Windows Media Server, Tomcat, Squid,
Sambar, Roxen, Resin, RealMedia server, Oracle9iAS, Lotus Notes/Domino, Darwin, IPlanet, IceCast, ZeroBrand, Zeus, Zope, Abyss... 
FTP servers 
ProFTPd, vsFTPd... 
Mails servers 
Postfix, Sendmail, QMail, Mdaemon, www4mail, ... 
Perl interpreters (all Perl >= 5.005): 
ActivePerl 5.6, ActivePerl 5.8, Perl 5.8, Perl 5.6, Perl 5.005, mod_perl and mod_perl2 for Apache, ... 
</td></tr></table>

<a name="LOGFORMAT"></a> 
FAQ-ABO150 : WHICH LOG FORMATS CAN AWSTATS ANALYZE ? 
AWStats setup knows predefined log formats you can use to make AWStats config easier. However,
you can define your own log format, that's the reason why AWStats can analyze nearly all web, wap
and proxy server log files. Some FTP servers log files, Syslog or mail logs can also be analyzed. 
The only requirement is "Your log file must contain required information". 
 
This is very short examples of possible log format: 
<table width="95%" border=1 cellpadding=0 cellspacing=0 bgcolor=#F4F4F4 class=CFAQ><tr class=CFAQ><td class=CFAQ>
Apache common log format (see Note*), 
Apache combined log format (known as NCSA combined log format or XLF or ELF format), 
Any other personalized Apache log format, 
Any IIS log format (known as W3C format), 
Webstar native log format, 
Realmedia server, Windows Media Server, Darwin streaming server, 
ProFTPd server, vsFTPd server, 
Postfix, Sendmail, QMail, Mdaemon 
A lot of web/wap/proxy/streaming servers log format 
</td></tr></table>
 
*Note: Apache common log format (AWStats can now analyze such log files but such log files does not
contain all information AWStats is looking for. The problem is in the content, not in the
format). I think analyzing common log files is not interesting because there is a lot of
missing information: no way to filter robots, find search engines, keywords, os, browser.
But a lot of users asked me for it, so AWStats support it.
However, a lot of interesting advanced features can't work: browsers, os's, keywords, robot detection...).
 
See also <a href="#PERSONALIZEDLOG">F.A.Q.: LOG FORMAT SETUP OR ERRORS </a>.

<a name="LANG"></a> 
FAQ-ABO200 : WHICH LANGUAGES ARE AVAILABLE ? 
AWStats can make reports in 43 languages. This is a list of all of them, for last version, in
alphabetical order (The code you can use for <a href="awstats_config.html#Lang">Lang</a>
and <a href="awstats_config.html#ShowFlagLinks">ShowFlagLinks</a> parameter are 
the ISO-639-1 language codes): 

<table width="95%" border=1 cellpadding=0 cellspacing=0 bgcolor=#F4F4F4 class=CFAQ><tr class=CFAQ><td class=CFAQ>
Albanian=al, Bosnian=ba, Brezhoneg=bzg, Bulgarian=bg, Catalan=ca,
Chinese (Taiwan)=tw, Chinese (Simpliefied)=cn, Croatian=hr, Czech=cz,
Danish=dk, Dutch=nl, English=en, Estonian=et, Euskara=eu, Finnish=fi,
French=fr, Galician=gl, German=de, Greek=gr, Hebrew=he, Hungarian=hu,
Icelandic=is, Indonesian=id, Italian=it, Japanese=jp, Korean=ko,
Latvian=lv, Norwegian (Nynorsk)=nn, Norwegian (Bokmal)=nb, Polish=pl,
Portuguese=pt, Portuguese (Brazilian)=br, Romanian=ro, Russian=ru,
Serbian=sr, Slovak=sk, Solvenian=si, Spanish=es, Swedish=se, Thai=th,
Turkish=tr, Ukrainian=ua, Welsh=cy.
</td></tr></table>

However, AWStats documentation is only provided in English. 
But, you may find small documentation for other languages made by contributors on
<a href="awstats_contrib.html#DOC">Documentation Contrib page</a>. 
 
If your language is not in this list, you can translate it yourself. For this, find what is your
2 letter language code: <a href="http://www.oasis-open.org/cover/iso639a.html">here</a>. 
Once, you get it, for example "gl" for Galician, copy the file awstats-en.txt into awstats-gl.txt,
in langs directory and translate every sentence inside. You can do same for files inside
tooltips_f, tooltips_m and tooltips_w sub-directories. Then send your translated file(s) to eldy@users.sourceforge.net.

<a name="PHPNUKE"></a> 
FAQ-ABO250 : CAN AWSTATS BE INTEGRATED WITH PHP NUKE ? 
The only plugin I know to integrate AWStats inside PHPNuke is here: <a href="http://phpnuke.org/modules.php?name=News&file=article&sid=7041">PhpNuke addon for AWStats</a>

<a name="ABOUTHISTORY"></a> 
FAQ-ABO300 : ABOUT AWSTATS HISTORY 
AWStats was initialy designed for my own use to track visitors on my personal web sites or other projects i worked on
(<a href="http://www.chiensderace.com" alt="Chiens De Race .com">www.chiensderace.com</a>,
 <a href="http://www.chatsderace.com" alt="Chats De Race .com">www.chatsderace.com</a>,
 <a href="https://www.dolibarr.org" alt="The simple ERP and CRM to manage your business">www.dolibarr.org</a>,
 <a href="https://www.nltechno.com" alt="NLTechno">www.nltechno.com</a>,
and <a href="https://www.destailleur.fr" alt="Site personnel Laurent Destailleur">www.destailleur.fr</a>) 
Then I decided to put it on sourceforge in year 2000. Then a lot of new versions were
developed to add enhancements until today. See changelog for full history of changes.

<hr>

<a name="NOLOG"></a> 
FAQ-COM025 : HOW TO USE AWSTATS WITH NO SERVER LOG FILE 
PROBLEM: 
I want to have AWStats statistics but i have no access to my server log file. 
SOLUTION: 
Because AWStats is a log analyzer, if you don't have any way to read your server log file,
you have nothing to analyze and you should not be able to use AWStats.
However, this is a trick that you can use to have a log file be built. You must add
a tag to call a CGI script like pslogger into each of your web pages. This will
allow you to have an artificial log file that can be analyzed by AWStats. 
You can find a Perl version of CGI pslogger enhanced by AWStats author <a href="/files/pslogger.pl">here</a>
or a php version of CGI pslogger made by Florent CHANTRET <a href="/files/pslogger.phps">here</a>.

<a name="LIMITLOG"></a> 
FAQ-COM050 : WHAT IS THE LOG SIZE LIMIT AWSTATS CAN ANALYZE 
PROBLEM: 
I know I must run AWStats update process frequently on new log files, this means thoose
files have a regular size, but for my first update, I want/need to run update process
on old log files that are very large. Is there a limit on log file size AWStats can analyze ? 
SOLUTION: 
No. There is no limit in AWStats. This means you can use it on large log files (test were
made on 10GB log files). 
However your system (Operating System or Perl version) might have a limit. For example, you can
experience size limit errors on files larger than 2 or 4 GB.
If limit is Perl only, try to use a Perl version compiled with "large file" option. 
If you can't find it nor build it, you can try to use a LogFile parameter that looks like this
<table width="95%" border=1 cellpadding=0 cellspacing=0 bgcolor=#F4F4F4 class=CFAQ><tr class=CFAQ><td class=CFAQ>
LogFile="cat /yourlogfilepath/yourlogfile |"
</td></tr></table>
instead of
<table width="95%" border=1 cellpadding=0 cellspacing=0 bgcolor=#F4F4F4 class=CFAQ><tr class=CFAQ><td class=CFAQ>
LogFile="/yourlogfilepath/yourlogfile"
</td></tr></table>

<a name="FTP"></a> 
FAQ-COM090 : SETUP FOR FTP SERVER LOG FILES (proftpd, vsftpd, ...) 
PROBLEM: 
What do I have to do to use AWStats to analyze some FTP server log files ? 
SOLUTION: 
AWStats can be used with some FTP server log files. 
 
With ProFTPd: 
 
1- Setup your server log file format: 
 
Modify the proftpd.conf file to add the following two lines :
<table width="95%" border=1 cellpadding=0 cellspacing=0 bgcolor=#F4F4F4 class=CFAQ><tr class=CFAQ><td class=CFAQ>

LogFormat awstats "%t %h %u %m %f %s %b" &nbsp; &nbsp; # WARNING: You must use a tab char between % tags and not a space !
 ExtendedLog /var/log/xferlog read,write awstats &nbsp; &nbsp; # WARNING: ExtendedLog directive might need to be placed inside a virtual host context if you use them.

</td></tr></table>
 
Then turn off old format Transfer log:
<table width="95%" border=1 cellpadding=0 cellspacing=0 bgcolor=#F4F4F4 class=CFAQ><tr class=CFAQ><td class=CFAQ>
TransferLog none &nbsp; &nbsp; # WARNING: TransferLog directive might need to be placed inside a virtual host context if you use them.
</td></tr></table>
 
To have the change effective, stop your server, remove old log file /var/log/xferlog and restart the server. 
Download a file by FTP and check that your new log file looks like this: 
<table width="95%" border=1 cellpadding=0 cellspacing=0 bgcolor=#F4F4F4 class=CFAQ><tr class=CFAQ><td class=CFAQ>
[01/Jan/2001:21:49:57 +0200]	ftp.server.com	user	RETR	/home/fileiget.txt	226	1499
</td></tr></table>
 
2- Then setup AWStats to analyze the FTP log file: 
 
Copy config file "awstats.model.conf" to "awstats.ftp.conf". 
Modify this new config file:
<table width="95%" border=1 cellpadding=0 cellspacing=0 bgcolor=#F4F4F4 class=CFAQ><tr class=CFAQ><td class=CFAQ>
LogFile="/var/log/xferlog"
 LogType=F
 LogFormat="%time1 %host %logname %method %url %code %bytesd"
 LogSeparator="\t"
 NotPageList=""
 LevelForBrowsersDetection=0
 LevelForOSDetection=0
 LevelForRefererAnalyze=0
 LevelForRobotsDetection=0
 LevelForWormsDetection=0
 LevelForSearchEnginesDetection=0
 ShowLinksOnUrl=0
 ShowMenu=1
 ShowSummary=UVHB
 ShowMonthStats=UVHB
 ShowDaysOfMonthStats=HB
 ShowDaysOfWeekStats=HB
 ShowHoursStats=HB
 ShowDomainsStats=HB
 ShowHostsStats=HBL
 ShowAuthenticatedUsers=HBL
 ShowRobotsStats=0
 ShowEMailSenders=0
 ShowEMailReceivers=0
 ShowSessionsStats=1
 ShowPagesStats=PBEX
 ShowFileTypesStats=HB
 ShowFileSizesStats=0
 ShowBrowsersStats=0
 ShowOSStats=0
 ShowOriginStats=0
 ShowKeyphrasesStats=0
 ShowKeywordsStats=0
 ShowMiscStats=0
 ShowHTTPErrorsStats=0
 ShowSMTPErrorsStats=0
</td></tr></table>
 
Now you can use AWStats as usual (run the update process and read statistics). 
 
 
With vsFTPd, or any FTP server that log with xferlog format: 
 
1- Check your server log file format: 
 
Take a look at your FTP server log file. You must have a format that match the following example to
use this FAQ : 
<table width="95%" border=1 cellpadding=0 cellspacing=0 bgcolor=#F4F4F4 class=CFAQ><tr class=CFAQ><td class=CFAQ>
Wed Jan 01 19:29:35 2001 1 192.168.1.1 102 /home/file1.txt b _ o r username ftp 0 * c
</td></tr></table>
 
2- Then setup AWStats to analyze the FTP log file: 
 
If your FTP log file format looks good, copy config file "awstats.model.conf" to "awstats.ftp.conf". 
Modify this new config file:
<table width="95%" border=1 cellpadding=0 cellspacing=0 bgcolor=#F4F4F4 class=CFAQ><tr class=CFAQ><td class=CFAQ>
LogFile="/var/log/xferlog"
 LogType=F
 LogFormat="%time3 %other %host %bytesd %url %other %other %method %other %logname %other %code %other %other"
 LogSeparator="\s"
 NotPageList=""
 LevelForBrowsersDetection=0
 LevelForOSDetection=0
 LevelForRefererAnalyze=0
 LevelForRobotsDetection=0
 LevelForWormsDetection=0
 LevelForSearchEnginesDetection=0
 ShowLinksOnUrl=0
 ShowMenu=1
 ShowSummary=UVHB
 ShowMonthStats=UVHB
 ShowDaysOfMonthStats=HB
 ShowDaysOfWeekStats=HB
 ShowHoursStats=HB
 ShowDomainsStats=HB
 ShowHostsStats=HBL
 ShowAuthenticatedUsers=HBL
 ShowRobotsStats=0
 ShowEMailSenders=0
 ShowEMailReceivers=0
 ShowSessionsStats=1
 ShowPagesStats=PBEX
 ShowFileTypesStats=HB
 ShowFileSizesStats=0
 ShowBrowsersStats=0
 ShowOSStats=0
 ShowOriginStats=0
 ShowKeyphrasesStats=0
 ShowKeywordsStats=0
 ShowMiscStats=0
 ShowHTTPErrorsStats=0
 ShowSMTPErrorsStats=0
</td></tr></table>
 
Now you can use AWStats as usual (run the update process and read statistics).

