Analyzing IIS6 Web Logs With AWStats Page 2

AWStats’ Structure

You control AWStats by creating or (more often) altering configuration files. A configuration file is a text file with a .conf extension that contains information about a Web site’s logs. You must create a configuration file for each Web site you want to analyze.

You should name your configuration files using the naming pattern awstats.CONFIGNAME.conf, where “CONFIGNAME” is variable and is the name of the configuration you want to create. You can later refer to specific configuration files using that variable name. For example, when you instruct AWStats to apply a “CONFIGNAME” configuration, it will look for a file named awstats.CONFIGNAME.conf in the bin folder.

A configuration file can “include” options defined in another file, so it’s best to create a base/general configuration file that contains the standard options you want to apply to all reports, and then define a specific file for each Web site. The site-specific file contains information such as where the logs to analyze are, how to process them for this site, and so on. Extracting the standard options into a separate general file and then including that in the site-specific files simplifies managing a hosting environment where you want to analyze data for many Web sites.

AWStats comes with a template configuration called awstats.model.conf that you can use to create new files (you can find it in the wwwrootcgi-bin folder from the installation).

Put all .conf files in the bin folder you created earlier.

IIS Logs

IIS 6 can record data in either log files or database tables; the precise fields it records are configurable. To use IIS6 with AWStats, you need to make sure that IIS6 logging is turned on, that it’s saving data to log files, and you need to specify which data fields to collect and how to write them. You can control these options from the IIS MMC snap-in management application, editing the log properties for a specific Web site or for all Web sites simultaneously. You can launch the IIS MMC through Control Panel by double-clicking the Administrative Tools item, and then Internet Information Services

After launching the IIS MMC:

• Enable extended logging capabilities by checking the “Enable logging” option.
• Accept the default “W3C Extended Log File Format” option.
• Next, click the Properties button to edit the logging options.
• Set up a log schedule (I suggest monthly, because that schedule makes it easy to manage through AWStats configuration). Check the “Use local time for file naming and rollover” option; however note that doing so doesn’t change the way IIS records time values in the log but only how it manages files.
• Select a log file folder (I suggest moving the logs to a different one than the default, so you can have a simple log storage path for all your Web sites).
• Set the fields that IIS will log. To do that, select the Advanced tab, and check only these options: date, time, client IP, user name, method, URI stem, URI query, protocol status, bytes sent, protocol version, user agent, and referrer. Check your selections, because AWStats log analysis depends on having the correct format.

Finally, if there’s an existing and active log file for your Web sites, delete (or rename) it, which will force IIS to create a new one and begin filling it using the new format. If you cannot access this file because IIS is using it, restart IIS by entering iisreset.exe at a command prompt.

Configuration Profiles

It’s best to edit AWStats configuration files using WordPad (not Notepad or another Windows text editor), because the provided templates are in a Unix file format, which uses a single line feed (LF) character for line endings rather than a carriage return/line feed (CR/LF) character pair as Windows does, so it’s not easy mange them with Notepad). A typical configuration file for a Web site might look like the following (note that I’ve removed all AWStats’ template notes, but you can find them included in the downloadable code).

   Include "awstats.common.conf"
   LogFile="E:LogsWebW3SVC529796009ex%YY-0%MM-0.log"
   SiteDomain="www.website.com"
   HostAliases="www.website.com"

These files tell AWStats to look for IIS log files in a specific directory. By default, IIS dynamically creates file names using an exYYMM.log pattern. For example, for November 2005, IIS would use a file named ex0511.log. You can refer to the AWStats documentation to check supported patterns.

The included file awstats.common.conf is the “base” file discussed above that you can use to manage all shared configuration options. You’ll “include” this file with more specific configurations. Create the file as a copy of the awstats.model.conf template provided with the AWStats installation. You can leave all options as defined in this template, remove all “include” commands, and overwrite the following entries:

   LogFormat="date time cs-method cs-uri-stem cs-uri-query 
      cs-username c-ip cs-version cs(User-Agent) cs(Referer) 
      sc-status sc-bytes"
   
   DirData="E:myAppsawstats-6.4bindirdata"
   
   DirIcons="icon"
   
   Logo="logo_huge.gif"
   LogoLink="http://www.huge.it"
   
   LoadPlugin="timezone +1"

In the preceding code, the LogFormat option is one of the most important options. Logformat=2, the default option for IIS logs, does not work on IIS 6 because that option records data with an order that AWStats doesn’t recognize. Instead, you must explicitly specify the correct parameters as shown above. The pattern I provided works well on IIS 6, so you can simply cut and paste it.

DirData is the working folder for AWStats that you can define on your system. AWStats will save its working file (databases on statistics) in this folder. Although you can change it to whatever you like, the example uses the bindirData folder you created during the installation.

DirIcons is the folder that contains all graphic files used to create reports.

Logo defines the file name of the logo to publish on the reports (typically your company logo), and LogoLink defines the URL for the image. In this case, you may put the logo file in the biniconothers folder. You can leave the standard configuration values for experimentation purposes, but you should be aware that you can create reports with a custom logo.

The LoadPlugin timezone option tells AWStats to “correct” time values found in log files. IIS records data using Greenwich Meridian time, so, if you want your reports to be based on your local time zone, you have to correct the values from the logs. For example, “timezone +1” adds 1 hour to time values recorded by IIS (+1 is Italy’s time zone, so with this setting I can read reports with results based on my local time). While AWStats manages time zone adjustment using this setting, it doesn’t correct for daylight savings time, so you must manually update this value for daylight savings time changes.

>> Running AWStats

This article was originally published on DevX.com.