1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
|
# $Id: sample.def.conf,v 1.1 2001/01/19 20:28:52 achim Exp $
# ModLogAn default configuration file
#
# 1. Format:
# - lines starting with '#' are comments
# - empty lines are ignored
# - every other line has consist of a key-value pair
# - a key-value pair has to be seperated by an equal-sign '='
#
# 2. Whitespaces:
# - whitespaces at the end of key are ignored
# - whitespaces at the end of value are ignored
# - whitespaces at the beginning of value are ignored
# example:
# inputplugin=clf
# and
# inputplugin = clf
# are the same.
#
# 3. Wildcardmatching:
# every key that starts with
# - hide
# - group
# - match
# has support for wildcard matching. the wildcard is the '*' and is allowed
# at the beginning and at the end of the value
#
# 4. sections
# the configfile is divided into four section:
# -> global, input, output, processor
#
# the 'global'-section is special and has to be at the top if the config-file.
# the other sections (input, output, processor) correnspond to the different
# plugins. As every plugin has its own configfile options they have to be
# seperated in the configfile
# this achieved by appending a '_' and the plugin-name after the section
# name.
# e.g:
# [global] -> global section
# [input_clf] -> input section, only parsed und used if the clf input plugin
# is selected
# [input] -> section input (for backward compatibility), parsed by
# every input plugin (deprecated)
# global section
[global]
# input plugin (wuftpd, clf, null, msiis, hicom116, isdnlog, elmeg)
inputplugin=clf
# output plugin (modlogan, csv, webalizer, text, tkcontrol)
outputplugin=modlogan
# processor plugin (web,telecom)
processorplugin=web
# used output language (default: == env LC_ALL) [not used yet]
#language=
# where to put the generated files
##
#outputdir=/usr/local/httpd/modlogan
# incremental mode (0 = off, 1 = semi, 2 = full)
## If you are rotating your logfile more than once a month, the incremental
## processing feature will save you a lot of time.
## modlogan saves the data of the last run in a file (modlogan.state). This
## enables you to run modlogan everytime you rotated your logfiles. You
## don't have to reparse the whole month.
##
## 0: incremental mode off. the state file will be ignored and every record
## will be parsed
## 1: semi-incremental mode on. if the first records of the parsed logfile
## are older than the last timestamp from the state-file the records
## will be ignored
## 2: full-incremental mode on. if the first records of the parsed logfile
## are older than the last timestamp from the state-file the records
## will be counted, but their timestamps will be ignored
##
incremental=1
# global debug level
##
## 0: be quiet, only error messages and the greeting
## 1: verbose, add some status messages
## 2: add warning
## >2: talk about everything
debug_level=1
[processor_web]
