AWStats Documentation - FAQs
Description: AWStats Documentation - FAQ page
Keywords: awstats, awstat, faq, error, errors, frequently, asked, questions, support, help, problem, solution, troubleshooting, rotate log

| AWStats logfile analyzer 5.3 Documentation |

# Frequently Asked Questions + Troubleshooting

ABOUT QUESTIONS:

FAQ-ABO100 Which server log files or operating systems are supported ?
FAQ-ABO150 Which log format can AWStats analyze ?
FAQ-ABO200 Which languages are available ?
FAQ-ABO250 Can AWStats be integrated with PHP Nuke ?

SETUP or ERROR QUESTIONS:
Here, you can find the most common questions and answers users have to install/setup AWStats.

FAQ-SET025 How to use AWStats with no server log
FAQ-SET050 Error "Missing $ on loop variable ..."
FAQ-SET100 I see Perl script's source instead of its execution in my browser.
FAQ-SET150 Error "...couldn't create/spawn child process..." with Apache for windows.
FAQ-SET200 "Internal Error" or "Error 500" in a browser connecting to Apache.
FAQ-SET210 "Internal Error" after a long time in my browser (See FAQ-COM100 "AWStats speed/timeout problems").
FAQ-SET220 Crash while running awstats.pl or page content only partialy loaded
FAQ-SET250 Log format setup or errors.
FAQ-SET260 Setup for FTP server log files.
FAQ-SET270 Setup for MAIL log files (Sendmail, Postfix, Exchange).
FAQ-SET272 Setup for WINDOWS MEDIA SERVER log files.
FAQ-SET280 Error "Not same number of records of...".
FAQ-SET300 Error "Couldn't open file ..."
FAQ-SET350 Empty or null statistics reported.
FAQ-SET400 Pipe redirection to a file give me an empty file.
FAQ-SET450 No pictures/graphics shown.
FAQ-SET500 How to rotate my logs without loosing data.
FAQ-SET550 How to run AWStats frequently ?
FAQ-SET600 How to exclude my IP address (or whole subnet mask) from stats ?
FAQ-SET700 My visits are doubled for old month I migrated from 3.2 to 5.x

COMMON SUPPORT QUESTIONS:
Here, you can find the most common questions and answers users have when using AWStats.

FAQ-COM100 AWStats speed/timeout problems.
FAQ-COM150 Benchmark question.
FAQ-COM200 How reverse DNS Lookup works, unresolved IP Addresses ?
FAQ-COM250 Different results than other log analyzers (Analog, Webalizer, WUsage, wwwStats...).
FAQ-COM300 Difference between local hour and AWStats reported hour.
FAQ-COM350 How can I process old log file ?
FAQ-COM400 How can I update my statistics when I use a load balancing system that splits my logs ?
FAQ-COM500 How can I reset all my statistics ?
FAQ-COM550 Can I safely remove a line in AWStats history files (awstatsMMYYYY*.txt) ?

SECURITY QUESTIONS:
Here, you can find the common questions about security problems when setting or using AWStats.

FAQ-SEC100 Can AWStats be used to make Cross Site Scripting Attacks ?
FAQ-SEC150 How can I prevent some users to see statistics of other users ?
FAQ-SEC200 How to manage log files (and statistics) corrupted by worms attacks like 'Code Red Virus like'.

FAQ-ABO100 : WHICH SERVER LOG FILES OR OS ARE SUPPORTED ?
AWStats can works with :
- All web server able to write log file with a combined log format (XLF/ELF) like Apache, a common log format (CLF) like Apache or Squid, a W3C log format like IIS 5.0 or higher, or any other log format that contains all information AWStats expect to find.
- Most of all others Web/Wap/Proxy/Streaming servers.
- Some FTP, Syslog or Mail log files.
Because AWStats is in Perl, it can works on all Operating Systems.
Examples of used platforms (bold means 'tested by author', others were reported by AWStats users to work correctly) :

OS: Windows 2000, Windows NT 4.0, Windows Me, Linux, Macintosh, Solaris, Aix, BeOS, ... Web/Wap/Proxy/FTP/Mails/Streaming servers Apache 1.3.x and 2, IIS 5.0, WebStar, WebLogic, WebSite, Windows Media Server, Tomcat, Squid, Sendmail, Postfix, Roxen, Resin, ProFTP, Lotus Notes/Domino, IPlanet, IceCast, Zope, ZeroBrand, www4mail, ... Perl interpreters: ActivePerl 5.6, Perl 5.8, Perl 5.6, Perl 5.0, mod_perl for Apache, ...