<a name="MAIL"></a> 
FAQ-COM100 : SETUP FOR MAIL LOG FILES (Postfix, Sendmail, Qmail, MDaemon, Exchange...) 
PROBLEM: 
What do I have to do to use AWStats to analyze my mail log files ? 
SOLUTION: 
 
This tip works with AWStats 5.5 or higher. 
 
For Postfix, Sendmail, QMail or MDaemon log files 
 
You must setup AWStats to use a mail log file preprocessor (maillogconvert.pl is provided
into AWStats tools directory, but you can use the one of your choice): 
For this, copy config "awstats.model.conf" file to "awstats.mail.conf". 
Modify this new config file:
For standard Postfix, Sendmail, MDaemon and standard QMail logfiles, set 
<table width="95%" border=1 cellpadding=0 cellspacing=0 bgcolor=#F4F4F4 class=CFAQ><tr class=CFAQ><td class=CFAQ>
LogFile="perl /path/to/maillogconvert.pl standard &lt; /pathtomaillog/maillog |"
</td></tr></table>
If the logfiles are compressed, they can be processed this way 
<table width="95%" border=1 cellpadding=0 cellspacing=0 bgcolor=#F4F4F4 class=CFAQ><tr class=CFAQ><td class=CFAQ>
LogFile="gzip -cd /var/log/maillog.0.gz | /path/to/maillogconvert.pl standard |" 
</td></tr></table>
And for VAdmin QMail logfiles (multi-host/virtualhost mail servers running vadmin software), set 
<table width="95%" border=1 cellpadding=0 cellspacing=0 bgcolor=#F4F4F4 class=CFAQ><tr class=CFAQ><td class=CFAQ>
LogFile="perl /path/to/maillogconvert.pl vadmin &lt; /pathtomaillog/maillog |" 
</td></tr></table>
 
Then, whatever is you mail server, you must also change:
<table width="95%" border=1 cellpadding=0 cellspacing=0 bgcolor=#F4F4F4 class=CFAQ><tr class=CFAQ><td class=CFAQ>
LogType=M
 LogFormat="%time2 %email %email_r %host %host_r %method %url %code %bytesd"
 LevelForBrowsersDetection=0
 LevelForOSDetection=0
 LevelForRefererAnalyze=0
 LevelForRobotsDetection=0
 LevelForWormsDetection=0
 LevelForSearchEnginesDetection=0
 LevelForFileTypesDetection=0
 ShowMenu=1
 ShowSummary=HB
 ShowMonthStats=HB
 ShowDaysOfMonthStats=HB
 ShowDaysOfWeekStats=HB
 ShowHoursStats=HB
 ShowDomainsStats=0
 ShowHostsStats=HBL
 ShowAuthenticatedUsers=0
 ShowRobotsStats=0
 ShowEMailSenders=HBML
 ShowEMailReceivers=HBML
 ShowSessionsStats=0
 ShowPagesStats=0
 ShowFileTypesStats=0
 ShowFileSizesStats=0
 ShowBrowsersStats=0
 ShowOSStats=0
 ShowOriginStats=0
 ShowKeyphrasesStats=0
 ShowKeywordsStats=0
 ShowMiscStats=0
 ShowHTTPErrorsStats=0
 ShowSMTPErrorsStats=1
</td></tr></table>
Warning: For MDaemon mail server, you must use the new MDaemon log file that ends
with "-Statistics.log". 
 
Now you can use AWStats as usual (run the update process and read statistics).

For Exchange log files 
 
Despite the high number of possible log format provided with Exchange,
none of them is built enough seriously to offer an interseting analyze (missing informations,
messy data, no id to join multiple records for same mail, etc...).
For this reason, an "exact" log analysis is a joke with Exchange log files.
However a little support is provided. In order to analyze Exchange traffic, you have to
enable "Message Tracking" (see article http://support.microsoft.com/default.aspx?scid=kb;EN-US;246856). 
Then copy config awstats.model.conf file to "awstats.mail.conf". 
Modify this new config file:
<table width="95%" border=1 cellpadding=0 cellspacing=0 bgcolor=#F4F4F4 class=CFAQ><tr class=CFAQ><td class=CFAQ>
LogType=M
 LogFormat="%time2 %email %email_r %host %host_r %method %url %code %bytesd"
 LevelForBrowsersDetection=0
 LevelForOSDetection=0
 LevelForRefererAnalyze=0
 LevelForRobotsDetection=0
 LevelForWormsDetection=0
 LevelForSearchEnginesDetection=0
 LevelForFileTypesDetection=0
 ShowMenu=1
 ShowSummary=HB
 ShowMonthStats=HB
 ShowDaysOfMonthStats=HB
 ShowDaysOfWeekStats=HB
 ShowHoursStats=HB
 ShowDomainsStats=0
 ShowHostsStats=HBL
 ShowAuthenticatedUsers=0
 ShowRobotsStats=0
 ShowEMailSenders=HBML
 ShowEMailReceivers=HBML
 ShowSessionsStats=0
 ShowPagesStats=0
 ShowFileTypesStats=0
 ShowFileSizesStats=0
 ShowBrowsersStats=0
 ShowOSStats=0
 ShowOriginStats=0
 ShowKeyphrasesStats=0
 ShowKeywordsStats=0
 ShowMiscStats=0
 ShowHTTPErrorsStats=0
 ShowSMTPErrorsStats=1
</td></tr></table>
 
Also don't forget that with Exchange, informations in a log analyses can't be exact.
Do not send any questions or requests for using AWStats with Exchange, this is not a problem in
AWStats and we have no time to support non opened products. 
If you want to have complete and accurate information with Exchange, forget using AWStats or use a
more serious mail serveur (Postfix, Sendmail, QMail...)

<a name="MEDIASERVER"></a> 
FAQ-COM110 : SETUP FOR A MEDIA SERVER (REALMEDIA, WINDOWS MEDIA SERVER, DARWIN STREAMING SERVER) 
PROBLEM: 
What do I have to do to use AWStats to analyze my Media Server log files. 
SOLUTION: 
 
For Realmedia 
 
Your log file will probably looks like this: 
<table width="95%" border=1 cellpadding=0 cellspacing=0 bgcolor=#F4F4F4 class=CFAQ><tr class=CFAQ><td class=CFAQ>
216.125.146.50 - - [16/Sep/2002:14:57:21 -0500] "GET cme/rhythmcity/rcitycaddy.rm?cloakport=8080,554,7070 RTSP/1.0" 200 6672 [Win95_4.0_6.0.9.374_play32_NS80_en-US_586] [80d280e1-c9ae-11d6-fa53-d52aaed98681] [UNKNOWN] 281712 141 3 0 0 494 
</td></tr></table>
 
Copy config awstats.model.conf file to "awstats.mediaserver.conf".
Modify this new config file:
<table width="95%" border=1 cellpadding=0 cellspacing=0 bgcolor=#F4F4F4 class=CFAQ><tr class=CFAQ><td class=CFAQ>
LogFile="/pathtomediaserverlog/mediaserverlog"
 LogType=S
 LogFormat="%host %other %logname %time1 %methodurl %code %bytesd %uabracket %other %other %other %other %other %other %other %other"
 LogSeparator="\s+"
 ShowMenu=1
 ShowSummary=UHB
 ShowMonthStats=UHB
 ShowDaysOfMonthStats=HB
 ShowDaysOfWeekStats=HB
 ShowHoursStats=HB
 ShowDomainsStats=HB
 ShowHostsStats=HBL
 ShowAuthenticatedUsers=0
 ShowRobotsStats=0
 ShowEMailSenders=0
 ShowEMailReceivers=0
 ShowSessionsStats=0
 ShowPagesStats=PB
 ShowFileTypesStats=HB
 ShowFileSizesStats=0
 ShowBrowsersStats=1
 ShowOSStats=1
 ShowOriginStats=H
 ShowKeyphrasesStats=0
 ShowKeywordsStats=0
 ShowMiscStats=0
 ShowHTTPErrorsStats=1
 ShowSMTPErrorsStats=0
</td></tr></table>
 
Now you can use AWStats as usual (run the update process and read statistics). 
 
 
For Windows Media Server / Darwin Streaming Server 
 
1- If your Windows Media / Darwin streaming Server version allows it, setup your log format to write the following fields:
<table width="95%" border=1 cellpadding=0 cellspacing=0 bgcolor=#F4F4F4 class=CFAQ><tr class=CFAQ><td class=CFAQ>
c-ip
 date
 time
 cs-uri-stem
 c-starttime
 x-duration
 c-rate
 c-status
 c-playerid
 c-playerversion
 c-playerlanguage
 cs(User-Agent)
 cs(Referer)
 c-hostexe
 c-hostexever
 c-os
 c-osversion
 c-cpu
 filelength
 filesize
 avgbandwidth
 protocol
 transport
 audiocodec
 videocodec
 channelURL
 sc-bytes
</td></tr></table>
 
To make the change effective, stop your server, remove old log files and restart the server. 
Listen to streaming files and check that your new log file looks like this: 
<table width="95%" border=1 cellpadding=0 cellspacing=0 bgcolor=#F4F4F4 class=CFAQ><tr class=CFAQ><td class=CFAQ>
80.223.91.37 2002-10-08 14:18:58 mmst://mydomain.com/mystream 0 106 1 200 {F4A826EE-FA46-480F-A49B-76786320FC6B} 8.0.0.4477 fi-FI - - wmplayer.exe 8.0.0.4477 Windows_2000 5.1.0.2600 Pentium 0 0 20702 mms TCP Windows_Media_Audio_9 - - 277721
</td></tr></table>
 
 
If your Windows Media/Darwin Streaming Server version does not allow to define your log format: 
Just follow instructions in step 2 directly but use the log format string found in first lines
of your log files (Just after the "#Fields:" string) as value for AWStats LogFormat
parameter. For example, you could have a LogFormat defined like this: 
<table width="95%" border=1 cellpadding=0 cellspacing=0 bgcolor=#F4F4F4 class=CFAQ><tr class=CFAQ><td class=CFAQ>
LogFormat="c-ip date time c-dns cs-uri-stem c-starttime x-duration c-rate
c-status c-playerid c-playerversion c-playerlanguage cs(User-Agent)
cs(Referer) c-hostexe c-hostexever c-os c-osversion c-cpu filelength
filesize avgbandwidth protocol transport audiocodec videocodec channelURL
sc-bytes c-bytes s-pkts-sent c-pkts-received c-pkts-lost-client
c-pkts-lost-net c-pkts-lost-cont-net c-resendreqs c-pkts-recovered-ECC
c-pkts-recovered-resent c-buffercount c-totalbuffertime c-quality s-ip s-dns
s-totalclients s-cpu-util"
</td></tr></table>
 This means you don't use the AWStats tags but AWStats can often also understand all the IIS and/or
Windows Media Server tags.

2- Then setup AWStats to analyze your Media Server log: 
Copy config awstats.model.conf file to "awstats.mediaserver.conf". 
Modify this new config file:
<table width="95%" border=1 cellpadding=0 cellspacing=0 bgcolor=#F4F4F4 class=CFAQ><tr class=CFAQ><td class=CFAQ>
LogFile="/pathtomediaserver/mediaserverlog"
 LogType=S
 LogFormat="c-ip date time cs-uri-stem c-starttime x-duration c-rate c-status c-playerid c-playerversion c-playerlanguage cs(User-Agent) cs(Referer) c-hostexe c-hostexever c-os c-osversion c-cpu filelength filesize avgbandwidth protocol transport audiocodec videocodec channelURL sc-bytes"
 DecodeUA=1
 ShowMenu=1
 ShowSummary=UHB
 ShowMonthStats=UHB
 ShowDaysOfMonthStats=HB
 ShowDaysOfWeekStats=HB
 ShowHoursStats=HB
 ShowDomainsStats=HB
 ShowHostsStats=HBL
 ShowAuthenticatedUsers=0
 ShowRobotsStats=0
 ShowEMailSenders=0
 ShowEMailReceivers=0
 ShowSessionsStats=0
 ShowPagesStats=PB
 ShowFileTypesStats=HB
 ShowFileSizesStats=0
 ShowBrowsersStats=1
 ShowOSStats=1
 ShowOriginStats=H
 ShowKeyphrasesStats=0
 ShowKeywordsStats=0
 ShowMiscStats=0
 ShowHTTPErrorsStats=1
 ShowSMTPErrorsStats=0
</td></tr></table>
 
Now you can use AWStats as usual (run the update process and read statistics).

