Working with the Log Analyzer

Use the log analyzer to generate statistics about your server, such as a summary of activity, most commonly accessed URLs, times during the day when the server is accessed most frequently, etc. You can run the log analyzer from the Server Status form or the command line.

Before running the log analyzer, you should archive the server logs. For more information about archiving server logs, see Monitoring the Server Using SNMP.

Running the Log Analyzer from the Server Status Form

1. From the Web Manager home page, click Enterprise Web Server servername > Server Status > Generate Report.

2. Enter the name of your server in the Server Name field.

   This name appears in the generated report.

3. Select the output type---whether the report will appear in HTML or plain text format.

4. Select the log file you want to analyze.

5. If you want to save the results in a file, enter an output filename in the Output File field.

   If you leave the field blank, the analyzer prints results on the screen. For large log files, you should save the results to a file because printing the output to the screen might take a long time.

6. Select whether to generate the following server statistics:

   • Total Hits: Total number of hits the server received after access logging was enabled
   • 304 (Not Modified) Status Codes: Number of times the requesting client used a local copy of the requested document rather than retrieving it from the server
   • 302 (Redirects) Status Codes: Number of times the server redirected to a new URL because the original URL moved
   • 404 (Not Found) Status Codes: Number of times the server couldn't find the requested document or the server didn't serve the document because the client was not an authorized user
   • 500 (Server Error) Status Codes: Number of times a server-related error occurred
   • Total Unique URLs: Number of unique URLs accessed after access logging was enabled
   • Total Unique Hosts: Number of unique client hosts who have accessed the server after access logging was enabled
   • Total Kilobytes Transferred: Number of kilobytes the server transferred after access logging was enabled

7. Select whether to generate the following statistics:

   • Top Number of One-Second Periods: Number of one-second periods during which requests were highest
   • Top Number of One-Minute Periods: Number of one-minute periods during which requests were highest
   • Top Number of One-Hour Periods: Number of one-hour periods during which requests were highest
   • Top Number of Users: Number of users that accessed your server, provided that you included this as an item to log when you enabled access logging
   • Top Number of Referers: Number of referers that appear in your log analysis, provided that you included this as an item to log when you enabled access logging
   • Top Number of User Agents: Number of user agents that appear in your log analysis, provided that you included this as an item to log when you enabled access logging
   • Top Number of Miscellaneous Logged Items: Number of miscellaneous logged items (request method, the URI, and the URI query) that appear in your log analysis (provided that you included this as an item to log when you enabled access logging)

   To enable access logging, see Setting Log Preferences.

8. Select whether to generate a list of the following server access statistics:

   • Most Commonly Accessed URLs: The most commonly accessed URLs or URLs that were accessed more than a specified number of times
   • Hosts Most Often Accessing Your Server: The hosts most often accessing your server or hosts that have accessed your server more than a specified number of times

9. Enter the order in which you want to see the results in the Output order field.

10. Click OK.

Running the Log Analyzer from the Command Line

To analyze access log files from the command line, run the FLEXANLG tool, which is in EXTRAS/FLEXANLG in your server root directory.

To run FLEXANLG, enter the following command and options at the command prompt:

flexanlg [ -P ] [-n name] [-x] [-r] [-p order] [-i file]* [ -m metafile ]* [ o file][ c opts] [-t opts] [-l opts]

The following describes the syntax. (You can get this information online by entering flexanlg -h at the command prompt.)

-P: proxy log format                                  Default: no  
-n servername: The name of the server  
-x : Output in HTML                                   Default: no  
-r : Resolve IP addresses to hostnames                Default: no  
-p [c,t,l]: Output order (counts, time stats, lists)  Default: ctl  
-i filename: Input log file(s)                        Default: none  
-o filename: Output log file                          Default: stdout  
-m filename: Meta file(s)                             Default: none  
-c [h,n,r,f,e,u,o,k,c,z]: Count these item(s) -       Default: hnreuokc  
    h: total hits  
    n: 304 Not Modified status codes (Use Local Copy)  
    r: 302 Found status codes (Redirects)  
    f: 404 Not Found status codes (Document Not Found)  
    e: 500 Server Error status codes (Misconfiguration)  
    u: total unique URL's  
    o: total unique hosts  
    k: total kilobytes transferred  
    c: total kilobytes saved by caches  
    z: Do not count any items.  
-t [sx,mx,hx, xx,z]: Find general stats - Default:s5m5h24x10  
    s(number): Find top (number) seconds of log  
    m(number): Find top (number) minutes of log  
    h(number): Find top (number) hours of log  
    u(number): Find top (number) users of log  
    a(number): Find top (number) user agents of log  
    r(number): Find top (number) referers of log  
    x(number): Find top (number) for miscellaneous keywords  
    z: Do not find any general stats.  
-l [cx,hx]: Make a list of -                          Default: c+3h5  
    c(x,+x): Most commonly accessed URLs  
             (x: Only list x entries)  
             (+x: Only list if accessed more than x times)  
    h(x,+x): Hosts (or IP addresses) most often accessing your server  
             (x: Only list x entries)  
             (+x: Only list if accessed more than x times)  
    z: Do not make any lists