FAQ-ABO150 : WHICH LOG FORMAT CAN AWSTATS ANALYZE ?
AWStats setup knows predefined log format you can use to make AWStats config easier. However, you can define your own log format, that's the reason why AWStats can analyze nearly all web, wap and proxy server log files. Some FTP servers log files, Syslog or mail logs can also be analyzed.
The only requirement is "Your log file must contain required information".
This is example of possible log format:
Apache combined log format (known as NCSA combined log format or XLF or ELF format)
IIS 5.0+ log format (known as W3C format)
Webstar native log format
Windows Media Server
ProFTP server
A lot of web/wap/proxy/streaming servers log format
Apache common log format (AWStats can now analyze such log files but such log files does not contain all information AWStats is looking for. The problem is in the content, not in the format). I think analyzing common log files is not interesting because there is a lot of missing information: no way to filter robots, find search engines, keywords, os, browser. But a lot of users asked me for it, so AWStats support it. However, a lot of interesting advanced features can't work: browsers, os's, keywords, robot detection...).
See also F.A.Q.: LOG FORMAT SETUP OR ERRORS .
FAQ-ABO200 : WHICH LANGUAGES ARE AVAILABLE ?
AWStats can make reports in 33 languages. This is a list of all of them, for last version, in alphabetical order (with the code you can use for Lang and ShowFlagLinks parameter) :

Albanian=al, Bosnian=ba, Bulgarian=bg, Chinese (Taiwan)=tw, Chinese (Traditional)=cn, Czech=cz, Danish=dk, Dutch=nl, English=en, Finnish=fi, French=fr, German=de, Greek=gr, Hungarian=hu, Indonesian=id, Italian=it, Japanese=jp, Korean=kr, Latvian=lv, Norwegian (Nynorsk)=nn, Norwegian (Bokmal)=nb, Polish=pl, Portuguese=pt, Portuguese (Brazilian)=br, Romanian=ro, Russian=ru, Slovak=sk, Spanish=es, Spanish (Catalan)=es_cat, Swedish=se, Turkish=tr, Ukrainian=ua, Welsh=wlk

However, AWStats documentation is only provided in English.
But, you can find some documentation made by contributors:
In French: How to install AWStats and Webalizer
FAQ-ABO250 : CAN AWSTATS BE INTEGRATED WITH PHP NUKE ?
I don't know any plan to make an Add-On for PHPNuke to include AWStats, for the moment. But this can change. You should ask to have a such Add-On to PHPNuke authors, and on PHPNuke forums.

FAQ-SET025 : HOW TO USE AWSTATS WITH NO SERVER LOG FILE
PROBLEM:
I want to have AWStats statistics but i have no access to my server log file.
SOLUTION:
Because AWStats is a log analyzer, if you don't have any way to read your server log file, you have nothing to analyze and you can't use AWStats.
FAQ-SET050 : ERROR "MISSING $ ON LOOP VARIABLE ..."
PROBLEM:
When I run awstats.pl from command line, I get:
"Missing $ on loop variable at awstats.pl line xxx"
SOLUTION:
Problem is in your Perl interpreter. Try to install or reinstall a more recent/stable Perl interpreter.
You can get new Perl version at ActivePerl (Win32) or Perl.com (Unix/Linux/Other).
FAQ-SET100 : I SEE PERL SCRIPT'S SOURCE INSTEAD OF ITS EXECUTION
PROBLEM:
When I try to execute the Perl script through the web server, I see the Perl script's source instead of the HTML result page of its execution !
SOLUTION:
This is not a problem of AWStats but a problem in your web server setup. awstats.pl file must be in a directory defined in your web server to be a "cgi" directory, this means, a directory configured in your web server to contain "executable" files and not to documents files. You have to read your web server manual to know how to setup a directory to be an "executable cgi" directory (With IIS, you have some checkbox to check in directory properties, with Apache you have to use the "ExecCGI" option in the directory "Directive").
FAQ-SET150 : INTERNAL ERROR 500 IN MY BROWSER
FAQ-SET200 : ERROR "... COULDN'T CREATE/SPAWN CHILD PROCESS..."
PROBLEM:
AWStats seems to run fine at the command prompt but when ran as a CGI from a browser, I get an "Internal Error 500".
I also also might have the following message in my Apache error log file (or in browser with Apache 2.0+):
...couldn't create/spawn child process: c:/mywebroot/cgi-bin/awstats.pl
SOLUTION:
First, try to run awstats.pl from command line to see if file is correct. If you get some syntax errors and use a Unix like OS, check if your file is a Unix like text file (This means each line end with a LF char and not a CR+LF char).
If awstats.pl file runs correctly from command line, this is probably because your web server is not able to known how to run perl scripts. This problem can occur with Apache web servers with no internal Perl interpreter (mod_perl not active). To solve this, you must tell Apache where is your external Perl interpreter.
For this, you have 2 solutions:
1) Add the following directive in your Apache httpd.conf config (or remove the # to uncomment it if line is already available)
ScriptInterpreterSource registry
Then restart Apache. This will tell Apache to look into the registry to find the program associated to .pl extension.
2) Other solution (not necessary if first solution works): Change the first line of awstats.pl file with the full path of your Perl interpreter.
Example with Windows OS and ActivePerl Perl interpreter (installed in C:\Program Files\ActiveState\ActivePerl), you must change the first line of awstats.pl file with:
#!c:/program files/activestate/activeperl/bin/perl
FAQ-SET220 : CRASH WHILE RUNNING AWSTATS.PL OR PAGE CONTENT ONLY PARTIALY LOADED ON WINDOWS XP
PROBLEM:
Sometimes my browser (Most often IE6) crash while running awstats.pl with some AWStats configuration. With some other versions or browsers, page content is partialy loaded.
SOLUTION:
Problem was with WinXP and WinXPpro as documented at MS site Q317949;
"Socket Sharing Creates Data Loss When Listen and Accept Occur on Different Processes"
Result was that MSIE would crash or display nothing. Netscaep and Opera handled the socket better but displayed the pages partially.
The efffect of the bug was more prononced as the page contents increased(above 30k).
http://support.microsoft.com/default.aspx?scid=kb;EN-US;q317949
And also at Apache.org
http://www.apache.org/dist/httpd/binaries/win32/
MS produced a Hotfix which is now included in SP1.
FAQ-SET250 : LOG FORMAT SETUP OR ERRORS
PROBLEM:
Which value do I have to put in the LogFormat parameter to make AWStats working with my log file format ?
SOLUTION:
The AWStats config file give you all possible values for LogFormat parameter. To help you, this is some common cases of log file format, and the corresponding value for LogFormat you must use in your AWStats config file:

If your log records are EXACTLY like this (NCSA combined/XLF/ELF log format): 62.161.78.73 - - [dd/mmm/yyyy:hh:mm:ss +0x00] "GET /page.html HTTP/1.1" 200 1234 "http://www.from.com/from.htm" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)" You must use : LogFormat=1 This is same than: LogFormat="%host %other %logname %time1 %methodurl %code %bytesd %refererquot %uaquot"

If your log records are EXACTLY like this (NCSA combined with several virtualhostname sharing same log file).
virtualserver1 62.161.78.73 - - [dd/mmm/yyyy:hh:mm:ss +0x00] "GET /page.html HTTP/1.1" 200 1234 "http://www.from.com/from.htm" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)"
You must use : LogFormat="%virtualname %host %other %logname %time1 %methodurl %code %bytesd %refererquot %uaquot"

If your log records are EXACTLY like this (NCSA combined with Apache using mod_gzip format 1): 62.161.78.73 - - [dd/mmm/yyyy:hh:mm:ss +0x00] "GET /page.html HTTP/1.1" 200 1234 "http://www.from.com/from.htm" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)" mod_gzip: 66pct. You must use : LogFormat="%host %other %logname %time1 %methodurl %code %bytesd %refererquot %uaquot %other %gzipratio"

If your log records are EXACTLY like this (NCSA combined with Apache using mod_gzip format 2):
62.161.78.73 - - [dd/mmm/yyyy:hh:mm:ss +0x00] "GET /page.html HTTP/1.1" 200 1234 "http://www.from.com/from.htm" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)" mod_gzip: DECHUNK:OK In:11393 Out:3904:66pct.
You must use : LogFormat="%host %other %logname %time1 %methodurl %code %bytesd %refererquot %uaquot %other %other %gzipin %gzipout"

If your log records are EXACTLY like this (NCSA common CLF log format): 62.161.78.73 - - [dd/mmm/yyyy:hh:mm:ss +0x00] "GET /page.html HTTP/1.1" 200 1234 You must use : LogFormat=4 Note: Browsers, OS's, Keywords and Referers features are not available with a such format.

If your log records are EXACTLY like this (With some Squid versions, after setting emulate_http_log to on):
200.135.30.181 - - [dd/mmm/yyyy:hh:mm:ss +0x00] "GET http://www.mysite.com/page.html HTTP/1.0" 200 456 TCP_CLIENT_REFRESH_MISS:DIRECT
You must use : LogFormat="%host %other %logname %time1 %methodurl %code %bytesd %other"

If your log records are EXACTLY like this (IIS W3C log format): yyyy-mm-dd hh:mm:ss 62.161.78.73 - GET /page.html 200 1234 HTTP/1.1 Mozilla/4.0+(compatible;+MSIE+5.01;+Windows+NT+5.0) http://www.from.com/from.html You must use : LogFormat=2

If your log records are EXACTLY like this (IIS W3C log format with some .net servers):
yyyy-mm-dd hh:mm:ss GET /page.html - 62.161.78.73 - Mozilla/4.0+(compatible;+MSIE+5.01;+Windows+NT+5.0) http://www.from.com/from.html 200 1234 HTTP/1.1
You must use : LogFormat="%time2 %method %url %logname %host %other %ua %referer %code %bytesd %other"

If your log records are EXACTLY like this (With some WebSite versions): yyyy-mm-dd hh:mm:ss 62.161.78.73 - 192.168.1.1 80 GET /page.html - 200 11205 0 0 HTTP/1.1 mydomain.com Mozilla/4.0+(compatible;+MSIE+5.5;+Windows+98) - http://www.from.com/from.html You must use : LogFormat="%time2 %host %logname %other %other %method %url %other %code %bytesd %other %other %other %other %ua %other %referer"

If your log records are EXACTLY like this (Webstar native log format):
05/21/00 00:17:31 OK 200 212.242.30.6 Mozilla/4.0 (compatible; MSIE 5.0; Windows 98; DigExt) http://www.cover.dk/ "www.cover.dk" :Documentation:graphics:starninelogo.white.gif 1133
You must use : LogFormat=3

If your log records are EXACTLY like this (Lotus Notes/Domino log format): 62.161.78.73 - Name Surname Service [dd/mmm/yyyy:hh:mm:ss +0x00] "GET /page.html HTTP/1.1" 200 1234 "http://www.from.com/from.htm" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)" You must use : LogFormat=6

If you use a FTP server like ProFTP:
See FAQ-SET260.