<a name="PERSONALIZEDLOG"></a> 
FAQ-COM115 : SETUP/EXAMPLES FOR LOGFORMAT PARAMETER 
PROBLEM: 
Which value do I have to put in the LogFormat parameter to make AWStats working with my log
file format ? 
SOLUTION: 
The AWStats config file gives you all the possible values for LogFormat parameter.
To help you, this is some common cases of log file format, and
the corresponding value of LogFormat you must use in your AWStats config file: 
<hr>
If your log records are EXACTLY like this (NCSA combined/XLF/ELF log format): 
62.161.78.73 - - [dd/mmm/yyyy:hh:mm:ss +0x00] "GET /page.html HTTP/1.1" 200 1234 "http://www.from.com/from.htm" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)"

You must use : LogFormat=1 
This is same than: LogFormat="%host %other %logname %time1 %methodurl %code %bytesd %refererquot %uaquot"

<hr>
If your log records are EXACTLY like this (NCSA combined with several virtualhostname sharing same log file). 
virtualserver1 62.161.78.73 - - [dd/mmm/yyyy:hh:mm:ss +0x00] "GET /page.html HTTP/1.1" 200 1234 "http://www.from.com/from.htm" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)" 
You must use : LogFormat="%virtualname %host %other %logname %time1 %methodurl %code %bytesd %refererquot %uaquot" 
<hr>
If your log records are EXACTLY like this (NCSA combined and mod_gzip format 1 with Apache 1.x): 
62.161.78.73 - - [dd/mmm/yyyy:hh:mm:ss +0x00] "GET /page.html HTTP/1.1" 200 3904 "http://www.from.com/from.htm" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)" mod_gzip: 66pct. 
You must use : LogFormat="%host %other %logname %time1 %methodurl %code %bytesd %refererquot %uaquot %other %gzipratio"

<hr>
If your log records are EXACTLY like this (NCSA combined and mod_gzip format 2 with Apache 1.x): 
62.161.78.73 - - [dd/mmm/yyyy:hh:mm:ss +0x00] "GET /page.html HTTP/1.1" 200 3904 "http://www.from.com/from.htm" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)" mod_gzip: DECHUNK:OK In:11393 Out:3904:66pct. 
You must use : LogFormat="%host %other %logname %time1 %methodurl %code %bytesd %refererquot %uaquot %other %other %gzipin %gzipout" 
<hr>
If your log records are EXACTLY like this (NCSA combined and mod_deflate with Apache 2): 
62.161.78.73 - - [dd/mmm/yyyy:hh:mm:ss +0x00] "GET /page.html HTTP/1.1" 200 3904 "http://www.from.com/from.htm" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)" (45) 
You must use : LogFormat="%host %other %logname %time1 %methodurl %code %bytesd %refererquot %uaquot %deflateratio"

<hr>
If your log records are EXACTLY like this (NCSA combined with 2 spaces between some fields with Zope): 
62.161.78.73 &nbsp;- - [dd/mmm/yyyy:hh:mm:ss +0x00] "GET /page.html HTTP/1.1" 200 3904 "http://www.from.com/from.htm" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)" (45) 
You must use : 
LogFormat="%host %other %logname %time1 %methodurl %code %bytesd %refererquot %uaquot" 
LogSeparator=" *" 

<hr>
If your log records are EXACTLY like this (NCSA common CLF log format): 
62.161.78.73 - - [dd/mmm/yyyy:hh:mm:ss +0x00] "GET /page.html HTTP/1.1" 200 1234 
You must use : LogFormat=4 
Note: Browsers, OS's, Keywords and Referers features are not available with a such format.

<hr>
If your log records are EXACTLY like this (With some Squid versions, after setting emulate_http_log to on): 
200.135.30.181 - - [dd/mmm/yyyy:hh:mm:ss +0x00] "GET http://www.mydomain.com/page.html HTTP/1.0" 200 456 TCP_CLIENT_REFRESH_MISS:DIRECT 
You must use : LogFormat="%host %other %logname %time1 %methodurl %code %bytesd %other" 
<hr>
If your log records are EXACTLY like this (Some old IIS W3C log format): 
yyyy-mm-dd hh:mm:ss 62.161.78.73 - GET /page.html 200 1234 HTTP/1.1 Mozilla/4.0+(compatible;+MSIE+5.01;+Windows+NT+5.0) http://www.from.com/from.html 
You must use : LogFormat=2

<hr>
If your log records are EXACTLY like this (Some IIS W3C log format with some .net servers): 
yyyy-mm-dd hh:mm:ss GET /page.html - 62.161.78.73 - Mozilla/4.0+(compatible;+MSIE+5.01;+Windows+NT+5.0) http://www.from.com/from.html 200 1234 HTTP/1.1 
You must use : LogFormat=2 (or LogFormat="%time2 %method %url %logname %host %other %ua %referer %code %bytesd %other") 
<hr>
If your log records are EXACTLY like this (Some IIS 6+ W3C log format): 
yyyy-mm-dd hh:mm:ss GET /page.html - 62.161.78.73 - Mozilla/4.0+(compatible;+MSIE+5.01;+Windows+NT+5.0) http://www.from.com/from.html 200 1234 
You must use : LogFormat=2 (or LogFormat="date time cs-method cs-uri-stem cs-username c-ip cs-version cs(User-Agent) cs(Referer) sc-status sc-bytes")

<hr>
If your log records are EXACTLY like this (Some ISA W3C log format): 
62.161.78.73, anonymous, Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1), N, 1/1/2001, 0:00:16, W3ReverseProxy, HCSERV2, -, www.host.be, 192.168.141.101, 80, 266, 406, 10042, http, TCP, GET, http://192.168.141.101/, text/html, Inet, 200, 0x42330010, -, - 
You must use : 
LogFile="sed -e 's/, /\t/g' "/yourlogpath/yourlogfile.log" |" 
LogFormat=2 
LogSeparator=" " 
<hr>
If your log records are EXACTLY like this (With some WebSite versions): 
yyyy-mm-dd hh:mm:ss 62.161.78.73 - 192.168.1.1 80 GET /page.html - 200 11205 0 0 HTTP/1.1 mydomain.com Mozilla/4.0+(compatible;+MSIE+5.5;+Windows+98) - http://www.from.com/from.html 
You must use : LogFormat="%time2 %host %logname %other %other %method %url %other %code %bytesd %other %other %other %other %ua %other %referer"

<hr>
If your log records are EXACTLY like this (Webstar native log format): 
05/21/00	00:17:31	OK 	200	212.242.30.6	Mozilla/4.0 (compatible; MSIE 5.0; Windows 98; DigExt)	http://www.cover.dk/	"www.cover.dk"	:Documentation:graphics:starninelogo.white.gif	1133 
You must use : LogFormat=3 
<hr>
If your log records are EXACTLY like this (With some Lotus Notes/Domino versions): 
62.161.78.73 - Name Surname Service [dd/mmm/yyyy:hh:mm:ss +0x00] "GET /page.html HTTP/1.1" 200 1234 "http://www.from.com/from.htm" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)" 
You must use : LogFormat=6

<hr>
If your log records are EXACTLY like this (Lotus Notes/Domino 6.x log format): 
62.161.78.73 - "Name Surname" Service [dd/mmm/yyyy:hh:mm:ss +0x00] "GET /page.html HTTP/1.1" 200 1234 "http://www.from.com/from.htm" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)" 
You must use : LogFormat="%host %other %lognamequot %time1 %methodurl %code %bytesd %refererquot %uaquot" 
<hr>
If your log records are EXACTLY like this (With Oracle9iAS): 
62.161.78.73 - [dd/mmm/yyyy:hh:mm:ss +0x00] GET /page.html HTTP/1.1 200 1234 - "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)" 
Where separators are "tab" characters or several "spaces",
You must use : LogFormat="%host %logname %time1 %method %url %other %code %bytesd %referer %uaquot"
and LogSeparator="\s+"

<hr>
If you use a FTP server like ProFTPd: 
See <a href="#FTP">FAQ-COM090</a>. 
<hr>
If you want to analyze a mail log file (Postfix, Sendmail, QMail, MDaemon, Exchange): 
See <a href="#MAIL">FAQ-COM100</a>.

<hr>
If you use a Media Server (Realmedia, Windows Media Server): 
See <a href="#MEDIASERVER">FAQ-COM110</a>. 
<hr>
If your log records are EXACTLY like this (With some providers): 
62.161.78.73 - - [dd/Month/yyyy:hh:mm:ss +0x00] "GET /page.html HTTP/1.1" "-" 200 1234 
You must use : LogFormat="%host %other %logname %time1 %methodurl %other %code %bytesd" 
Note: Browsers, OS's, Keywords and Referers features are not available with a such format.

<hr>
There are a lot of other possible log formats. 
You must use a personalized log format LogFormat ="..." as described in config file to
support other various log formats.

<a name="ROTATE"></a> 
FAQ-COM120 : HOW TO ROTATE MY LOGS WITHOUT LOSING DATA 
PROBLEM: 
I want to archive/rotate my logs using my server system (for example logrotate) options or a third
software (rotatelog, cronolog) but I don't want to lose any visits information during the rotate
process. 
SOLUTION: 
<li> If your config file is setup with a <a href="awstats_config.html#LogFile">LogFile</a> parameter
that point to your current running log file (required if you want to use the
<a href="awstats_config.html#AllowToUpdateStatsFromBrowser">AllowToUpdateStatsFromBrowser</a>
option to have "real-time" statistics), to avoid losing too much records during the rotate
process, you must run the AWStats update JUST BEFORE the rotate process is done. 
The best way to do that on 'Linux like' OS is to use the linux built-in logrotate feature. You must
edit the logrotate config file used for your web server log file (usually stored in /etc/logrotate.d
directory) by adding the AWStats update process as a preprocessor command, like this example (bold
lines are lines to add for having a prerotate process): 
<table width="95%" border=1 cellpadding=0 cellspacing=0 bgcolor=#F4F4F4 class=CFAQ><tr class=CFAQ><td class=CFAQ>
/usr/local/apache/logs/*log 
{ 
notifempty 
daily 
rotate 7 
compress 

sharedscripts 
prerotate 
/usr/local/awstats/wwwroot/cgi-bin/awstats.pl -update -config=mydomainconfig 
endscript 

postrotate 
/usr/bin/killall -HUP httpd 
endscript 
} 
</td></tr></table>
 
If using a such solution, this is sequential steps that happens: 
<table border=1 cellpadding=1 cellspacing=0 bgcolor=#F4F4F4 width="95%" class=CFAQ>
<tr class=CFAQ><td class=CFAQ>Step</td><td class=CFAQ>Description</td><td class=CFAQ>Step name</td><td class=CFAQ>Date/Time example</td></tr>
<tr class=CFAQ valign=top><td class=CFAQ>A</td><td class=CFAQ>logrotate is started (by cron)</td><td class=CFAQ>Start of logrotate</td><td class=CFAQ>04:02:00</td></tr>
<tr valign=top><td class=CFAQ>B</td><td class=CFAQ><ul>awstats -update is launched by logrotate</td><td class=CFAQ>Start of awstats</td><td class=CFAQ>04:02:01</td><tr>
<tr valign=top><td class=CFAQ>C</td><td class=CFAQ><ul><ul>awstats start to read the log file file.log</td><td class=CFAQ>&nbsp;</td><td class=CFAQ>04:02:02</td><tr>
<tr valign=top><td class=CFAQ>D</td><td class=CFAQ><ul>awstats has reached the end of log file so now it starts to save its database on disk.</td><td class=CFAQ>&nbsp;</td><td class=CFAQ>04:05:00</td><tr>
<tr valign=top><td class=CFAQ>E</td><td class=CFAQ><ul>awstats has finished to save its new database, so it stops</td><td class=CFAQ>End of awstats</td><td class=CFAQ>04:06:00</td><tr>
<tr valign=top><td class=CFAQ>F</td><td class=CFAQ>logrotate moves old log file file.log to a new name file.log.sav. Apache now logs in this file file.log.sav since log file handle has not been changed (only log file name has been renamed).</td><td class=CFAQ>Log move</td><td class=CFAQ>04:06:01</td><tr>
<tr valign=top><td class=CFAQ>G</td><td class=CFAQ>logrotate sends the -HUP or -USR1 signal to Apache. With -HUP, Apache immediatly kills all its child process/thread, close log file file.log.sav, and reopen file file.log. So now, ALL hits are written to new file. With -USR1, Apache only ask its child process/thread to stop only when HTTP request will be completely served. However it closes immediatly log file file.log.sav, and reopen file file.log. So only NEW hits are written to new log file. HTTP requests that are still running will write in old one.</td><td class=CFAQ>Apache restart</td><td class=CFAQ>04:06:02</td><tr>
<tr valign=top><td class=CFAQ>H</td><td class=CFAQ>logrotate starts compress the old log file file.log.sav into file.log.gz</td><td class=CFAQ>Start compress</td><td class=CFAQ>04:06:03</td><tr>
<tr valign=top><td class=CFAQ>I</td><td class=CFAQ><ul>If some apache threads/processes are still running (because the kill sent was -USR1, so child process are waiting end of request before to stop), then those threads/processes are still writing to file.log.sav. If kill -HUP was used, all process are already restarted so all writes in new file.log.</td><td class=CFAQ>&nbsp;</td><td class=CFAQ>&nbsp;</td><tr>
<tr valign=top><td class=CFAQ>J</td><td class=CFAQ>logrotate has finished to compress log file into file.log.gz. File file.log.sav is deleted.</td><td class=CFAQ>End&nbsp;of&nbsp;compress End&nbsp;of&nbsp;logrotate</td><td class=CFAQ>04:07:03</td><tr>
<tr valign=top><td class=CFAQ>K</td><td class=CFAQ><ul>If signal was -USR1, some old childs can still run (when serving a very long request for example). So the log writing, still done in same file handle are going to a file that has been removed. So log writing are lost nowhere (this is only if -USR1 was used and if request was very long).</td><td class=CFAQ>&nbsp;</td><td class=CFAQ>&nbsp;</td><tr>
</table>
 
The advantage of this solution is that it is a very common way of working, used by a lot of
products, and easy to setup. You will notice that you can "lose" some hits: 
If you use the -HUP signal, you will only lose all hits that were written during D and E.
Note that you will also break all requests still running at G. In the example, it's a 
1 minute lost (for small or medium web sites, it will be less than few seconds), so this
give you an error lower than 0.07% (less for small web sites). This is not significant,
above all for a "statistics" progam. 
If you use the -USR1 signal, you will not kill any request. But you will lose all hits that
were wrote during D and E (like with -HUP) but also all hits that are still running after H
(all very long request that requires several minutes to be served). If hit ends during I, it is
wrote in a log file already analyzed, if hit ends at K, it is wrote nowhere. In the example,
it's also a 0.07% error plus error for other not visible hits that were finished during I or K,
but number of such hits should be very low since only hits that started before G and not
finished after H are concerned. In most cases a hits needs only few milliseconds to be served
so lost hits could be ignored. 
 
