Apache2Triad Help, Support and Development Forum Index Search Profile Log in to check your private messages Log in Register Memberlist Attachments Statistics Crew/Ranks Archive
 Awstats and error: combined log format .:Solved:.
Google
Post new topic Reply to topic
Author Message
Slo
 
 


Joined: 22 Mar 2005
Posts: 42
Location: New Jersey USA

PostPosted: Mon May 02, 2005 5:44 am Reply with quoteBack to top

Awstats will not work at all if I set "logformat to 1" in awstats/mydomain.com. conf,,it will work if I set it to 4,but awstats does not give info like referers and bot lists while set at 4... Awstats acknowledges this and says use logformat 1...

when I use logformat 1 I get this error


Quote:

AWStats did not find any valid log lines that match your LogFormat parameter, in the 50th first non commented lines read of your log.
Your log file D:\apache2triad\logs\access.log must have a bad format or LogFormat parameter setup does not match this format.

Your AWStats LogFormat parameter is: 1
This means each line in your web server log file need to have "combined log format" like this:
111.22.33.44 - - [10/Jan/2001:02:14:14 +0200] "GET / HTTP/1.1" 200 1234 "http://www.fromserver.com/from.htm" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)"

And this is an example of records AWStats found in your log file (the record number 50 in your log):
127.0.0.1 - root [02/May/2005:00:47:07 -0400] "GET /awstats/icon/other/vh.png HTTP/1.1" 304 -


Setup ('D:/apache2triad/htdocs/awstats/awstats.themoddepot.com.conf' file, web server or permissions) may be wrong.
Check config file, permissions and AWStats documentation (in 'docs' directory).




here is a snipit from my httpd.conf and as far as I can tell it is set right... customLog is set to combined???


Quote:
# The following directives define some format nicknames for use with
# a CustomLog directive (see below).
#
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
LogFormat "%h %l %u %t \"%r\" %>s %b" common
LogFormat "%{Referer}i -> %U" referer
LogFormat "%{User-agent}i" agent

# You need to enable mod_logio.c to use %I and %O
#LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %I %O" combinedio

#
# The location and format of the access logfile (Common Logfile Format).
# If you do not define any access logfiles within a <VirtualHost>
# container, they will be logged here. Contrariwise, if you *do*
# define per-<VirtualHost> access logfiles, transactions will be
# logged therein and *not* in this file.
#
#CustomLog logs/access.log combined

#
# If you would like to have agent and referer logfiles, uncomment the
# following directives.
#
#CustomLog logs/referer.log referer
#CustomLog logs/agent.log agent

#
# If you prefer a single logfile with access, agent, and referer information
# (Combined Logfile Format) you can use the following directive.
#
CustomLog logs/access.log combined

#


Here is a snipit of my access.log as you can see it is not written in combined format so awstats error is right... what I conclude here is that either I don't know how to fully set up a combined log or something is borked...