If you want to analyze a mail log file (Sendmail, Exchange): See FAQ-SET270.

If you use Windows Media Server:
See FAQ-SET272.

If your log records are EXACTLY like this (With some providers): 62.161.78.73 - - [dd/Month/yyyy:hh:mm:ss +0x00] "GET /page.html HTTP/1.1" "-" 200 1234 You must use : LogFormat="%host %other %logname %time1 %methodurl %other %code %bytesd" Note: Browsers, OS's, Keywords and Referers features are not available with a such format.

There is a lot of other possible log formats.
You must use a personalized log format LogFormat ="..." as described in config file to support other various log formats.
FAQ-SET260 : SETUP FOR FTP SERVER LOG FILES
PROBLEM:
What do I have to do to use AWStats to analyze some FTP server log files.
SOLUTION:
AWStats was built to analyze web,wap or proxy server's log files. However it can be used with some FTP server log files.
Setup your ProFTP logformat:
Modify the proftpd.conf file to add the following two lines :
LogFormat awstats "%t %h %u %m %f %s %b" # WARNING: You must use a tab char between % tags and not a space !
ExtendedLog /var/log/xferlog read,write awstats # WARNING: ExtendedLog directive might need to be placed inside a virtual host context if you use them.
Then turn off old format Transfer log:
TransferLog none # WARNING: TransferLog directive might need to be placed inside a virtual host context if you use them.
To have the change effective, stop your server, remove old log file /var/log/xferlog and restart the server.
Setup AWStats to analyze those FTP log files:
Copy config awstats.model.conf file to "awstats.proftp.conf".
Modify this new config file:
LogFile="/var/log/xferlog"
LogFormat="%time1 %host %logname %method %url %code %bytesd"
LogSeparator="\t"
DNSLookup=0
SkipFiles=""
NotPageList=""
ShowLinksOnUrl=0
ShowHeader=1
ShowMenu=1
ShowMonthDayStats=UVHB
ShowDaysOfWeekStats=HB
ShowHoursStats=HB
ShowDomainsStats=HB
ShowHostsStats=HBL
ShowAuthenticatedUsers=HBL
ShowRobotsStats=1
ShowEMailSenders=0
ShowEMailReceivers=0
ShowSessionsStats=1
ShowPagesStats=PBEX
ShowFileTypesStats=HB
ShowFileSizesStats=0
ShowBrowsersStats=0
ShowOSStats=0
ShowOriginStats=0
ShowKeyphrasesStats=0
ShowKeywordsStats=0
ShowHTTPErrorsStats=0
Now you can use AWStats as usual (run the update process and read statistics).
FAQ-SET270 : SETUP FOR MAIL LOG FILES (SENDMAIL, POSTFIX, EXCHANGE...)
PROBLEM:
What do I have to do to use AWStats to analyze my mail log files.
SOLUTION:
For Sendmail or PostFix log files
1- First, install a mail log convertor like SMA to use it as a post-processor for AWStats update process.
Setup SMA to convert your mail log into a format readable by AWStats:
Copy sma (or sma.exe) file and sma.conf into same directory than awstats.pl file.
Edit sma.conf to change the CLogFormat and ClogSentOnly parameter to :
ClogFormat "%y-%m-%d %h:%n:%s %f %t %F %T SMTP - %S %z"
ClogSentOnly no
To check that your sma config is correct, run the following command:
sma -O clog -f /pathtosmaconf/sma.conf /pathtomaillog/maillog > convertedmaillog
The resulting convertedmaillog file must have records that match the following format:
2001-01-01 05:38:08 sender@mailsender.com receiver@mailreceiver.com hostrelaysender hostrelayreceiver SMTP - 1 31357
Warning: some sma versions (1.3) have been reported to not convert month correctly, giving for example a date like this 2001-#01-01 instead of 2001-01-01. This makes AWStats analyze fails so check your sma output and change version if error.
2- Then setup AWStats to analyze SMA processed mail log:
Copy config awstats.model.conf file to "awstats.mail.conf".
Modify this new config file:
LogFile="/pathtosma/sma -O clog -f /pathtosmaconf/sma.conf /pathtomaillog/maillog |"
LogFormat="%time2 %email %email_r %host %host_r %method %url %code %bytesd"
DNSLookup=0
ValidSMTPCodes="1"
ShowHeader=1
ShowMenu=1
ShowMonthDayStats=HB
ShowDaysOfWeekStats=HB
ShowHoursStats=HB
ShowDomainsStats=0
ShowHostsStats=HBL
ShowAuthenticatedUsers=0
ShowRobotsStats=0
ShowEMailSenders=HBL
ShowEMailReceivers=HBL
ShowSessionsStats=0
ShowPagesStats=0
ShowFileTypesStats=0
ShowFileSizesStats=0
ShowBrowsersStats=0
ShowOSStats=0
ShowOriginStats=0
ShowKeyphrasesStats=0
ShowKeywordsStats=0
ShowHTTPErrorsStats=0
Now you can use AWStats as usual (run the update process and read statistics).
For Exchange log files
If someone can understand the Exchange log format, he can explain it to me at eldy@users.sourceforge.net.
Until this server won't log in a clever way, just forget using AWStats or use a more serious mail server (sendmail, postfix, ...). Sorry.
FAQ-SET272 : SETUP FOR WINDOWS MEDIA SERVER
PROBLEM:
What do I have to do to use AWStats to analyze my Windows Media Server log files.
SOLUTION:
Setup your Windows Media Server log format to write the following fields:
c-ip
date
time
cs-uri-stem
c-starttime
x-duration
c-rate
c-status
c-playerid
c-playerversion
c-playerlanguage
cs(User-Agent)
cs(Referer)
c-hostexe
c-hostexever
c-os
c-osversion
c-cpu
filelength
filesize
avgbandwidth
protocol
transport
audiocodec
videocodec
channelURL
sc-bytes
To have the change effective, stop your server, remove old log files and restart the server.