Note also that if you have x logrotate config files, with each of them a postrotate with a
kill -HUP, you send a kill x times to your server process. So try to include several log files
in same logrotate config file. You can have several awstats update command in the same
prerotate section and you will send the -HUP only once, after all updates are finished.
However, doing this, you will have a lap time between D and F (were some hits are lost) that will
be higher.

<li> Another common way of working is to choose to run the AWStats update process only once the log file has been
archived. 
This is required for example if you use the <a href="http://cronolog.org" target=awstatsbis>cronolog</a>
or rotatelog tools to rotate your log files. For example, Apache users can setup their Apache
httpd config file to write log file through a pipe to cronolog or rotatelog using
Apache CustomLog directive: 
<table border=1 cellpadding=1 cellspacing=0 bgcolor=#F4F4F4 width="95%" class=CFAQ><tr class=CFAQ><td class=CFAQ>
CustomLog "|/usr/sbin/cronolog [cronolog_options] /var/logs/access.%Y%m%d.log" combined
</td></tr></table>
If you use a such feature, you can't trigger AWStats update process to be ran just BEFORE the
rotate is done, so you must run it AFTER the rotate process, so on the archived log file. 
To setup awstats to always point to last archive log file, you can use the 'tags' available for
<a href="awstats_config.html#LogFile">LogFile</a>. 
The problem with that is that your data are refreshed only after a rotate has done. However,
you will miss absolutely nothing (no hits) and your server processes are never killed. 
 
<li> So, if you really want to not lose absolutely no hit and want to have updates more
frequently than the rotate frequency, the best way is still an hybrid solution (i am not sure
that it worth the pain, and remember that statistics are only statistics): 
You run the awstats update process from you crontab frequently, every hour for example, and half and hour
before the rotate has done. See next FAQ to know how to setup a scheduled job. 
Then, once the rotate has been done (by the logrotate or by a piped cronolog log file), and
before the next scheduled awstats update process start,
you run another update process on the archived log file using the -logfile option to force
update on the archived log file and not the current log file defined in awstats
config file. This will allow you to update the half hour missing,
until the log rotate (AWStats will find the new lines). However don't forget that this
particular update MUST be finished before the next croned update.

<a name="CRONTAB"></a> 
FAQ-COM130 : HOW TO RUN AWSTATS UPDATE PROCESS FREQUENTLY 
PROBLEM: 
AWStats must be ran frequently to update statistics. How can I do this ? 
SOLUTION: 
A good way of working is to run the AWStats update process as a preprocessor of your log rotate
process. See previous FAQ (<a href="#ROTATE">FAQ-COM120</a>) for this. 
But you can also run AWStats update process regularly by a scheduler: 
 
With Windows, you can use the internal task scheduler.
The use of this tool is not an AWStats related problem, so please take a look at your Windows manual.
Warning, if you use "awstats.pl -config=mysite -update" in your scheduled task, you might
experience problem of failing task. Try this instead 
<table border=1 cellpadding=1 cellspacing=0 bgcolor=#F4F4F4 width="95%" class=CFAQ><tr class=CFAQ><td class=CFAQ>
"C:\WINNT\system32\CMD.EXE /C C:\[awstats_path]\awstats.pl -config=mysite -update"
</td></tr></table>
or 
<table border=1 cellpadding=1 cellspacing=0 bgcolor=#F4F4F4 width="95%" class=CFAQ><tr class=CFAQ><td class=CFAQ>
"C:\[perl_path]\perl.exe C:\[awstats_path]\awstats.pl -config=mysite -update"
</td></tr></table>
A lot of other open source schedulers are often better (otherwise there is also good sharewares or freewares). 
 
With unix-like operating systems, you can use the "crontab". 
This is examples of lines you can add in the cron file (see your unix reference manual for cron) : 
To run update every day at 03:50, use : 
<table border=1 cellpadding=1 cellspacing=0 bgcolor=#F4F4F4 width="95%" class=CFAQ><tr class=CFAQ><td class=CFAQ>
50 3 * * * /usr/local/awstats/wwwroot/cgi-bin/awstats.pl -config=mysite -update >/dev/null 
</td></tr></table>
To run update every hour, use : 
<table border=1 cellpadding=1 cellspacing=0 bgcolor=#F4F4F4 width="95%" class=CFAQ><tr class=CFAQ><td class=CFAQ>
0 * * * * /usr/local/awstats/wwwroot/cgi-bin/awstats.pl -config=mysite -update >/dev/null 
</td></tr></table>

<a name="EXCLUDEHOSTS"></a> 
FAQ-COM140 : HOW CAN I EXCLUDE MY IP ADDRESS (OR WHOLE SUBNET MASK) FROM STATS ? 
PROBLEM: 
I don't want to see my own IP address in the stats or I want to exclude counting visits from a whole subnet. 
SOLUTION: 
You must edit the config file to change the <a href="awstats_config.html#SkipHosts">SkipHosts</a> parameter. 
For example, to exclude: 
<li> your own IP address 123.123.123.123, use <a href="awstats_config.html#SkipHosts">SkipHosts</a>="123.123.123.123" 
<li> the whole subnet 123.123.123.xxx, use <a href="awstats_config.html#SkipHosts">SkipHosts</a>="REGEX[^123\.123\.123\.]" 
<li> all sub hosts xxx.myintranet.com, use <a href="awstats_config.html#SkipHosts">SkipHosts</a>="REGEX[\.myintranet\.com$]" (This one works only if DNS lookup is already done in your
log file).

<a name="SCREENSIZE"></a> 
FAQ-COM142 : HOW TO GET THE SCREEN SIZE AND BROWSER CAPABILITIES REPORT WORKING ? 
PROBLEM: 
I see in the AWStats features list that it can report the screen size used by visitors and other browsers' informations,
(like if browser support Flash, Java, Javascript, PDF, MAcromedia, Audio plugins, etc...). How can I do that ? 
SOLUTION: 
AWStats is a log analyzer, so to report the screen size of your visitor, we need to have information inside the log file itself.
For this, the only way to do that, is to add some HTML tags inside some of your pages (the home page is enough to
get use ratios). This tag will add call to a javascript that ask your browser to get a virtual URL that
includes, in its parameters, the screen size resolution and all other informations about browser capabilities (Flash, Java, Javascript, PDF, Macromedia, Audio plgins...). 
 
This is the code you must add (at bottom of your home page for example) : 
<table border=1 cellpadding=1 cellspacing=0 bgcolor=#F4F4F4 width="95%" class=CFAQ><tr class=CFAQ><td class=CFAQ>
&lt;script language="javascript" type="text/javascript" src="/js/awstats_misc_tracker.js" &gt;&lt;/script&gt; 
&lt;noscript&gt;&lt;img src="/js/awstats_misc_tracker.js?nojs=y" height="0" width="0" border="0" style="display: none"&gt;&lt;/noscript&gt; 
</td></tr></table>
 
Note that you must also place the awstats_misc_tracker.js script (provided in /js directory with AWStats) inside 
a js directory stored in your web root. 
Once this is done, load your home page with your browser and go to check that inside your log file
if you can see a line that looks like that: 
<table border=1 cellpadding=1 cellspacing=0 bgcolor=#F4F4F4 width="95%" class=CFAQ><tr class=CFAQ><td class=CFAQ>
123.123.123.123 - - [24/Apr/2005:16:09:38 +0200] "GET /js/awstats_misc_tracker.js?screen=800x600&win=724x517&...&sid=awssession_id123 HTTP/1.1" 200 6237 "http://therefererwebsite.com/index.php" "Mozilla/5.0 (Linux) Gecko/20050414 Firefox/1.0.3"
</td></tr></table>
 
If yes, you can then run the AWStats update process. Screen sizes information will be analyzed. All you have to do 
now is to edit your config file to tell AWStats to add the report on html output. For this, change
the <a href="awstats_config.html#Show">ShowMiscStats</a> parameter. 
<table border=1 cellpadding=1 cellspacing=0 bgcolor=#F4F4F4 width="95%" class=CFAQ><tr class=CFAQ><td class=CFAQ>
ShowMiscStats=anjdfrqwp
</td></tr></table>
 
Note: If you change directory where awstats_misc_tracker.js is stored (somewhere else than the /js directory),
you must modify, according to your change: 
- the html tags added 
- the line: var awstatsmisctrackerurl="/js/awstats_misc_tracker.js"; inside the awstats_misc_tracker.js script 
- the parameter <a href="awstats_config.html#MiscTrackerUrl">MiscTrackerUrl</a> inside AWStats configuration file.

<a name="EXTRA"></a> 
FAQ-COM145 : HOW TO USE THE EXTRA SECTIONS FEATURES ? 
PROBLEM: 
I want to build personalized reports not provided in default AWStats reports. How can I setup 
the Extra Sections parameters in my AWStats config file to do so ? 
SOLUTION: 
Take a look at the <a href="awstats_extra.html">Using AWStats Extra Sections features</a>

<a name="BENCHMARK"></a> 
FAQ-COM150 : BENCHMARK / FREQUENCY TO LAUNCH AWSTATS TO UPDATE STATISTICS 
PROBLEM: 
What is AWStats speed ? 
What is the frequency to launch AWStats process to update my statistics ? 
SOLUTION: 
All benchmarks information and advice on frequency for update process are related into
the <a href="awstats_benchmark.html">Benchmark page</a>.

<a name="DNS"></a> 
FAQ-COM200 : HOW REVERSE DNS LOOKUP WORKS, UNRESOLVED IP ADDRESSES 
PROBLEM: 
The reported page AWStats shows me has no hostnames, only IP addresses, countries reported are all "unknown". 
SOLUTION: 
When AWStats find an IP address in your log file, it tries a reverse DNS lookup to find
the hostname and domain if the <a href="awstats_config.html#DNSLookup">DNSLookup</a> parameter, in your AWStats config file, is <a href="awstats_config.html#DNSLookup">DNSLookup</a>=1
(Default value). So, first, check if you have the good value. The <a href="awstats_config.html#DNSLookup">DNSLookup</a>=0 
must be used only if your log file contains already resolved IP address. For example, 
when you set up Apache with the HostNameLookups=on directive. When you 
ask your web server to make itself the reverse DNS lookup to log hostname instead 
of IP address, you will still find some IP addresses in your log file because 
the reverse DNS lookup is not always possible. But if your web server fails in 
it, AWStats will also fails (All reverse DNS lookups use the same system API). 
So to avoid AWStats to make an already done lookup (with success or not), you 
can set <a href="awstats_config.html#DNSLookup">DNSLookup</a>=0 in AWStats config file.
If you prefer, you can make the reverse DNS lookup on a log file before running
your log analyzer (If you only need to convert a logfile with IP Addresses into a
logfile with resolved hostnames). You can use for this <a href="awstats_tools.html#logresolvemerge">logresolvemerge</a> tool
provided with AWStats distribution (This tools is an improved version of logresolve provided with Apache).