Quote:
127.0.0.1 - root [02/May/2005:00:47:16 -0400] "GET /awstats/icon/other/hh.png HTTP/1.1" 304 -
127.0.0.1 - root [02/May/2005:00:47:16 -0400] "GET /awstats/icon/other/hp.png HTTP/1.1" 304 -
127.0.0.1 - root [02/May/2005:00:47:16 -0400] "GET /awstats/icon/flags/ip.png HTTP/1.1" 304 -
127.0.0.1 - root [02/May/2005:00:47:16 -0400] "GET /awstats/icon/flags/de.png HTTP/1.1" 304 -
127.0.0.1 - root [02/May/2005:00:47:16 -0400] "GET /awstats/icon/flags/net.png HTTP/1.1" 304 -
127.0.0.1 - root [02/May/2005:00:47:16 -0400] "GET /awstats/icon/flags/ca.png HTTP/1.1" 304 -
127.0.0.1 - root [02/May/2005:00:47:16 -0400] "GET /awstats/icon/flags/edu.png HTTP/1.1" 304 -
127.0.0.1 - root [02/May/2005:00:47:16 -0400] "GET /awstats/icon/flags/nl.png HTTP/1.1" 304 -
127.0.0.1 - root [02/May/2005:00:47:16 -0400] "GET /awstats/icon/flags/com.png HTTP/1.1" 304 -
127.0.0.1 - root [02/May/2005:00:47:16 -0400] "GET /awstats/icon/mime/image.png HTTP/1.1" 304 -
127.0.0.1 - root [02/May/2005:00:47:16 -0400] "GET /awstats/icon/mime/notavailable.png HTTP/1.1" 304 -
127.0.0.1 - root [02/May/2005:00:47:17 -0400] "GET /awstats/icon/mime/other.png HTTP/1.1" 304 -
127.0.0.1 - root [02/May/2005:00:47:17 -0400] "GET /awstats/icon/mime/html.png HTTP/1.1" 304 -
127.0.0.1 - root [02/May/2005:00:47:17 -0400] "GET /awstats/icon/mime/script.png HTTP/1.1" 304 -
127.0.0.1 - root [02/May/2005:00:47:17 -0400] "GET /awstats/icon/mime/video.png HTTP/1.1" 304 -
127.0.0.1 - root [02/May/2005:00:47:17 -0400] "GET /awstats/icon/mime/audio.png HTTP/1.1" 304 -
127.0.0.1 - root [02/May/2005:00:47:17 -0400] "GET /awstats/icon/other/he.png HTTP/1.1" 304 -
127.0.0.1 - root [02/May/2005:00:47:17 -0400] "GET /awstats/icon/other/hx.png HTTP/1.1" 304 -
127.0.0.1 - root [02/May/2005:00:47:17 -0400] "GET /awstats/icon/os/unknown.png HTTP/1.1" 304 -
127.0.0.1 - root [02/May/2005:00:47:17 -0400] "GET /awstats/icon/browser/unknown.png HTTP/1.1" 304 -
127.0.0.1 - root [02/May/2005:00:47:22 -0400] "GET /awstats/awstats.cgi?month=05&year=2005&config=themoddepot.com&framename=mainright&output=allrobots HTTP/1.1" 200 6336
127.0.0.1 - root [02/May/2005:00:47:22 -0400] "GET /awstats/awstats_bw.css HTTP/1.1" 304 -
127.0.0.1 - root [02/May/2005:00:47:22 -0400] "GET /awstats/icon/other/awstats_logo6.png HTTP/1.1" 304 -
127.0.0.1 - - [02/May/2005:00:47:22 -0400] "GET /awstatsicons/other/button.gif HTTP/1.1" 404 1527
127.0.0.1 - root [02/May/2005:00:47:29 -0400] "GET /awstats/awstats.cgi?month=05&year=2005&output=allrobots&config=themoddepot.com&framename=index HTTP/1.1" 200 1113
127.0.0.1 - root [02/May/2005:00:47:29 -0400] "GET /awstats/awstats.cgi?month=05&year=2005&output=allrobots&config=themoddepot.com&framename=mainleft HTTP/1.1" 200 10902
127.0.0.1 - root [02/May/2005:00:47:30 -0400] "GET /awstats/awstats_bw.css HTTP/1.1" 304 -
127.0.0.1 - root [02/May/2005:00:47:30 -0400] "GET /awstats/icon/other/page.png HTTP/1.1" 304 -
127.0.0.1 - root [02/May/2005:00:47:29 -0400] "GET /awstats/awstats.cgi?month=05&year=2005&output=allrobots&config=themoddepot.com&framename=mainright HTTP/1.1" 200 6336
127.0.0.1 - root [02/May/2005:00:47:30 -0400] "GET /awstats/awstats_bw.css HTTP/1.1" 304 -
127.0.0.1 - root [02/May/2005:00:47:30 -0400] "GET /awstats/icon/other/awstats_logo6.png HTTP/1.1" 304 -
127.0.0.1 - - [02/May/2005:00:47:30 -0400] "GET /awstatsicons/other/button.gif HTTP/1.1" 404 1527
127.0.0.1 - root [02/May/2005:00:47:37 -0400] "GET /awstats/awstats.cgi?month=05&year=2005&config=themoddepot.com&framename=mainright&output=allhosts HTTP/1.1" 200 16522
127.0.0.1 - root [02/May/2005:00:47:38 -0400] "GET /awstats/awstats_bw.css HTTP/1.1" 304 -
127.0.0.1 - root [02/May/2005:00:47:38 -0400] "GET /awstats/icon/other/awstats_logo6.png HTTP/1.1" 304 -
127.0.0.1 - - [02/May/2005:00:47:38 -0400] "GET /awstatsicons/other/button.gif HTTP/1.1" 404 1525




Anyone have this problem???