Listen to streaming files and check that your new log file looks like this:
80.223.91.37 2002-10-08 14:18:58 mmst://mydomain.com/mystream 0 106 1 200 {F4A826EE-FA46-480F-A49B-76786320FC6B} 8.0.0.4477 fi-FI - - wmplayer.exe 8.0.0.4477 Windows_2000 5.1.0.2600 Pentium 0 0 20702 mms TCP Windows_Media_Audio_9 - - 277721
Then setup AWStats to analyze your Media Server log:
Copy config awstats.model.conf file to "awstats.mediaserver.conf".
Modify this new config file:
LogFile="/pathtomediaserver/mediaserverlog"
LogFormat="c-ip date time cs-uri-stem c-starttime x-duration c-rate c-status c-playerid c-playerversion c-playerlanguage cs(User-Agent) cs(Referer) c-hostexe c-hostexever c-os c-osversion c-cpu filelength filesize avgbandwidth protocol transport audiocodec videocodec channelURL sc-bytes"
DNSLookup=0
ShowHeader=1
ShowMenu=1
ShowMonthDayStats=UHB
ShowDaysOfWeekStats=HB
ShowHoursStats=HB
ShowDomainsStats=HB
ShowHostsStats=HBL
ShowAuthenticatedUsers=0
ShowRobotsStats=0
ShowEMailSenders=0
ShowEMailReceivers=0
ShowSessionsStats=0
ShowPagesStats=PB
ShowFileTypesStats=HB
ShowFileSizesStats=0
ShowBrowsersStats=1
ShowOSStats=1
ShowOriginStats=PH
ShowKeyphrasesStats=0
ShowKeywordsStats=0
ShowHTTPErrorsStats=1
Now you can use AWStats as usual (run the update process and read statistics).
FAQ-SET280 : ERROR "NOT SAME NUMBER OF RECORDS OF..."
PROBLEM:
When I run AWStats from command line (or as a cgi from a browser), I get a message "Not same number of records of ...".
SOLUTION:
This means your AWStats reference database files (operating systems, browsers, robots...) are not correct. First try to update to last version. Then check in your disk that you have only ONE of those files. They should be in 'lib' directory ('db' with 4.0) where awstats.pl is installed:
browsers.pm
operating_systems.pm
robots.pm
domains.pm
search_engines.pm
worms.pm
FAQ-SET300 : ERROR "COULDN'T OPEN FILE ..."
PROBLEM:
I have the following error:
"Couldn't open file /workingpath/awstatsmmyyyy.tmp.9999: Permission denied."
SOLUTION:
This error means that the web server didn't succeed in writing the working temporary file (file ended by .tmp.9999 where 9999 is a number) because of permissions problems.
First check that the directory /workingpath has "Write" permission for
user nobody (default user used by Apache on Linux systems)
or user IUSR_SERVERNAME (default used user by IIS on NT).
With Unix, try with a path with no links.
With NT, you must check NTFS permissions ("Read/Write/Modify"), if your directory is on a NTFS partition.
With IIS, there is also a "Write" permission attribute, defined in directory properties in your IIS setup, that you must check.
With IIS, if a default cgi-bin directory was created during IIS install, try to put AWStats directly into this directory.
If this still fails, you can change the DirData parameter to say AWStats that you want to use another directory (A directory you are sure that the default user, used by web server process, can write into).
FAQ-SET350 : EMPTY OR NULL STATISTICS REPORTED
PROBLEM:
AWStats seems to work but I'm not getting any results. i get a statistics page that looks like i have no hits.
SOLUTION:
That's one of the most common problem you can get and there is 2 possible reasons :
1) Your log file format setup might be wrong.
If you use Apache web server
The best way of working is to use the "combined" log format (See the Setup and Use page to know the way to change your Apache server log from "common" log format into "combined"). Don't forget to stop Apache, reset your log file and restart Apache to make change into combined effective. Then you must setup your AWStats config file with value LogFormat=1.
If you want to use another format, read the next FAQ to have examples of LogFile value according to log files format.
If you use IIS server or Windows built-in web server
The Internet Information Server default W3C Extended Log Format will not work correctly with AWStats. To make it work correctly, start the IIS Snap-in, select the web site and look at it's Properties. Choose W3C Extended Log Format, then Properties, then the Tab Extended Properties and uncheck everything under Extended Properties. Once they are all unchecked, check off the list given in the Setup and Use page ("With IIS Server" chapter).
You can also read the next FAQ to have examples of LogFormat value according to log files format.
2) You are viewing stats for a year or month when no hits was made on your server.
When you run awstats, the reports is by default for the current month/year.
If you want to see data for another month/year you must:
Add -year=YYYY -month=MM on command line when building the html report page from command line.
Use an URL like http://myserver/cgi-bin/awstats.pl?config=xxx&year=YYYY&month=MM if viewing stats with AWStats used as a CGI.
FAQ-SET400 : PIPE REDIRECTION TO A FILE GIVE ME AN EMPTY FILE
PROBLEM:
I want to redirect awstats.pl output to a file with the following command :
> awstats.pl -config=... [other_options] > myfile.html
But myfile.html is empty (size is 0). If i remove the redirection, everythings works correctly.
SOLUTION:
This is not an AWStats bug but a problem between perl and Windows.