<a name="DIFFERENT_RESULTS"></a> 
FAQ-COM250 : DIFFERENT RESULTS THAN OTHER ANALYZER 
PROBLEM: 
I also use Webalizer, Analog (or another log analyzer) and it doesn't report the same results than AWStats. Why ? 
SOLUTION: 
If you compare AWStats results with an other log file analyzer, you will found some differences,
sometimes very important. In fact, all analyzer (even AWStats) make "over reporting" because of the
problem of proxy-servers and robots. However AWStats is one of the most accurate and its "over reporting"
is very low where all other analyzers, even the most famous, have a VERY HIGH error rate (10% to 200% more than reality !). 
This is the most important reasons why you can find important differences: 
<li> Some dynamic pages generated by CGI programs are not counted by some analyzer (ie Webalizer) like
a "Page" (but only like a "Hit") if CGI prog does not end with a defined extension (.cgi, ...), so they are not included
correctly in their statistics. AWStats use on oposite policy, assuming a file is a page except if 
type is in a list (See <a href="awstats_config.html#NotPageList">NotPageList</a> parameter). Error rate
with a such policy is lower. 
<li> Some log analyzers use the "Hits" to count visitors. This is a very bad way of working :
Some visitors use a lot of proxy servers to surf (ie: AOL users), this means it's possible that several
hosts (with several IP addresses) are used to reach your site for only one visitor (ie: one proxy server download
the page and 2 other servers download all images). Because of this, if stats of unique visitors are made on "hits",
3 users are reported but it's wrong. So AWStats considers only HTML "Pages" to count unique visitors.
This decrease the error, not completely, because it's always possible that a proxy server download one HTML frame and
another one download another frame, but this make the over-reporting of unique visitors less important. 
<li> Another important reason to have difference is that an error log files is not always completely sorted
but only "nearly" sorted because of cache and writing log engines used by server. Nearly all log
analyzers (commercial and not) assumes that log file is "exactly" sorted by hit date to calculate
visits, entry and exit pages. But there is nothing that guaranties this and some log files
are only "nearly" sorted, above all log files on highly loaded servers.
AWStats has an advanced parsing algorithm that is able to count 
correctly visits, entry and exit pages even if log file is only "nearly" sorted. 
<li>AWStats does not count twice (with default setup) redirects made by server "rewrite rules". Such rule makes two hits into
log files, so most log analyzer count them twice, but only one page were "viewed". 
<li> Then, there is internal bugs in log analyzers that make reports wrong.
For example, a lot of users have reported that Webalizer "doubles" the number of visits or visitors
in some circumstances. 
<li> AWStats is able to detect robots visits. Most analyzers think robots visits are human visitors.
This error make them to report more visits and visitors than reality.
When AWStats reports a "1 visitor", it means "1 human visitor" (even if it's not posible to detect
all robots, most of them are detected). "Robots visitors" are reported separately in the "Robots/Spiders visitors" chart.
AWStats is a log analyzer with one of the most important robot database. In fact, a lot of other log analyzer
uses an update copy of the AWStats robot database for their own use.
However, even if a robot database is up to date, there is still some robot hits that are not possible to detect
using log analyzing. For this reason, AWStats still report 10% more visits than reality because of such robots.
This is the major reason that create differences between a log analyzer and a HTML tagger system like Google Analytics. 
Now let see other minor reasons. However those points explains only very small differences (<1%. See all previous points
if you have more important difference): 
<li> To differenciate new visits from same visitor, log analysers uses a visit time-out. If value differs,
then result differs (for visit count and entry and exit pages).
A such time-out is a fixed value (For example 60 minutes) meaning if a visitor make a hit
59 minutes after downloading the previous page, it's the same visits, if he make it 61 minutes after, it's a new visit.
Of course, there is no realy difference between 59 and 61, but couting visits without
time-out is not possible. And because the most important is to have a time-out (and not
really it's value), AWStats time-out is not an "exact" value but is "around" 60 minutes.
This allows AWStats to have better speed processing time, so you also might experience
little differences, in visit count, between AWStats and another log analyzer even if
their time-out are both defined to same value (because AWStats time-out is not exactly
but nearly value defined). 
<li> There is also differences in log analyzers databases and algorithms that make details of results less or more accurate: 
AWStats has a larger browsers, os', search engines and robots database, so reports concerning this are more accurate. 
AWStats has url syntax rules to find keywords or keyphrases used to find your site, but AWStats has also
an algorithm to detect keywords of unknown search engines with unknown url syntax rule. 
Etc... 
 
If you want to check how serious your log analyzer is, try to parse the following log file.
It's a very common log file but results will show you how bad most log analyzers are (above
all commercial products): 
<table width="95%" border=1 cellpadding=0 cellspacing=0><tr class=CFAQ><td class=CFAQ>
<pre>
# This is a sample of log file that contains a lot of various data we can find
# in a log file. Great sample to test reliability and accuracy of any log
# analyzer.
# ----------------------------------------------------------------------------
# This sample log file contains 10 differents IPs that are :
# Viewed traffic: 5 different true human visitors making 6 human visits
# 21 hits on pages and 15 hits not pages (36 hits)
# Not viewed traffic: 13 pages, 15 hits
# ----------------------------------------------------------------------------
# 80.8.55.1 2 visits (start at 00:00:00 and at 12:00:00 with both entry page on /)
# And 2 hits to add favourites but first is non root hit with error meaning it's same "add"
# 80.8.55.2 Not a visit, only an image included into a page of an other site
# 80.8.55.3 1 visit (and add home page to favourites)
# 80.8.55.4 same visitor than 80.8.55.3 using aol proxy
# 80.8.55.5 Not a visit (but bot indexing)
# 80.8.55.6 1 visit (authenticated visitor)
# 80.8.55.7 1 visit (authenticated visitor with space in name)
# 80.8.55.8 Not a visit (try but failed twice with 404 and 405 error)
# 80.8.55.9 Not a visit (but a worm attack)
# 80.8.55.10 1 visit that come from a web page that is not a search engine

80.8.55.1 - - [01/Jan/2001:00:00:10 +0100] "GET /page1.html HTTP/1.0" 200 7009 "-" "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0)"
80.8.55.1 - - [01/Jan/2001:00:00:00 +0100] "GET / HTTP/1.0" 200 7009 "http://www.sitereferer/cgi-bin/search.pl?q=a" "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0)"
80.8.55.1 - - [01/Jan/2001:00:00:20 +0100] "GET /page2.cgi HTTP/1.0" 200 7009 "http://localhost/page1.html" "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0)"
80.8.55.1 - - [01/Jan/2001:00:00:25 +0100] "GET /page3 HTTP/1.0" 200 7009 "-" "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0)"
80.8.55.1 - - [01/Jan/2001:00:00:30 +0100] "GET /image.gif HTTP/1.0" 200 7009 "-" "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0)"
80.8.55.1 - - [01/Jan/2001:00:00:35 +0100] "GET /image2.png HTTP/1.0" 200 7009 "-" "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0)"
80.8.55.1 - - [01/Jan/2001:00:00:40 +0100] "GET /dir/favicon.ico HTTP/1.0" 404 299 "-" "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0)"
80.8.55.1 - - [01/Jan/2001:00:00:40 +0100] "GET /favicon.ico HTTP/1.0" 200 299 "-" "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0)"

80.8.55.1 - - [01/Jan/2001:12:00:00 +0100] "GET / HTTP/1.0" 200 7009 "http://WWW.SiteRefereR:80/cgi-bin/azerty.pl?q=a" "Mozilla/4.7 [fr] (Win95; I)"
80.8.55.1 - - [01/Jan/2001:12:00:10 +0100] "GET /page1.html HTTP/1.0" 200 7009 "-" "Mozilla/4.7 [fr] (Win95; I)"
80.8.55.1 - - [01/Jan/2001:12:00:20 +0100] "GET /page2.cgi HTTP/1.0" 200 7009 "-" "Mozilla/4.7 [fr] (Win95; I)"
80.8.55.1 - - [01/Jan/2001:12:00:25 +0100] "GET /page3 HTTP/1.0" 200 7009 "-" "Mozilla/4.7 [fr] (Win95; I)"
80.8.55.1 - - [01/Jan/2001:12:00:30 +0100] "GET /image.gif HTTP/1.0" 200 7009 "-" "Mozilla/4.7 [fr] (Win95; I)"
80.8.55.1 - - [01/Jan/2001:12:00:35 +0100] "GET /image2.png HTTP/1.0" 200 7009 "-" "Mozilla/4.7 [fr] (Win95; I)"
80.8.55.1 - - [01/Jan/2001:12:00:40 +0100] "GET /js/awstats_misc_tracker.js HTTP/1.1" 200 4998 "-" "Mozilla/4.7 [fr] (Win95; I)"
80.8.55.1 - - [01/Jan/2001:12:00:45 +0100] "GET /js/awstats_misc_tracker.js?screen=1024x768&cdi=32&java=true&shk=n&fla=y&rp=y&mov=n&wma=y&pdf=y&uid=awsuser_id1073036758306r9417&sid=awssession_id1073036758306r9417 HTTP/1.1" 200 4998 "-" "Mozilla/4.7 [fr] (Win95; I)"

80.8.55.2 - - [01/Jan/2001:12:01:00 +0100] "GET /hitfromothersitetoimage.gif HTTP/1.0" 200 7009 "-" "Mozilla/5.0+(Macintosh;+U;+PPC+Mac+OS+X+Mach-O;+en-US;+rv:1.4)+Gecko/20030624+Netscape/7.1"

80.8.55.3 - - [01/Jan/2001:12:01:10 +0100] "GET / HTTP/1.0" 200 7009 "http://www.sitereferer:81/cgi-bin/azerty.pl" "Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.5a) Gecko/20030728 Mozilla Firebird/0.6.1"
80.8.55.3 - - [01/Jan/2001:12:01:15 +0100] "GET /page1.html HTTP/1.0" 200 7009 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.5a) Gecko/20030728 Mozilla Firebird/0.6.1"
80.8.55.3 - - [01/Jan/2001:12:01:20 +0100] "GET /page2.cgi?x=a&family=a&y=b&familx=x HTTP/1.0" 200 7009 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.5a) Gecko/20030728 Mozilla Firebird/0.6.1"
80.8.55.3 - - [01/Jan/2001:12:01:25 +0100] "GET /page3 HTTP/1.0" 200 7009 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.5a) Gecko/20030728 Mozilla Firebird/0.6.1"
80.8.55.3 - - [01/Jan/2001:12:01:30 +0100] "GET /image.gif HTTP/1.0" 200 7009 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.5a) Gecko/20030728 Mozilla Firebird/0.6.1"
80.8.55.3 - - [01/Jan/2001:12:01:35 +0100] "GET /image2.png HTTP/1.0" 200 7009 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.5a) Gecko/20030728 Mozilla Firebird/0.6.1"

80.8.55.4 - - [01/Jan/2001:12:01:45 +0100] "GET /samevisitorthan80.8.55.3usingaolproxy.gif HTTP/1.0" 200 7009 "-" "Mozilla/3.0 (Windows 98; U) Opera 6.03"

80.8.55.5 - - [01/Jan/2001:12:02:00 +0200] "GET /robots.txt HTTP/1.0" 200 299 "-" "This is an unkown user agent"
80.8.55.5 - - [01/Jan/2001:12:02:00 +0200] "GET /mydir/robots.txt HTTP/1.0" 200 299 "-" "This is an unkown user agent"
80.8.55.5 - - [01/Jan/2001:12:02:05 +0200] "GET /pagefromabot1.html HTTP/1.0" 200 7009 "-" "GoogleBot"
80.8.55.5 - - [01/Jan/2001:12:02:05 +0200] "GET /pagefromabot2a.html HTTP/1.0" 200 7009 "-" "This is bot xxx"
80.8.55.5 - - [01/Jan/2001:12:02:05 +0200] "GET /pagefromabot2b.html HTTP/1.0" 200 7009 "-" "This_is_bot_xxx"
80.8.55.5 - - [01/Jan/2001:12:02:05 +0200] "GET /pagefromabot3.html HTTP/1.0" 200 7009 "-" "This is sucker xxx"
80.8.55.5 - - [01/Jan/2001:12:02:05 +0200] "GET /pagefromabot4.html HTTP/1.0" 200 7009 "-" "woozweb-monitoring"
80.8.55.5 - - [01/Jan/2001:12:02:05 +0200] "GET /pagefromabot5.html HTTP/1.0" 200 7009 "-" "wget"
80.8.55.5 - - [01/Jan/2001:12:02:05 +0200] "GET /pagefromabot6.html HTTP/1.0" 200 7009 "-" "libwww"