1.5.2

Thanks

Slo...\



EDIT: OK here's the hairy part... I just checked my whole access.log and found that in the begining when I installed 1.5.2 on the 18th the access.log was written in combined form... Strange thing is it stopped writing right at my first hack attempt...

see: http://apache2triad.net/forums/viewtopic.php?t=3485

here is the point it stopped... I don't want to reinstall,but if I have to I will...

snipit of where it stopped combined format..

Quote:
HTTP/1.1" 304 - "http://localhost/uebimiau/index.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Maxthon)"
127.0.0.1 - - [18/Apr/2005:11:30:39 -0400] "GET /uebimiau/images/logo.gif HTTP/1.1" 304 - "http://localhost/uebimiau/index.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Maxthon)"
127.0.0.1 - - [18/Apr/2005:11:30:39 -0400] "GET /favicon.ico HTTP/1.1" 404 1205 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Maxthon)"
127.0.0.1 - - [18/Apr/2005:11:30:41 -0400] "POST /uebimiau/process.php HTTP/1.1" 200 788 "http://localhost/uebimiau/index.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Maxthon)"
127.0.0.1 - - [18/Apr/2005:11:30:56 -0400] "GET /favicon.ico HTTP/1.1" 404 1205 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Maxthon)"
127.0.0.1 - - [18/Apr/2005:11:31:23 -0400] "GET /uebimiau/index.php HTTP/1.1" 200 3699 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Maxthon)"
127.0.0.1 - - [18/Apr/2005:11:31:23 -0400] "GET /uebimiau/themes/default/webmail.css HTTP/1.1" 304 - "http://localhost/uebimiau/index.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Maxthon)"
127.0.0.1 - - [18/Apr/2005:11:31:23 -0400] "GET /uebimiau/images/logo.gif HTTP/1.1" 304 - "http://localhost/uebimiau/index.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Maxthon)"
127.0.0.1 - - [18/Apr/2005:11:31:23 -0400] "GET /favicon.ico HTTP/1.1" 404 1205 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Maxthon)"
127.0.0.1 - - [18/Apr/2005:11:31:26 -0400] "POST /uebimiau/process.php HTTP/1.1" 200 788 "http://localhost/uebimiau/index.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Maxthon)"
127.0.0.1 - - [18/Apr/2005:11:31:41 -0400] "GET /favicon.ico HTTP/1.1" 404 1205 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Maxthon)"
68.38.154.240 - - [18/Apr/2005:11:55:39 -0400] "GET /scripts/root.exe?/c+dir HTTP/1.0" 404 1199 "-" "-"
68.38.154.240 - - [18/Apr/2005:11:55:40 -0400] "GET /MSADC/root.exe?/c+dir HTTP/1.0" 404 1199 "-" "-"
68.38.154.240 - - [18/Apr/2005:11:55:40 -0400] "GET /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 1199 "-" "-"
68.38.154.240 - - [18/Apr/2005:11:55:40 -0400] "GET /d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 1199 "-" "-"
68.38.154.240 - - [18/Apr/2005:11:55:41 -0400] "GET /scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 1199 "-" "-"
68.38.154.240 - - [18/Apr/2005:11:55:41 -0400] "GET /_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 1199 "-" "-"
68.38.154.240 - - [18/Apr/2005:11:55:41 -0400] "GET /_mem_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 1199 "-" "-"
68.38.154.240 - - [18/Apr/2005:11:55:42 -0400] "GET /msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c1%1c../..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 1199 "-" "-"
68.38.154.240 - - [18/Apr/2005:11:55:42 -0400] "GET /scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 1199 "-" "-"
68.38.154.240 - - [18/Apr/2005:11:55:42 -0400] "GET /scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 1199 "-" "-"


Last edited by Slo on Wed May 04, 2005 4:38 am; edited 2 times in total
View user's profileSend private messageMSN Messenger
LiquidSnake
past contributor
past contributor


Joined: 23 May 2004
Posts: 267
Location: Middlesboro, KY

PostPosted: Mon May 02, 2005 8:00 pm Reply with quoteBack to top

remove the combined part from the log? or simply stop apache and delete the file ... I may be misunderstanding you though. do you want combined log?
View user's profileSend private messageSend e-mailYahoo Messenger
Slo
 
 


Joined: 22 Mar 2005
Posts: 42
Location: New Jersey USA

PostPosted: Tue May 03, 2005 2:50 am Reply with quoteBack to top

Yes I want combined log.... Awstats does not log referers or bots in the stats while in common log... I reinstalled everything today and the combined log worked briefly then went to common log on it's own again... I don't know what is making it change as I have it set to combined...