You can easily solve this running the following command instead:
> perl awstats.pl -config=... [other_options] > myfile.html
FAQ-SET450 : NO PICTURES/GRAPHICS SHOWN
PROBLEM:
AWStats seems to work (all data and counters seem to be good) but I have no image shown.
SOLUTION:
With Apache web server, you might have troubles (no picture shown on stats page) if you use a directory called "icons" (because of Apache pre-defined "icons" alias directory), so use instead, for example, a directory called "icon" with no s at the end (Rename your directory physically and change the DirIcons parameter in config file to reflect this change).
FAQ-SET500 : HOW TO ROTATE MY LOGS WITHOUT LOOSING DATA
PROBLEM:
I want to archive/rotate my logs using my web server system options or a third software (rotatelog, cronolog) but don't want to loose any visits information during the rotate process.
SOLUTION:
If you use a rotate system (internal web server feature or third software), this means you probably not use AWStats PurgeLogFile nor ArchiveLogRecords parameter.
* If your config file is setup to process current log file (because you want to use the AllowToUpdateStatsFromBrowser option), if you don't want to loose any records during the rotate process, you can just run the AWStats update process on the archived log file just after the update process using the -logfile option (This will avoid you to change the config file).
* If you choose (for security reason, to avoid CPU abuse on large web site or other) to make updates by your scheduler only on archive files, this means you don't use the AllowToUpdateStatsFromBrowser "real-time" feature of AWStats. In this case all you have to do is to run the update process just after the rotate was done using a config/domain file configured to process the archived log files (using date tags of LogFile for examples).
Note: For Apache users, use of cronolog seems to be a better choice than rotatelog (cronolog is available for Unix/Linux and Windows and is more flexible).
To use cronolog or rotatelog you must setup your web server log file name using a pipe like this example:
CustomLog "|/usr/sbin/cronolog [cronolog_options] /var/logs/access.%Y%m%d.log" combined
FAQ-SET550 : HOW TO RUN AWSTATS FREQUENTLY
PROBLEM:
AWStats must be ran frequently to update statistics. How can I do this ?
SOLUTION:
With Windows, you can use the internal task scheduler. The use of this tool is not an AWStats related problem, so please take a look at your Windows manual. Warning, if you use "awstats.pl -config=mysite -update" in your scheduled task, you might experience problem of failing task. Try this instead
"C:\WINNT\system32\CMD.EXE /C C:\[awstats_path]\awstats.pl -config=mysite -update"
or
"C:\[perl_path]\perl.exe C:\[awstats_path]\awstats.pl -config=mysite -update"
A lot of other scheduler (sharewares/freewares) are very good.
With unix-like operating systems, you can use the "crontab".
This is examples of lines you can add in the cron file (see your unix reference manual for cron) :
To run update every day at 04:00, use :
0 4 * * * /opt/awstats/wwwroot/cgi-bin/awstats.pl -config=mysite -update
To run update every hour, use :
0 * * * * /opt/awstats/wwwroot/cgi-bin/awstats.pl -config=mysite -update
FAQ-SET600 : HOW CAN I EXCLUDE MY IP ADDRESS (OR WHOLE SUBNET MASK) FROM STATS ?
PROBLEM:
I don't want to see my own IP address in the stats or I want to exclude counting visits from a whole subnet.
SOLUTION:
You must edit the config file to change the SkipHosts parameter.
For example, to exclude:
- your own IP address 123.123.123.123, use SkipHosts="123.123.123.123"
- the whole subnet 123.123.123.xxx, use SkipHosts="123.123.123"
- all sub hosts xxx.myintranet.com, use SkipHosts=".myintranet.com" (This one works only if DNS lookup is already done in your log file).
FAQ-SET700 : MY VISITS ARE DOUBLED FOR OLD MONTH I MIGRATED FROM 3.2 TO 5.X
PROBLEM:
After having migrated an old history file for a month, the number of visits for this month is doubled. So the number of "visits per visitor" is also doubled and "pages per visit" and "hits per visit" is divided by 2. All other data like "pages", "hits" and bandwith are correct.
SOLUTION:
This problem occurs when migrating history files from 3.2 to 5.x.
To fix this you can use the following tip (warning, do this only after migrating from 3.2 to 5.x and if your visit value is doubled). The goal is to remove the line in history file that looks like this
YYYYMM00 999 999 999 999
where YYYY and MM are year and month of config file and 999 are numerical values.
So if your OS is Unix/Linux
grep -vE '^[0-9]{6}00' oldhistoryfile > newhistoryfile
mv newhistoryfile oldhistoryfile
And then run the migrate process again on the file.
If your OS is windows and got cygwin
You must follow same instructions than if OS is Unix/Linux BUT you must do this from a cygwin 'sh' shell and not from the DOS prompt (because the ^ is not understanded by DOS).
And then run the migrate process again on the file.
In any other case (in fact works for every OS)
You must remove manually the line YYYYMM00 999 999 999 999 (must find one and only one such line) and then run the migrate process again on the file.