80.8.55.6 - john [01/Jan/2001:13:00:00 +0100] "GET /cgi-bin/order.cgi?x=a&family=a&productId=998&titi=i&y=b&y=b HTTP/1.0" 200 7009 "http://www.google.com/search?sourceid=navclient&ie=utf-8&oe=utf-8&q=ma%C3%AEtre+�l�ve" "SAGEM-myX-5m/1.0_UP.Browser/6.1.0.6.1.103_(GUI)_MMP/1.0_(Google_WAP_Proxy/1.0)"
80.8.55.6 - john [01/Jan/2001:13:00:00 +0100] "GET /images/image1.gif HTTP/1.0" 200 364 "http://www.google.fr/search?q=cache:dccTQ_Zn4isJ:www.chiensderace.com/cgi-bin/liste_annonces.pl%3FTYPE%3D5%26ORIGINE%3Dchiensderace+labrador+chiensderace&hl=en&lr=lang_en|lang_fr&ie=UTF-8" "SAGEM-myX-5m/1.0_UP.Browser/6.1.0.6.1.103_(GUI)_MMP/1.0_(Google_WAP_Proxy/1.0)"
80.8.55.6 - john [01/Jan/2001:13:00:00 +0100] "GET /images/image2.gif HTTP/1.0" 200 364 "http://www.google.fr/search?q=cache:dccTQ_Zn4isJ:www.chiensderace.com/cgi-bin/liste_annonces.pl%3FTYPE%3D5%26ORIGINE%3Dchiensderace+labrador+chiensderace&hl=en&lr=lang_en|lang_fr&ie=UTF-8" "SAGEM-myX-5m/1.0_UP.Browser/6.1.0.6.1.103_(GUI)_MMP/1.0_(Google_WAP_Proxy/1.0)"
80.8.55.6 - john [01/Jan/2001:13:00:00 +0100] "GET /images/image3.gif HTTP/1.0" 200 364 "http://www.google.fr/search?q=cache:dccTQ_Zn4isJ:www.chiensderace.com/cgi-bin/liste_annonces.pl%3FTYPE%3D5%26ORIGINE%3Dchiensderace+labrador+chiensderace&hl=en&lr=lang_en|lang_fr&ie=UTF-8" "SAGEM-myX-5m/1.0_UP.Browser/6.1.0.6.1.103_(GUI)_MMP/1.0_(Google_WAP_Proxy/1.0)"
80.8.55.6 - john [01/Jan/2001:13:00:00 +0100] "GET /images/image4.gif HTTP/1.0" 200 364 "http://www.google.fr/search?q=cache:dccTQ_Zn4isJ:www.chiensderace.com/cgi-bin/liste_annonces.pl%3FTYPE%3D5%26ORIGINE%3Dchiensderace+labrador+chiensderace&hl=en&lr=lang_en|lang_fr&ie=UTF-8" "SAGEM-myX-5m/1.0_UP.Browser/6.1.0.6.1.103_(GUI)_MMP/1.0_(Google_WAP_Proxy/1.0)"
80.8.55.6 - john [01/Jan/2001:13:00:00 +0100] "GET /images/image5.gif HTTP/1.0" 200 364 "http://www.google.fr/search?q=cache:dccTQ_Zn4isJ:www.chiensderace.com/cgi-bin/liste_annonces.pl%3FTYPE%3D5%26ORIGINE%3Dchiensderace+labrador+chiensderace&hl=en&lr=lang_en|lang_fr&ie=UTF-8" "SAGEM-myX-5m/1.0_UP.Browser/6.1.0.6.1.103_(GUI)_MMP/1.0_(Google_WAP_Proxy/1.0)"

80.8.55.7 - John Begood [01/Jan/2001:13:01:00 +0100] "GET /cgi-bin/order.cgi;family=f&type=t&productId=999&titi=i#BIS HTTP/1.0" 200 7009 "http://www.a9.com/searchkeyfroma9" "Mozilla/3.01 (compatible;)"
80.8.55.7 - John Begood [01/Jan/2001:13:01:00 +0100] "GET /do/Show;jsessionid=6BEF030AB1677BEC333FFCC7BF4DF564?param=1477 HTTP/1.0" 200 7009 "-" "Mozilla/3.01 (compatible;)"

80.8.55.8 - - [01/Jan/2001:14:01:20 +0100] "GET /404notfoundpage.html?paramnotpagefound=valparamnotpagefound HTTP/1.0" 404 0 "http://refererto404nofoundpage/pageswithbadlink.html?paramrefnotpagefound=valparamrefnotpagefound" "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0)"
80.8.55.8 - - [01/Jan/2001:14:01:20 +0100] "GET /405error.html HTTP/1.0" 405 0 "http://refererto405error/pagesfrom405.html" "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0)"

80.8.55.9 - - [01/Jan/2001:15:00:00 +0200] "GET /default.ida?XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX HTTP/1.0" 404 299 "-" "-"
80.8.55.9 - - [01/Jan/2001:15:00:00 +0200] "SEARCH / -" 411 - "-" "-"

80.8.55.10 - - [01/Jan/2001:16:00:00 -0300] "GET / HTTP/1.1" 200 70476 "http://us.f109.mail.yahoo.com/ym/ShowLetter?box=Inbox&MoreYahooParams..." "Mozilla/5.0 (Windows; U; Windows NT 5.0; fr-FR; rv:1.7.5) Gecko/20041108 Firefox/1.0"
80.8.55.10 - - [01/Jan/2001:16:00:00 -0300] "GET /index.html HTTP/1.1" 200 70476 "http://us.f109.mail.yahoo.com/ym/ShowLetter?box=Inbox&MoreYahooParams..." "Mozilla/5.0 (Windows; U; Windows NT 5.0; fr-FR; rv:1.7.5) Gecko/20041108 Firefox/1.0"
80.8.55.10 - - [01/Jan/2001:16:00:00 -0300] "GET /index.php HTTP/1.1" 200 70476 "http://us.f109.mail.yahoo.com/ym/ShowLetter?box=Inbox&MoreYahooParams..." "Mozilla/5.0 (Windows; U; Windows NT 5.0; fr-FR; rv:1.7.5) Gecko/20041108 Firefox/1.0"
80.8.55.10 - - [01/Jan/2001:16:00:00 -0300] "GET / HTTP/1.1" 200 70476 "http://us.f109.mail.yahoo.com/ym/ShowLetter?box=Inbox&MoreYahooParams..." "Mozilla/5.0 (Windows; U; Windows NT 5.0; fr-FR; rv:1.7.5) Gecko/20041108 Firefox/1.0"

80.8.55.10 - - [01/Jan/2001:16:00:00 -0300] "GET / HTTP/1.1" 200 70476 "http://us.f109.mail.yahoo.com/ym/ShowLetter?box=Inbox&MoreYahooParams..." "Mozilla/5.0 (Windows; U; Windows NT 5.0; fr-FR; rv:1.7.5) Gecko/20041108 Firefox/1.0"
80.8.55.10 - - [01/Jan/2001:16:30:00 -0300] "GET /page1.html HTTP/1.1" 200 70476 "http://www.freeweb.hu/icecat/filmek/film04.html" "Mozilla/5.0 (Windows; U; en-US) AppleWebKit/526.9+ (KHTML, like Gecko) AdobeAIR/1.5"
80.8.55.10 - - [01/Jan/2001:17:00:00 -0300] "GET /cgi-bin/awredir.pl?url=http://xxx.com/aa.html HTTP/1.1" 302 70476 "http://us.f109.mail.yahoo.com/ym/ShowLetter?box=Inbox&MoreYahooParams..." "Mozilla/5.0 (Windows; U; Windows NT 5.0; fr-FR; rv:1.7.5) Gecko/20041108 Firefox/1.0"
</pre>
</td></tr></table> 
This is what you should find: 
6 true human visits 
5 different true visitors 
1 bot visit 
1 worm attack 
The entry pages for true visits should be "/" (even for 80.8.55.1) or "/cgi-bin/order.cgi" but nothing else. 
Note: I did not find any commercial log analyzer that can deal such a common log file correctly, so if you find, let me know !

<a name="DIFFERENCE_HOURS"></a> 
FAQ-COM300 : DIFFERENCE BETWEEN LOCAL HOURS AND AWSTATS REPORTED HOURS 
PROBLEM: 
I use IIS and there's a difference between local hour and AWStats reported hour. For example I made a hit on a page 
at 4:00 and AWStats report I hit it at 2:00. 
SOLUTION: 
This is not a problem of time in your local client host.
AWStats use only time reported in logs by your server 
and all time are related to server hour. The problem is that IIS in some foreign 
versions puts GMT time in its log file (and not local time). So, you have also 
GMT time in your statistics. 
You can wait that Microsoft change this in next IIS versions.
However, Microsoft sheet Q271196 "IIS Log File Entries Have the Incorrect Date and Time Stamp" says: 
The selected log file format is the W3C Extended Log File 
Format. The extended log file format is defined in the W3C 
Working Draft WD-logfile-960323 specification by Phillip 
M. Hallam-Baker and Brian Behlendorf. This document defines 
the Date and Time files to always be in GMT. This behavior 
is by design. 
So this means this way of working might never be changed, so another chance is to use the AWStats plugin 'timezone'.
Warning, this plugin need the perl module Time::Local and it reduces seriously AWStats speed. 
To enable the plugin, uncomment the following line in your config file. 
<table border=1 cellpadding=1 cellspacing=0 bgcolor=#F4F4F4 width="95%" class=CFAQ><tr class=CFAQ><td class=CFAQ>
LoadPlugin="timezone TZ" 
</td></tr></table>
where TZ is value of your signed timezone (+2 for Paris, -8 for ...)

<a name="GEOIPEU"></a> 
FAQ-COM320 : WHAT DOES "EU" (EUROPEAN COUNTRY)" MEAN IN GEOIP COUNTRY REPORTS ? 
PROBLEM: 
I use the <a href="awstats_contrib.html#geoip">AWStats GeoIp country plugins</a> to report countries according
to geolocalisation of IP address.
In country report, I have some visitors said to come from "eu (European country)". If this visitor
come from France, does this means it is reported twice ? 
SOLUTION: 
No. 
"eu (European country)" means we are sure that visitor come from an european country but we can't tell
wich one. It might be a major country like France, Great Britain, Spain, Germany... like a very small one. 
So, in the country report, each visitor is in one and only one group. If reported in "eu (European country)",
it is not counted in another country, and if reported in a particular country, it is not counted in "eu (European country)",
even if this country is in Europe.

<a name="OLDLOG"></a> 
FAQ-COM350 : HOW CAN I PROCESS AN OLD LOG FILE ? 
PROBLEM: 
I want to process an old log file to include its data in my AWStats reports. 
SOLUTION: 
You must change your <a href="awstats_config.html#LogFile">LogFile</a> parameter to point to the old log file and run
the update (or use the -LogFile option on command line to overwrite <a href="awstats_config.html#LogFile">LogFile</a> parameter).
The update process can only accept files in chronological order for a particular month, so if you
have already processed a recent file and forgot to run update
on a log file that contains older data, you must reset all of
your statistics (see <a href="#FAQ-COM500">FAQ-COM500</a>) and restart all of the update processes
for all past log files and in chronological order. 
However, there is a "tip" that allows you to rebuild only the month were you missed data: 
Imagine we are on 5th of July 2003, all your statistics are up to date except for the 10th of
April 2003 (you forgot to run the update process for this day, so there is no visit for this
day). You can : 
- Reset the statistics for April only (this means remove the file awstats042003.[config.]txt
as explained in <a href="#FAQ-COM500">FAQ-COM500</a>), 
- Move the statistics history files for the month after April (file awstats052003.[config.]txt,
awstats062003.[config.]txt,...) into a temp directory (so that it is no longer in the DirData
directory; as if they were deleted). 
- Run the update process on all log files for April (in chronological order). AWStats does not
complain about "too old record" because there is no history files in DirData directory
that contains compiled data more recent than records into log you process. 
- Moved back the month history files you saved into your DirData directory. 
Your statistics are up to date and the missing days are no longer missing.

<a name="MULTILOG"></a> 
FAQ-COM360 : HOW CAN I PROCESS SEVERAL LOG FILES IN ONE RUN ? 
PROBLEM: 
How can I update my statistics for several log file, in one run ? 
SOLUTION: 
A solution should be to setup your config file with something like: 
LogFile=mylog*.log 
However, with such a syntax, AWStats can't know in wich order processing log files (wich log file is the first, next or last). So
to work like this you must use the following syntax: 
<table border=1 cellpadding=1 cellspacing=0 bgcolor=#F4F4F4 width="95%" class=CFAQ><tr class=CFAQ><td class=CFAQ>
LogFile="/pathto/logresolvemerge.pl mylog*.log |" 
</td></tr></table>
 
<a href="awstats_tools.html#logresolvemerge">Logresolvemerge</a> is a tool provided with
AWStats (in tools directory) that merges several log files on the fly. It opens a pointer on each file
and sends, line by line, the oldest record from this. Using such a tool as a pipe source for AWStats <a href="awstats_config.html#LogFile">LogFile</a>
parameter is a very good solution because, it allows you to merge log files whatever their size
with no memory use, no hard disk use (no temporary files built), it is fast, it prevents
you from a bad order if your log files are not correctly ordered, etc... 
This tool can also be used to process log files from load balanced systems (see <a href="awstats_faq.html#LOADLOG">FAQ-COM400</a>)

<a name="LOADLOG"></a> 
FAQ-COM400 : HOW CAN I UPDATE MY STATISTICS WHEN I USE A LOAD BALANCING SYSTEM THAT SPLITS MY LOGS ? 
PROBLEM: 
How can I update my statistics when i use a load balancing system that split my logs ? 
SOLUTION: 
First solution is to merge all split log files resulted from all your load balanced servers into one. For this, you can use
the <a href="awstats_tools.html#logresolvemerge">logresolvemerge</a> tool provided with AWStats : 
<table border=1 cellpadding=1 cellspacing=0 bgcolor=#F4F4F4 width="95%" class=CFAQ><tr class=CFAQ><td class=CFAQ>
logresolvemerge.pl file1.log file2.log ... filen.log &gt; newfiletoprocess.log
</td></tr></table>
And setup the <a href="awstats_config.html#LogFile">LogFile</a> parameter in your config file to process the newfiletoprocess.log file or use
the -LogFile command line option to overwrite <a href="awstats_config.html#LogFile">LogFile</a> value. 
 
