Ubuntu
awstats package

awstats confused by 408 entries in apache log files

Bug #908901 reported by James Troup
34
This bug affects 7 people
Affects Status Importance Assigned to Milestone
awstats (Ubuntu)
Confirmed
Medium
Canonical Server

Bug Description

We have a mostly idle (historical) site that we still run awstats
over. These days, for reasons I've yet to derermine, it generates a
lot of 408 responses, e.g.:

| 91.189.88.12 - - [01/Dec/2011:12:54:56 +0000] "-" 408 4808 "-" "-"

If enough of these are at the start of the logfile, awstats chokes on
the file:

| AWStats did not find any valid log lines that match your LogFormat parameter, in the 50th first non commented lines read of your log.
| Your log file /usr/share/doc/awstats/examples/logresolvemerge.pl /srv/webstats.canonical.com/logs/SERVER_NAME/SITE_NAME* | must have a bad format or LogFormat parameter setup does not match this format.
| Your AWStats LogFormat parameter is:
| 1
| This means each line in your web server log file need to have "combined log format" like this:
| 111.22.33.44 - - [10/Jan/2001:02:14:14 +0200] "GET / HTTP/1.1" 200 1234 "http://www.fromserver.com/from.htm" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)"
| And this is an example of records AWStats found in your log file (the record number 50 in your log):
| 91.189.88.12 - - [01/Dec/2011:13:10:24 +0000] "-" 408 4808 "-" "-"
| Setup ('/etc/awstats/awstats.SITE_NAME.conf' file, web server or permissions) may be wrong.
| Check config file, permissions and AWStats documentation (in 'docs' directory).

We're using LogFormat=1 and AFAIK the line quoted is valid combined
log format data.

Rick Spencer (rick-rickspencer3)
Changed in awstats (Ubuntu):
assignee: nobody → Canonical Server Team (canonical-server)
importance: Undecided → Medium
Revision history for this message
Launchpad Janitor (janitor) wrote :

Status changed to 'Confirmed' because the bug affects multiple users.

Changed in awstats (Ubuntu):
status: New → Confirmed
Revision history for this message
Ch. Tronche (ch-tronche) wrote :

Problem present in 7.0~dfsg-5 (Ubuntu 12.04.2 LTS).

NB: 408 lines appears (notably) if the client has made a connection to the web server and not sent any request.

Revision history for this message
Enrico Razzetti (o-enrico) wrote :

Any solution in sight?

Revision history for this message
Marius Gedminas (mgedmin) wrote :

Upstream bug: https://sourceforge.net/p/awstats/bugs/914/

Revision history for this message
Vincent Lefevre (vincent-vinc17-net) wrote :

Any news? awstats spams me every 10 minutes! Here's the message:

Error while processing /etc/awstats/awstats.www.vinc17.net.conf
Create/Update database for config "/etc/awstats/awstats.www.vinc17.net.conf" by AWStats version 7.2 (build 1.992)
From data in log file "/srv/d_ioooi/www/www.vinc17.net/logs/www.vinc17.net-access.log"...
Phase 1 : First bypass old records, searching new record...
Direct access after last parsed record (after line 610309)
AWStats did not find any valid log lines that match your LogFormat parameter, in the 50th first non commented lines read of your log.
Your log file /srv/d_ioooi/www/www.vinc17.net/logs/www.vinc17.net-access.log must have a bad format or LogFormat parameter setup does not match this format.
Your AWStats LogFormat parameter is:
1
This means each line in your web server log file need to have "combined log format" like this:
111.22.33.44 - - [10/Jan/2001:02:14:14 +0200] "GET / HTTP/1.1" 200 1234 "http://www.fromserver.com/from.htm" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)"
And this is an example of records AWStats found in your log file (the record number 50 in your log):
72.69.147.250 - - [16/May/2016:06:20:12 +0200] "\x03" 400 0 "-" "-"
Setup ('/etc/awstats/awstats.www.vinc17.net.conf' file, web server or permissions) may be wrong.
Check config file, permissions and AWStats documentation (in 'docs' directory).

Revision history for this message
Worik (worik-stanton) wrote :

This is affecting me too. Possibly.

My access log has lines like:

69.199.239.200 - - [14/Jun/2016:01:59:16 +1200] "\x03" 400 0 "-" "-"

About 310 entries over a period of 10 minutes. My log format is set to 4.

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.