The default in A2T is combined so I ask all how is your log/access.log being written???

Like this---

111.22.33.44 - - [10/Jan/2001:02:14:14 +0200] "GET / HTTP/1.1" 200 1234 "http://www.fromserver.com/from.htm" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)"


or

like this with no browser being logged???

127.0.0.1 - root [02/May/2005:00:47:07 -0400] "GET /awstats/icon/other/vh.png HTTP/1.1" 304 -



Thanks...


Slo...
View user's profileSend private messageMSN Messenger
Vlad Alexa Mancini
lead developer
lead developer


Joined: 07 Jul 2003
Posts: 1539

PostPosted: Tue May 03, 2005 7:42 am Reply with quoteBack to top

conf\httpd.conf wrote:
CustomLog logs/access.log combined


htdocs\awstats\awstats.localhost.conf wrote:
LogFile="C:\apache2triadpath\logs\access.log"


as you can see the default is a combined log for both apache and awstats
what is your problem ?
View user's profileSend private message
Slo
 
 


Joined: 22 Mar 2005
Posts: 42
Location: New Jersey USA

PostPosted: Tue May 03, 2005 3:53 pm Reply with quoteBack to top

My specific problem is that the access.log that awstats reads from is in common form although it is set to combined form in conf\httpd.conf...

recent access.log
Quote:
80.41.243.230 - - [03/May/2005:11:27:37 -0400] "GET /Ebay/drives/52-755-05-2.jpg HTTP/1.1" 200 120237
80.108.9.71 - - [03/May/2005:11:27:37 -0400] "GET /Known_Mods_2/I-DO-IT-FOR-YOU.MOD? HTTP/1.1" 200 140523
65.240.136.210 - - [03/May/2005:11:31:02 -0400] "GET /Ebay/drives/52-755-05-2.jpg HTTP/1.1" 200 120237
65.240.136.210 - - [03/May/2005:11:31:07 -0400] "GET /cgi-bin/COUNTS20/counts.exe?link=Mdrive&loghost=on&style=E&ref=reference HTTP/1.1" 200 553
65.240.136.210 - - [03/May/2005:11:31:02 -0400] "GET /Ebay/drives/52-755-05.jpg HTTP/1.1"



EDIT: Below is a screen cap of awstats browser and OS stats... They are unknown cause access.log is not revealing them as it should... In other words: in combined form the browser of the client machine is recorded to the logs/access.log, if it is not recorded,,Awstats does not know it hence "Unknown"...



I am not trying to be an ass here,i am just interested in seeing all the info in awstats... I want to make sure I am understood cause I often am not,as this thread can attest to...

Thanks

Slo...
View user's profileSend private messageMSN Messenger
LiquidSnake
past contributor
past contributor


Joined: 23 May 2004
Posts: 267
Location: Middlesboro, KY

PostPosted: Tue May 03, 2005 11:51 pm Reply with quoteBack to top

Quote:
it will work if I set it to 4,but awstats does not give info like referers and bot lists while set at 4.



Quote:
# 4 - Apache or Squid native common log format (NCSA common/CLF log format)
# With LogFormat=4, some features (browsers, os, keywords...) can't work.


apache2triad is set up by defualt to do what you want.....

as far as as your log 'briefly' switching back and forth, well that would be an apache problem, you should check apache's website for more info.

did you try clearing the log like I suggested??? I had serious problems once before with awstats, the cause was 2 different log formats in the access.log


my log entries are like this:

Quote:
XX.XX.XX.XX - - [25/Mar/2005:20:23:36 -0500] "GET / HTTP/1.1" 200 1634 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)"


Quote:
Strange thing is it stopped writing right at my first hack attempt...


what do you mean your first hack attempt?
View user's profileSend private messageSend e-mailYahoo Messenger
Slo
 
 


Joined: 22 Mar 2005
Posts: 42
Location: New Jersey USA

PostPosted: Wed May 04, 2005 1:10 am Reply with quoteBack to top

Quote:

apache2triad is set up by defualt to do what you want.....