FAQ-COM100 : AWSTATS SPEED/TIMEOUT PROBLEMS ?
PROBLEM:
When I analyze large log files, processing times are very important (Example: update process from a browser returns a timeout/internal error after a long wait). Is there a setup or things to do to avoid this and increase speed ?
SOLUTION:
You really need to understand how a log analyzer works to have good speed. There is also major setup changes you can do to decrease your processing time.
See important advices in benchmark page.
FAQ-COM150 : BENCHMARK / FREQUENCY TO LAUNCH AWSTATS TO UPDATE STATISTICS
PROBLEM:
What is AWStats speed ?
What is the frequency to launch AWStats process to update my statistics ?
SOLUTION:
All benchmarks information and advice on frequency for update process are related into the Benchmark page.
FAQ-COM200 : HOW REVERSE DNS LOOKUP WORKS, UNRESOLVED IP ADDRESSES
PROBLEM:
The reported page AWStats shows me has no hostnames, only IP addresses, countries reported are all "unknown".
SOLUTION:
When AWStats find an IP address in your log file, it tries a reverse DNS lookup to find the hostname and domain if the DNSLookup parameter, in your AWStats config file, is DNSLookup=1 (Default value). So, first, check if you have the good value. The DNSLookup=0 must be used only if your log file contains already resolved IP address. For example, when you set up Apache with the HostNameLookups=on directive. When you ask your web server to make itself the reverse DNS lookup to log hostname instead of IP address, you will still find some IP addresses in your log file because the reverse DNS lookup is not always possible. But if your web server fails in it, AWStats will also fails (All reverse DNS lookups use the same system API). So to avoid AWStats to make an already done lookup (with success or not), you can set DNSLookup=0 in AWStats config file. If you prefer, you can make the reverse DNS lookup on a log file before running your log analyzer (If you only need to convert a logfile with IP Addresses into a logfile with resolved hostnames). You can use for this logresolvemerge tool provided with AWStats distribution (This tools is an improved version of logresolve provided with Apache).
FAQ-COM250 : DIFFERENT RESULTS THAN OTHER ANALYZER
PROBLEM:
I also use webalizer (or another log analyzer) and it doesn't report the same results than AWStats. Why ?
SOLUTION:
If you compare AWStats results with an other log file analyzer, you will found some differences, sometimes very important. In fact, all analyzer (even AWStats) make "over reporting" because of the problem of proxy-servers and robots. However AWStats is one the most accurate and its "over reporting" is very low where all other analyzers, even the most famous, have a very high error rate (10% to 2x more than reality).
This is the most important reasons why you will find differences:
- Some dynamic pages generated by CGI programs are not counted by some analyzer (ie Webalizer) like a "Page" (but only like a "Hit") if CGI prog has not a .cgi extension, so they are not included correctly in their statistics. AWStats does not make this error and all CGI pages are pages.
- AWStats is the alone analyzer (that i know for the moment) able to detect robots visits. All other analyzers think it's a human visitor. This error make them to report more visits and visitors than reality. This does not happen with AWStats. When it tells "1 visitor", it means "1 human visitor". All robots hits are reported in the "Robots/Spiders visitors" chart.
- A lot of analyzer (ie webalizer) use the "Hits" to count visitors. This is not a good way of working : Some visitors use a lot of proxy servers to surf (ie: AOL users), this means it's possible that several hosts (with several IP addresses) are used to reach your site for only one visitor (ie: one proxy server download the page and 2 other servers download all images). Because of this, if stats of unique visitors are made on "hits", 3 users are reported but it's wrong. So AWStats, like HitBox, considers only HTML "Pages" to count unique visitors. This decrease the error, not completely, because it's always possible that a proxy server download one HTML frame and another one download another frame, but this make the over-reporting of unique visitors less important.
There is also differences in log analyzers databases and algorithms that make details of results less or more accurate:
- AWStats has a larger browser, os and search engine database, so reports concerning this are more accurate.
- AWStats has url syntax rules to find keywords or keyphrases used to find your site, but AWStats has also an algorithm to detect keywords of unknown search engines with unknown url syntax rule.
FAQ-COM300 : DIFFERENCE BETWEEN LOCAL HOURS AND AWSTATS REPORTED HOURS
PROBLEM:
I use IIS and there's a difference between local hour and AWStats reported hour. For example I made a hit on a page at 4:00 and AWStats report I hit it at 2:00.
SOLUTION:
This is not a problem of time in your local client host. AWStats use only time reported in logs by your server and all time are related to server hour. The problem is that IIS in some foreign versions puts GMT time in its log file (and not local time). So, you have also GMT time in your statistics.
You can wait that Microsoft change this in next IIS versions. However, Microsoft sheet Q271196 "IIS Log File Entries Have the Incorrect Date and Time Stamp" says:
The selected log file format is the W3C Extended Log File Format. The extended log file format is defined in the W3C Working Draft WD-logfile-960323 specification by Phillip M. Hallam-Baker and Brian Behlendorf. This document defines the Date and Time files to always be in GMT. This behavior is by design.
So this means this way of working might never be changed, so another chance is to use the AWStats plugin 'timezone'. Warning, this plugin need the perl module Time::Local and it reduces seriously AWStats speed.
To enable the plugin, uncomment the following line in your config file.
LoadPlugin="timezone TZ"
where TZ is value of your signed timezone (+2 for Paris, -8 for ...)
FAQ-COM350 : HOW CAN I PROCESS OLD LOG FILE ?
PROBLEM:
I want to process an old log file to include its data in my AWStats reports.
SOLUTION:
You must change your LogFile parameter to point to the old log file and run the update (or use the -logfile option on command line to overwrite LogFile parameter). The update process can only accept files in chronological order, so if you have already processed a recent file, you must before reset all your statistics (see next FAQ) and restart all the update process for all past log files and in chronological order.
FAQ-COM400 : HOW CAN I UPDATE MY STATISTICS WHEN I USE A LOAD BALANCING SYSTEM THAT SPLITS MY LOGS ?
PROBLEM:
How can I update my statistics when i use a load balancing system that split my logs ?
SOLUTION:
The best solution is to merge all split log files resulted from all your load balanced servers into one. For this, you can use the logresolvemerge tool provided with AWStats :
logresolvemerge.pl file1.log file2.log ... filen.log > newfiletoprocess.log
And setup the LogFile parameter in your config file to process the newfiletoprocess.log file or use the -logfile command line option to overwrite LogFile value.
FAQ-COM500 : HOW CAN I RESET ALL MY STATISTICS ?
PROBLEM:
I want to reset all my statistics and restart my stats from now.
SOLUTION:
All analyzed data are stored by AWStats in files called awstatsMMYYYY.[site.]txt (one file each month). You will find those files in directory defined by DirData parameter (same directory than awstats.pl by default).
To reset your stats for a month, you just have to delete the file for the required month/year.
To reset all your stats, delete all files awstats*.txt
Warning, if you delete those data files, you won't be able to recover your stats back, unless you kept old log files somewhere. You will have to process all past log files (in chronological order) to get old statistics back.
FAQ-COM550 : CAN I SAFELY REMOVE A LINE IN HISTORY FILES (awstatsMMYYYY*.txt) ?
PROBLEM:
After processing a log file I want to change my statistics without running AWStats update process but changing directly data in AWStats historical database files.
SOLUTION:
If you remove a lines starting with "BEGIN_" or "END_", AWStats will find your file "corrupted" so you must not change those two kinds of lines.
You can change, add or remove any line that is in any sections but if you do this, you must also update the MAP section (lines between BEGIN_MAP and END_MAP) because this section contains the offset in file of each other sections for direct I/O access. If history file is the last one, you can easily do that by removing completely the MAP section and run an update process. Like that AWStats will rewrite the history file and the MAP section will be rewritten (MAP section is not read by update process, only written). You do this at your own risk. The main risk is that some charts will report wrong values or be unavailable.