As an other solution, if you miss disk space, or to save time, you can ask <a href="awstats_tools.html#logresolvemerge">logresolvemerge</a>
to merge log files on the fly during the AWStats update process. For this, you can use the following syntax in your AWStats config file: 
<table border=1 cellpadding=1 cellspacing=0 bgcolor=#F4F4F4 width="95%" class=CFAQ><tr class=CFAQ><td class=CFAQ>
LogFile="/pathto/logresolvemerge.pl file*.log |" 
</td></tr></table>
 
See also <a href="awstats_faq.html#MULTILOG">FAQ-COM360</a> for explanation on logresolvemerge use.

<a name="RESET"></a> 
FAQ-COM500 : HOW CAN I RESET ALL MY STATISTICS ? 
PROBLEM: 
I want to reset all my statistics to restart the update process from the beginning. 
SOLUTION: 
All analyzed data are stored by AWStats in history files called awstatsMMYYYY.[config.]txt (one file each month).
You will find those files in directory defined by <a href="awstats_config.html#DirData">DirData</a> parameter (same directory than awstats.pl by default). 
To reset all your statistics, just delete all files awstatsMMYYYY.txt 
To reset all your statistics built for a particular config file, just delete all files awstatsMMYYYY.myconfig.txt 
Warning, if you delete those data files, you won't be able to recover your stats back, unless you
kept old log files somewhere. You will have to process all past log files (in chronological order)
to get your statistics back.

<a name="DAILY"></a> 
FAQ-COM600 : HOW CAN I COMPILE AND BUILD STATISTICS ON A DAILY BASIS ONLY ? 
PROBLEM: 
How can I compile and build statistics on a daily basis. I mean i want to have a full report
with all charts with data for a particular day only and want one report for each day of month. 
SOLUTION: 
If you use version 6.5 or higher: 
To build statistics: 
What you can do is rerun the update process by adding the parameter -databasebreak=hour or -databasebreak=day.
Providing no option is similar than using -databasebreak=month, the default and old behaviour of AWStats. 
Using this hidden option will ask AWStats to build a different database file for each break entity,
this means that several reports are done for each hour or day, depending on option used. 
To read a report: 
Add same option -databasebreak=hour or -databasebreak=day with -output option
when AWStats report is staticaly built from command line, or add &amp;databasebreak=hour or
&amp;databasebreak=day if AWStats is called as a CGI.
Also, complete options month and year used to choose month and year of report with other option
day (when databasebreak option is 'day' or 'hour') and hour (only when databasebreak is 'hour') 
So use -day=XX and/or -hour=XX when AWStats is run from command line. Use &amp;day=XX and/or &amp;hour=XX
if AWStats is called as a CGI. 
This feature is recent so may have results not completely reliable, that's why it is not yet
fully documented. 
If you use version 6.4 or older: 
This is an non documented and not supported trick, as this is not the standard way of working: 
First, run the update process at midnight (or on a log file that was rotated at midnight so that
it contains only data for this particular day (you can choose another hour in night if you want
to have days that "start" at an different hour). 
Once the update process has been ran, MOVE (and not copy) the history file built by AWStats. For
example on Unix like systems: 
mv &nbsp; mydirdata/awstatsMMYYYY.mydomain.txt &nbsp; mydirdate/awstatsDDMMYYYY.mydomain.txt 
Note that the name has been changed by adding the day. Repeat this each day after the update process. 
With this you will have one history file for each day. You can then see full stats for
a particular day by adding the non documented parameter -day=DD on command line (with others
like -month=MM and -year=YYYY). If ran from a browser you can also add &day=DD on URL. 
However, if you have full day by day statistics, you don't have anymore statistics for full month,
except if you create a second config file that whose history files would not be moved.

<a name="EDITHISTORY"></a> 
FAQ-COM700 : CAN I SAFELY REMOVE A LINE IN HISTORY FILES (awstatsMMYYYY*.txt) ? 
PROBLEM: 
After processing a log file I want to change my statistics
without running AWStats update process but changing directly data in AWStats historical database files. 
SOLUTION: 
If you remove a lines starting with "BEGIN_" or "END_", AWStats will find your file "corrupted" so you must not change those
two kinds of lines. 
You can change, add or remove any line that is in any sections but if you do this, you must
also update the MAP section (lines between BEGIN_MAP and END_MAP) because this section contains the offset in
file of each other sections for direct I/O access.
If history file is the last one, you can easily do that by removing completely the MAP section and run an update process.
Like that AWStats will rewrite the history file and the MAP section will be rewritten (MAP section is not read by
update process, only written). You do this at your own risk. The main risk is that some charts will report wrong values
or be unavailable.

<hr>

<a name="MISSINGDOLLAR"></a> 
FAQ-SET050 : ERROR "MISSING $ ON LOOP VARIABLE ..." 
PROBLEM: 
When I run awstats.pl from command line, I get: 
"Missing $ on loop variable at awstats.pl line xxx" 
SOLUTION: 
Problem is in your Perl interpreter. Try to install or reinstall a more recent/stable Perl interpreter. 
You can get new Perl version at <a href="http://www.activestate.com/ActivePerl/">ActivePerl</a> (Win32)
or <a href="http://www.perl.com/pub/language/info/software.html">Perl.com</a> (Unix/Linux/Other).

<a name="CGISOURCE"></a> 
FAQ-SET100 : I SEE PERL SCRIPT'S SOURCE INSTEAD OF ITS EXECUTION 
PROBLEM: 
When I try to execute the Perl script through the web server,
I see the Perl script's source instead of the HTML result page of its execution ! 
SOLUTION: 
This is not a problem of AWStats but a problem in your web server setup.
awstats.pl file must be in a directory defined in your web server to be a "cgi" directory,
this means, a directory configured in your web server to contain "executable" files and
not to documents files.
You have to read your web server manual to know how to setup a directory to be an
"executable cgi" directory (With IIS, you have some checkbox to check in directory
properties, with Apache you have to use the "ExecCGI" option in the directory "Directive").

<a name="SPAWNERROR"></a><a name="INTERNAL"></a> 
FAQ-SET150 : INTERNAL ERROR 500 IN MY BROWSER 
FAQ-SET200 : ERROR "... COULDN'T CREATE/SPAWN CHILD PROCESS..." 
PROBLEM: 
AWStats seems to run fine at the command prompt but when ran as a CGI from a browser, I get an "Internal Error 500". 
I also also might have the following message in my Apache error log file (or in browser with Apache 2.0+): 
...couldn't create/spawn child process: c:/mywebroot/cgi-bin/awstats.pl 
SOLUTION: 
First, try to run awstats.pl from command line to see if file is correct. If you get some
syntax errors and use a Unix like OS, check if your file is a Unix like text file (This
means each line end with a LF char and not a CR+LF char). 
If awstats.pl file runs correctly from command line, this is probably because your
web server is not able to known how to run perl scripts. This problem can occur with Apache web
servers with no internal Perl interpreter (mod_perl not active). To solve this, you must
tell Apache where is your external Perl interpreter. 
For this, you have 2 solutions: 
1) Add the following directive in your Apache httpd.conf config (or remove the # to uncomment it if line is already available) 
<table border=1 cellpadding=1 cellspacing=0 bgcolor=#F4F4F4 width="95%" class=CFAQ><tr class=CFAQ><td class=CFAQ>
ScriptInterpreterSource registry
</td></tr></table>
Then restart Apache. This will tell Apache to look into the registry to find the program associated to .pl extension. 
2) Other solution (not necessary if first solution works): Change the first line of awstats.pl file with the full path of your Perl interpreter. 
Example with Windows OS and ActivePerl Perl interpreter (installed in C:\Program Files\ActiveState\ActivePerl),
you must change the first line of awstats.pl file with: 
<table border=1 cellpadding=1 cellspacing=0 bgcolor=#F4F4F4 width="95%" class=CFAQ><tr class=CFAQ><td class=CFAQ>
#!c:/program files/activestate/activeperl/bin/perl
</td></tr></table>

<a name="CRASH"></a><a name="CRASH"></a> 
FAQ-SET220 : CRASH WHILE RUNNING AWSTATS.PL OR PAGE CONTENT ONLY PARTIALY LOADED ON WINDOWS XP 
PROBLEM: 
Sometimes my browser (Most often IE6) crash while running awstats.pl with some AWStats configuration.
With some other versions or browsers, page content is partialy loaded. 
SOLUTION: 
Problem was with WinXP and WinXPpro as documented at MS site Q317949; 
"Socket Sharing Creates Data Loss When Listen and Accept Occur on Different Processes" 
Result was that MSIE would crash or display nothing. Netscape and Opera handled the socket better but displayed the pages partially. 
The effect of the bug was more prononced as the page contents increased (above 30k). 
<a href="http://support.microsoft.com/default.aspx?scid=kb;EN-US;q317949">http://support.microsoft.com/default.aspx?scid=kb;EN-US;q317949</a> 
And also at Apache.org 
<a href="http://www.apache.org/dist/httpd/binaries/win32/">http://www.apache.org/dist/httpd/binaries/win32/</a> 
MS produced a Hotfix which is now included in SP1. 
But the best solution is to use a better web browser. Take a look at <a href="http://www.mozilla.org/products/firefox/">Firefox</a>,
one of the best and most popular web browser.

<a name="CORRUPTEDDROPPED"></a> 
FAQ-SET270 : ONLY CORRUPTED OR DROPPED RECORDS 
PROBLEM: 
After running an AWStats update process, all my records are reported to be corrupted or dropped 
SOLUTION: 
First, if you have only a small percent of corrupted or dropped records, don't worry. This
is a normal behaviour. Few corrupted or dropped records can appear in a log file because of
internal web server bug, virus attack, error writing, log purge or rotate during a writing, etc... 
However, if ALL your records are reported to be corrupted or dropped, check the following things: 
If they are all dropped, run the update process from command line adding the option -showdropped 
-> You will be able to know why a dropped record is discarded. In most cases, this is because you use a 
too large or bad filter parameter (SkipFiles, SkipHosts, OnlyFiles ...). 
If they are all corrupted, run the update process from command line adding the option -showcorrupted 
-> You will be able to know why a corrupted record is discarded. 
If this is because of the log format, check the <a href="#EMPTY_STATS">FAQ-SET350</a> about log format errors. 
If this is because the date of a record is said to be lower than date of previous, this means 
that you ran update processes on different log files without keeping the chronological order
of log files. 
If this is because the date is invalid, you might have a problem of date not computed correctly
this it happens in some Pentium4/Xeon4 processors: 
On some (few) Intel Pentium4 (also Xeon4) based host systems, log file time can not be computed
correctly. This is not an issue of AWStats itself. This error usually occurs on source-based linux
distributions (gentoo, slackware etc.), where all system libraries are compiled with CPU optimization.
AWStats is a highly developed PERL application. PERL itself relies on some system libraries,
for example GLIBC. The GLIBC library usually is buggy in this case. There is an easy way to figure
out whether the problem described here is responsible for AWStats problems on your system: 
If you have shell access to your machine, simply type the following command: 
perl -e "print int ('541234567891011165415658')" 
(NOTE: any 25-digit number works, there is no need to type this exact number) 
If everything goes fine, you should see a floating point number as output: 
5.41234567891011e+23 
In this case, please do more research on your log file formats. Your host system itself is not
responsible for the error. 
But if simply a "0" returns or some other error, this is an indication of your glibc beeing corrupt. 
ATTENTION: The only solution in this case might be to recompile your GLIBC. This can be a quite tricky
task. Please consult the documentation and F.A.Q.s of your linux distribution first!! (experts: first
check your global compile flags, eg. march=Pentium4. Trying with other compile flags can solve problem
quickly in some cases. 
NOTE: In some cases, this error might occur "suddenly", even though AWStats was already running
perfect already.

<a name="NOTSAMENUMBER"></a> 
FAQ-SET280 : ERROR "NOT SAME NUMBER OF RECORDS OF..." 
PROBLEM: 
When I run AWStats from command line (or as a cgi from a browser), I get
a message "Not same number of records of ...". 
SOLUTION: 
This means your AWStats reference database files (operating systems, browsers, robots...) are not correct.
First try to update to last version. Then check in your disk that you have only ONE of those files. They should be
in 'lib' directory ('db' with 4.0) where awstats.pl is installed: 
browsers.pm 
browsers_phone.pm 
domains.pm 
operating_systems.pm 
robots.pm 
search_engines.pm 
worms.pm 
status_http.pm 
status_smtp.pm

<a name="COULDNOTOPEN"></a> 
FAQ-SET300 : ERROR "COULDN'T OPEN FILE ..." 
PROBLEM: 
I have the following error: 
"Couldn't open file /workingpath/awstatsmmyyyy.tmp.9999: Permission denied." 
SOLUTION: 
This error means that the web server didn't succeed in writing the working temporary file (file ended by .tmp.9999 
where 9999 is a number) because of permissions problems. 
First check that the directory /workingpath has "Write" permission for 
user nobody (default user used by Apache on Linux systems) 
or user IUSR_SERVERNAME (default used user by IIS on NT). 
With Unix, try with a path with no links. 
With NT, you must check NTFS permissions ("Read/Write/Modify"), if your directory is on a NTFS partition. 
With IIS, there is also a "Write" permission attribute, defined in directory properties 
in your IIS setup, that you must check. 
With IIS, if a default cgi-bin directory was created during IIS install, try to 
put AWStats directly into this directory. 
If this still fails, you can change the DirData parameter to say AWStats 
that you want to use another directory (A directory you are sure that the default 
user, used by web server process, can write into).