Yes I know...

Quote:
as far as as your log 'briefly' switching back and forth, well that would be an apache problem, you should check apache's website for more info.

I have been searhing apache's site for days and can't find the bug or cure... I realize it is probably a Apache problem...

The logs don't switch back and forth per say they switch to common log format and never switch back...


Quote:
did you try clearing the log like I suggested???

yes and I even reinstalled A2T and started with a new access.log,but after a few entries it reverted to common log just as before...



Quote:
Strange thing is it stopped writing right at my first hack attempt...


Quote:
what do you mean your first hack attempt



This explains it

http://apache2triad.net/forums/viewtopic.php?t=3485

,but it is just a coincidence because my access.log reverted to common on the new install too...

I found this thread and the same problem existed for this dude... the default as we determined is combined log format but this person has the same problem his logs are common...

http://apache2triad.net/forums/viewtopic.php?t=1590&highlight=awstats



EDIT:Embarassed Embarassed Embarassed

I found what the problem was... In the virtual host setup I followed the example
Code:
#<VirtualHost *>
#    ServerAdmin webmaster@dummy-host.example.com
#    DocumentRoot /www/docs/dummy-host.example.com
#    ServerName dummy-host.example.com
#    ErrorLog logs/dummy-host.example.com-error_log
#    CustomLog logs/dummy-host.example.com-access_log common
#</VirtualHost>


As you can see common is set in the custom logs and me not knowing WTF it meant at the time just used it...

Sorry,
Slo...
View user's profileSend private messageMSN Messenger
LiquidSnake
past contributor
past contributor


Joined: 23 May 2004
Posts: 267
Location: Middlesboro, KY

PostPosted: Wed May 04, 2005 9:53 pm Reply with quoteBack to top

Yep that will do it everytime .... Thats why it is important to know *every* detail when troubleshooting.... Anyways, glad you got it fixed
View user's profileSend private messageSend e-mailYahoo Messenger
clapp528
 
 


Joined: 16 Jul 2004
Posts: 19

PostPosted: Thu May 05, 2005 3:28 pm Reply with quoteBack to top

how did you fix it?

just by changing where it says common to combined?
View user's profileSend private message
Slo
 
 


Joined: 22 Mar 2005
Posts: 42
Location: New Jersey USA

PostPosted: Thu May 05, 2005 4:37 pm Reply with quoteBack to top

clapp528 wrote:
how did you fix it?

just by changing where it says common to combined?


Yes

This is what I had:
Code:
<VirtualHost *>
    ServerAdmin me@MyDomain.com
    DocumentRoot D:/apache2triad/htdocs
    ServerName themoddepot.com
    ErrorLog logs/error.log
    CustomLog logs/access.log common
</VirtualHost>


This is what I changed it to:
Code:
<VirtualHost *>
    ServerAdmin me@MyDomain.com
    DocumentRoot D:/apache2triad/htdocs
    ServerName themoddepot.com
    ErrorLog logs/error.log
    CustomLog logs/access.log combined
</VirtualHost>


Last edited by Slo on Fri May 06, 2005 2:36 pm; edited 1 time in total
View user's profileSend private messageMSN Messenger
clapp528
 
 


Joined: 16 Jul 2004
Posts: 19

PostPosted: Thu May 05, 2005 5:19 pm Reply with quoteBack to top

ok did that.. should i go in and clean out the logs/access.log ?
View user's profileSend private message
Slo
 
 


Joined: 22 Mar 2005
Posts: 42
Location: New Jersey USA

PostPosted: Thu May 05, 2005 5:22 pm Reply with quoteBack to top

clapp528 wrote:
ok did that.. should i go in and clean out the logs/access.log ?


Yes,,, because awstats is going by line 50 when determining the log format...
View user's profileSend private messageMSN Messenger
clapp528
 
 


Joined: 16 Jul 2004
Posts: 19

PostPosted: Fri May 06, 2005 1:56 pm Reply with quoteBack to top

Thanks guys.. the suggestions that you gave me worked
View user's profileSend private message
Display posts from previous:      
Post new topic Reply to topic


 Jump to:   



View next topic
View previous topic
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You cannot download files in this forum
Powered by phpBB © 2001, 2002 phpBB Group :: FI Theme
All times are GMT