FAQ-SEC100 : CAN AWSTATS BE USED TO MAKE CROSS SITE SCRIPTING ATTACKS ?
PROBLEM:
If a bad user use a browser to make a hit on an URL that include a < SCRIPT > ... < /SCRIPT > section in its parameter, when AWStats will show the links on the report page, does the script will be executed ?
SOLUTION:
No. AWStats use a filter to remove all scripts codes that was included in an URL to make a Cross Site Scripting Attack using a log analyzer report page.
FAQ-SEC150 : HOW CAN I PREVENT SOME USERS TO SEE STATISTICS OF OTHER USERS ?
PROBLEM:
I don't want a user xxx (having a site www.xxx.com) to see statistics of user yyy (having a site www.yyy.com). How can i setup AWStats for this ?
SOLUTION:
Take a look at the security page.
FAQ-SEC200 : HOW TO MANAGE LOG FILES (AND STATISTICS) CORRUPTED BY 'WORMS' ATTACKS ?
PROBLEM:
My site is attacked by some worms viruses (like Nimba, Code Red...). This make my log file corrupted and full of 404 errors. So my statistics are also full of 404 errors. This make AWStats slower and my history files very large. Can I do something to avoid this ?
SOLUTION:
Yes.
'Worms' attacks are infected browsers, robots or server chnaged into web client that make hits on your site using a very long unknown URL like this one:
/default.ida?XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX%40%50...%40%50
URL is generated by the infected robot and the purpose is to exploit a vulnerability of the web server (In most cases, only IIS is vulnerable). With such attacks, you will will always find a 'common string' in those URLs. For example, with Code Red worm, there is always default.ida in the URL string. Some other worms send URLs with cmd.exe in it. So, you should edit your config file to add in the SkipFiles parameter the following value:
SkipFiles="default.ida cmd.exe"