Specifying Log File Format

On this page you will find information on how to tell Statomatic about your log file format. If your server log format is not listed in Log file format menu, you can still use Statomatic if you describe it in the terms that the program can understand. Standard Apache and IIS log file formats are already included in Statomatic configuration.

The following table contains the fields that Statomatic uses when it parses log file. We suggest you open your log file in the text editor and go through 2-3 lines step by step looking for the fields listed below, generating a template. After you have created new format string, add it to the file formats.cfg, format name first and then the string.

Field	Description	Example
%?	ignore this field	any string or character
%h	client hostname	123.someisp.com
%i	numerical IP address of client	216.102.198.55
%d	day of the month	15
%m	month as a string	Sep or September
%M	month in digits	09
%y	year	2002
%H	hour of the day	07
%n	minute of the hour	25
%s	second of the minute	55
%a	AM / PM field in the 12-hour clock format	AM or PM
%f	file requested	/index.htm, /image.gif, ...
%c	HTTP status code	200, 404, 500, ...
%b	number of bytes transferred	1024
%r	HTTP referrer	http://www.domain.com/links.htm
%u	HTTP user agent (browser)	Mozilla/4.77 [en] (Win98; U)

Log File Formats Examples

NCSA Common log format (with numerical IP)

195.119.180.101 - - [19/Mar/2001:00:37:42 +0100] "GET / HTTP/1.0" 200 631

Statomatic template

%i %? %? [%d/%m/%y:%H:%n:%s %?] "%? %f %?" %c %b

NCSA Combined log format (with host)

123.isp.com - - [01/Dec/2001:00:14:07 -0800] "GET / HTTP/1.1" 200 956 "http://www.domain.com/links.htm" "Mozilla/4.77 [en] (Win98; U)"

Statomatic template

%h %? %? [%d/%m/%y:%H:%n:%s %?] "%? %f %?" %c %b "%r" "%u"

IIS 4.0 W3C Extended log format (with numerical IP)

#Fields: date time c-ip cs-username s-sitename s-computername s-ip cs-method cs-uri-stem cs-uri-query sc-status sc-win32-status sc-bytes cs-bytes time-taken s-port cs(User-Agent) cs(Cookie) cs(Referer)

2001-03-19 00:37:42 195.119.180.101 - W3SVC1 NEWS 127.0.0.1 GET /index.htm - 200 0 956 190 1500 80 Mozilla/4.77+[en]+(Win98;+U) - http://www.domain.com/links.htm

Statomatic template

%y-%M-%d %H-%n-%s %i %? %? %? %? %? %f %? %c %? %b %? %? %? %u %? %r

IIS 5.0 W3C Extended log format (with numerical IP and host)

#Fields: date time c-ip cs-username s-sitename s-computername s-ip s-port cs-method cs-uri-stem cs-uri-query sc-status sc-win32-status sc-bytes cs-bytes time-taken cs-version cs-host cs(User-Agent) cs(Cookie) cs(Referer)

2001-03-19 00:37:42 195.119.180.101 - W3SVC1 NEWS 127.0.0.1 80 GET /index.htm - 200 0 956 190 1500 HTTP/1.1 123.isp.com Mozilla/4.77+[en]+(Win98;+U) - http://www.domain.com/links.htm

Statomatic template

%y-%M-%d %H-%n-%s %i %? %? %? %? %? %? %f %? %c %? %b %? %? %? %? %u %? %r

If you are still not sure how to specify your server log file format or need help, email us with few sample entries (10-15 lines) from your log file or login/pass and location of your log file.