<a name="MALFORMEDUTF8"></a> 
FAQ-SET320 : ERROR "MALFORMED UTF-8 CHARACTER (UNEXPECTED ..." 
PROBLEM: 
When running AWStats from command line, I get one or several lines like this
on my output: 
Malformed UTF-8 character (unexpected non-continuation byte 0x6d, immediately after start byte 0xe4) at /www/cgi-bin/lib/xxx.pm line 999.
 
SOLUTION: 
This problem appeared with RedHat 8 and Perl 5.8. 
I don't know if RedHat provides a fix for this, but some users had reported that you can
remove thoose warmless messages by changing your LANG environment variable, removing
the ".UTF-8" at the end. For example, set LANG="en_US" instead of LANG="en_US.UTF8"

<a name="EMPTY_STATS"></a> 
FAQ-SET350 : EMPTY OR NULL STATISTICS REPORTED 
PROBLEM: 
AWStats seems to work but I'm not getting any results. i get a statistics page that looks like i have no hits. 
SOLUTION: 
That's one of the most common problem you can get and there is 3 possible reasons : 
 
1) Your log file format setup might be wrong. 
If you use Apache web server 
The best way of working is to use the "combined" log format (See the <a href="awstats_setup.html">Setup and Use</a> page
to know the way to change your Apache server log from "common" log format into "combined").
Don't forget to stop Apache, reset your log file and restart Apache to make change into combined
effective. Then you must setup your AWStats config file with value <a href="awstats_config.html#LogFormat">LogFormat</a>=1. 
If you want to use another format, read the next FAQ to have examples of LogFile value according
to log files format. 
If you use IIS server or Windows built-in web server 
The Internet Information Server default W3C Extended Log Format will not work correctly with AWStats.
To make it work correctly, start the IIS Snap-in, select the web site and look at it's Properties.
Choose W3C Extended Log Format, then Properties, then the Tab Extended Properties and uncheck everything
under Extended Properties. Once they are all unchecked, check off the list given in
the <a href="awstats_setup.html">Setup and Use</a> page ("With IIS Server" chapter). 
You can also read the next FAQ to have examples of <a href="awstats_config.html#LogFormat">LogFormat</a> value according to log files format. 
 
2) You are viewing stats for a year or month when no hits was made on your server. 
When you run awstats, the reports is by default for the current month/year. 
If you want to see data for another month/year you must: 
Add -year=YYYY -month=MM on command line when building the html report page from command line. 
Use an URL like http://myserver/cgi-bin/awstats.pl?config=xxx&year=YYYY&month=MM if viewing stats with AWStats used as a CGI. 
 
3) When you read your statistics, AWStats does not use the same config file than the one
used for the update process. Scan your disk for files that match awstats.*conf and remove
all files that are not the config file(s) you need (awstats.conf files, if found, can be deleted.
It is better to use a config file called awstats.mydomain.conf).

<a name="PARTIAL_STATS"></a> 
FAQ-SET360 : STATISTICS REPORTED EXCEPT FOR OS, BROWSERS, ROBOTS AND KEYWORDS/KEYPHRASES 
PROBLEM: 
AWStats seems to report my statistics however some charts, like robots, os', browsers, search engines,
or keywords/keyphrases are empty. 
SOLUTION: 
If only robots, search engines or keywords/keyphrases are empty, this simply means your web site was not
yet visited by any robots and noone found your site using a search engines (this happens particularly
for Intranet which are not referenced on search engines).
If all of them are empty or with only unknown values, even after several updates, this probably means
that your logfile does not contains all informations, this happens with Apache when using the
standard "common" log format instead of the standard "combined" log format. 
You may also use LogFormat=4 into your AWStats config files instead of 1. 
Read AWStats setup documentation to known how to setup your Apache Web server to report logs in
a "combined" log format then set <a href="awstats_config.html#LogFormat">LogFormat</a>=1 into your
AWStats config file.

<a name="REDIRECT"></a> 
FAQ-SET400 : PIPE REDIRECTION TO A FILE GIVE ME AN EMPTY FILE 
PROBLEM: 
I want to redirect awstats.pl output to a file with the following command : 
&gt;awstats.pl -config=... [other_options] > myfile.html 
But myfile.html is empty (size is 0). If i remove the redirection, everythings works correctly. 
SOLUTION: 
This is not an AWStats bug but a problem between Perl and Windows. 
You can easily solve this running the following command instead: 
<table border=1 cellpadding=1 cellspacing=0 bgcolor=#F4F4F4 width="95%" class=CFAQ><tr class=CFAQ><td class=CFAQ>
perl awstats.pl -config=... [other_options] > myfile.html
</td></tr></table>

<a name="NO_ICON"></a> 
FAQ-SET450 : NO PICTURES/GRAPHICS SHOWN 
PROBLEM: 
AWStats seems to work (all data and counters seem to be good) but I have no image shown. 
SOLUTION: 
With Apache web server, you might have troubles (no picture shown on stats page) if you use a directory called "icons" (because of Apache
pre-defined "icons" alias directory), so use instead, for example, a directory called "icon" with
no s at the end (Rename your directory physically and change the <a href="awstats_config.html#DirIcons">DirIcons</a> parameter in config file
to reflect this change).

<a name="MIGRATEDOUBLED"></a> 
FAQ-SET700 : MY VISITS ARE DOUBLED FOR OLD MONTH I MIGRATED FROM 3.2 TO 5.X 
PROBLEM: 
After having migrated an old history file for a month, the number of visits for this month is doubled.
So the number of "visits per visitor" is also doubled and "pages per visit" and "hits per visit" is divided by 2.
All other data like "pages", "hits" and bandwith are correct. 
SOLUTION: 
This problem occurs when migrating history files from 3.2 to 5.x. 
To fix this you can use the following tip (warning, do this only after migrating from
3.2 to 5.x and if your visit value is doubled). The goal is to remove the line
in history file that looks like this 
YYYYMM00 999 999 999 999 
where YYYY and MM are year and month of config file and 999 are numerical values. 
 
So if your OS is Unix/Linux 

<table border=1 cellpadding=1 cellspacing=0 bgcolor=#F4F4F4 width="95%" class=CFAQ><tr class=CFAQ><td class=CFAQ>
grep -vE '^[0-9]{6}00' oldhistoryfile > newhistoryfile 
mv newhistoryfile oldhistoryfile 
</td></tr></table>

And then run the migrate process again on the file. 
 
If your OS is windows and got cygwin 
You must follow same instructions than if OS is Unix/Linux BUT
you must do this from a cygwin 'sh' shell and not from the DOS
prompt (because the ^ is not understanded by DOS). 
And then run the migrate process again on the file. 
 
In any other case (in fact works for every OS) 
You must remove manually the line YYYYMM00 999 999 999 999 (must find one and only
one such line) and then run the migrate process again on the file.

<a name="OUTOFMEMORYCYGWIN"></a> 
FAQ-SET750 : AWSTATS RUN OUT OF MEMORY DURING UPDATE PROCESS WITH CYGWIN PERL 
PROBLEM: 
When I run the update process on a large log file with cygwin Perl, AWStats run out of memory
but I am sure that I have enough memory to run AWStats according to the 'memory' column in
benchmark chart available in AWStats documentation (<a href="awstats_benchmark.html">benchmark page</a>). 
SOLUTION: 
It might be a limit inside Cygwin Perl.
Try to increase the Cygwin parameter heap_chunk_in_mb.

<a name="SPEED"></a> 
FAQ-SET800 : AWSTATS SPEED/TIMEOUT PROBLEMS ? 
PROBLEM: 
When I analyze large log files, processing times are very important (Example: update process from a browser
returns a timeout/internal error after a long wait).
Is there a setup or things to do to avoid this and increase speed ? 
SOLUTION: 
You really need to understand how a log analyzer works to have good speed.
There is also major setup changes you can do to decrease your processing time. 
See <a href="awstats_benchmark.html#ADVICES">important advices</a> in benchmark page.

<hr>

<a name="CSSATTACK"></a> 
FAQ-SEC100 : CAN AWSTATS BE USED TO MAKE CROSS SITE SCRIPTING ATTACKS ? 
PROBLEM: 
If a bad user use a browser to make a hit on an URL that include a < SCRIPT > ... < /SCRIPT >
section in its parameter, when AWStats will show the links on the report page, does the script will be executed ? 
SOLUTION: 
No. AWStats use a filter to remove all scripts codes that was included in an URL to make a Cross Site Scripting Attack using a
log analyzer report page.

<a name="SECUSER"></a> 
FAQ-SEC150 : HOW CAN I PREVENT SOME USERS TO SEE STATISTICS OF OTHER USERS ? 
PROBLEM: 
I don't want a user xxx (having a site www.xxx.com) to see statistics of user yyy (having
a site www.yyy.com). How can i setup AWStats for this ? 
SOLUTION: 
Take a look at the <a href="awstats_security.html">security page</a>.

<a name="WORMS"></a> 
FAQ-SEC200 : HOW TO MANAGE LOG FILES (AND STATISTICS) CORRUPTED BY 'WORMS' ATTACKS ? 
PROBLEM: 
My site is attacked by some worms viruses (like Nimba, Code Red...). This make my log file corrupted
and full of 404 errors. So my statistics are also full of 404 errors. This make AWStats slower and my history files very large.
Can I do something to avoid this ? 
SOLUTION: 
Yes. 
'Worms' attacks are infected browsers, robots or server changed into web client that make hits on your site using a very long
unknown URL like this one: 
/default.ida?XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX%40%50...%40%50 
URL is generated by the infected robot and the purpose is to exploit a vulnerability of the web server (In most cases, only IIS is vulnerable).
With such attacks, you will will always find a 'common string' in those URLs.
For example, with Code Red worm, there is always default.ida in the URL string. Some other worms send URLs with cmd.exe in it. 
With 6.0 version and higher, you can set the <a href="awstats_config.html#LevelFor">LevelForWormsDetection</a>
parameter to "2" and <a href="awstats_config.html#Show">ShowWormsStats</a> to "HBL" in 
config file to enable the worm filtering nd reporting. 
However, this feature reduce seriously AWStats speed and the worms database (lib/worms.pm file) can't contain
all worms signatures. So if you still have rubish hits, you can modify the worms.pm file yourself or
edit your config file to add in the <a href="awstats_config.html#SkipFiles">SkipFiles</a> parameter some
values to discard the not required records, using a regex syntax like example : 
<table border=1 cellpadding=1 cellspacing=0 bgcolor=#F4F4F4 width="95%" class=CFAQ><tr class=CFAQ><td class=CFAQ>
SkipFiles="REGEX[^\/default\.ida] REGEX[\/winnt\/system32\/cmd\.exe]" 
</td></tr></table>

<hr>

<div class="htmldoc-ignore">

Article written by <a href="https://plus.google.com/+LaurentDestailleur-Open-Source-Expert?rel=author" rel="author" style="color: #ccc; font-weight: normal;">Laurent Destailleur</a>. 
 
<script type="text/javascript" src="https://apis.google.com/js/plusone.js"></script>
<g:plusone></g:plusone>

<div id="fb-root"></div>
<script>(function(d, s, id) {
 var js, fjs = d.getElementsByTagName(s)[0];
 if (d.getElementById(id)) return;
 js = d.createElement(s); js.id = id;
 js.src = "//connect.facebook.net/fr_FR/all.js#xfbml=1";
 fjs.parentNode.insertBefore(js, fjs);
}(document, 'script', 'facebook-jssdk'));</script>
<div class="fb-like" data-href="http://www.awstats.org/docs/awstats_faq.html" data-layout="button_count" data-action="recommend" data-show-faces="false" data-share="true"></div>
 

<a href="https://twitter.com/awstats_project" class="twitter-follow-button" data-show-count="false">Follow @awstats_project</a>
<script>!function(d,s,id){var js,fjs=d.getElementsByTagName(s)[0],p=/^http:/.test(d.location)?'http':'https';if(!d.getElementById(id)){js=d.createElement(s);js.id=id;js.src=p+'://platform.twitter.com/widgets.js';fjs.parentNode.insertBefore(js,fjs);}}(document, 'script', 'twitter-wjs');</script>
</div>

</body>
</html>

${this.title}

Code Editor : awstats_faq.html