# path to the searchengines description file
searchengines=/etc/modlogan/modlogan.searchengines
# timeout for a visit count (in seconds) (default = 1800)
## - every hit from the same url that comes in within a specified timeframe
## is counted as one visits
visit_timeout=1800
# debug options
## searchengines
## - every referrer the contains a '?' is checked if it matches one of the
## strings in the searchengine-definition file. If no matching string is
## found this option enables the output of the checked referrer.
## - this information can be used to improve the searchengine-definition
## file. Read ./doc/adding-searchengines.txt for more information on this
## topic
## - valid values are 0,1,2 for the different output levels:
## 0: quiet
## 1: output urls which contain a matching searchkey, but no matching site
## (recommend for those who want a more accurate report)
## 2: output urls which contain the '?' but didn't match a searchkey, too
debug_searchengines=0
## visits
## - to get a clue how a visit is setup this option enable the output of
## every hit and how it corresponds to a visit
##
## the following output is generated by this option:
#> process.is_visit: -> host5-99-45-76.btinternet.com, time: 957132111
#> process.is_visit: -- host5-99-45-76.btinternet.com, time: 957132121 - 10
#> process.is_visit: <- host5-99-45-76.btinternet.com, time: 957132242 - 1851
##
## explanation:
## process.is_visit: ->
## - the visit from host5-99-45-76.btinternet.com starts at 957132111.
## process.is_visit: --
## - 10 seconds later (957132121 - 10) another hits from the same host occurs
## process.is_visit: <-
## - 1851 seconds after the last hit the visit is finished
##
debug_visits=0
# hide an url
## the following URL are hidden (images)
hideurl="\.gif$"
hideurl="\.png$"
hideurl="\.GIF$"
hideurl="\.PNG$"
hideurl="\.jpg$"
hideurl="\.JPG$"
# hide a refferer
## the referrer stats should only contain the external referrer.
## you probably want to put your own url here:
hidereferrer="^http://##HOST2##"
# group the referrers
groupreferrer="^-$","(Direct Access)"
#groupreferrer="samba/GUI",www.samba.org UserInterfaces
#groupreferrer="samba/docs/ntdom_faq",www.samba.org NT Domain FAQ
#groupreferrer="/listproc/samba-ntdom/",www.samba.org NT Domain Mailinglist
#grouphosts="\.dip\.t-dialin\.net$",dip.t-dialin.net
#grouphosts="\.arcor-ip\.net$",arcor-ip.net
#grouphosts="\.Concordia\.CA$",Concordia.CA
# group broken links
## by default the various favicon should be grouped. if you want to know
groupbrokenlinks="favicon\.ico$",Bookmarking Icons for MSIE 5.0
groupos="Windows 98$",Windows 98
groupos="Windows 95$",Windows 95
groupos="Windows NT",Windows NT
groupos="WinNT$",Windows NT
groupos="Win98$",Windows 98
groupos="Win95$",Windows 95
groupos="^Linux 2\.4\.",Linux 2.4.x
groupos="^Linux 2\.3\.",Linux 2.3.x
groupos="^Linux 2\.2\.",Linux 2.2.x
groupos="^Linux 2\.1\.",Linux 2.1.x
groupos="^Linux 2\.0\.",Linux 2.0.x
groupos="^FreeBSD 2\.",FreeBSD 2.x
groupos="^FreeBSD 3\.",FreeBSD 3.x
groupos="^FreeBSD 4\.",FreeBSD 4.x
groupos="^SunOS 5\.5",SunOS 5.5.x
groupos="^SunOS 5\.6",SunOS 5.6.x
groupos="^SunOS 5\.7",SunOS 5.7.x
groupos="^SunOS 5\.8",SunOS 5.8.x
groupos="^HP-UX B\.10\.",HP-UX B.10.x
groupos="^HP-UX B\.11\.",HP-UX B.11.x
groupos="^NetBSD 1\.4\.",NetBSD 1.4.x
groupua="^MSIE 5\.5",Internet Explorer 5.5x
groupua="^MSIE 5\.",Internet Explorer 5.x
groupua="^MSIE 4\.",Internet Explorer 4.x
groupua="^MSIE 3\.",Internet Explorer 3.x
groupua="^MSIE 2\.",Internet Explorer 2.x
groupua="^Mozilla/2\.",Netscape 2.x
groupua="^Mozilla/3\.",Netscape 3.x
groupua="^Mozilla/4\.7",Netscape 4.7x
groupua="^Mozilla/4\.",Netscape 4.x
groupua="^Mozilla/5\.",Netscape 5.x
groupua="^Netscape/4\.",Netscape 4.x
groupua="^Konqueror/1\.",Konqueror 1.x
groupua="^Lynx/2\.8\.",Lynx 2.8.x
# url that should be counted as pages
## pages that end with a '/' are index-pages
pagetype="/$"
## default page names
pagetype="\.html$"
pagetype="\.htm$"
pagetype="\.php3$"
#pagetype="\.asp$"
#pagetype="\.shtml$"
#pagetype="\.php$"
# output modules (modlogan)
[output_modlogan]
# hostname (default: localhost)
#hostname=##HOST##
# number of lines per report
# 0 - disabled
# >0 - number of lines per report
maxrequrls = 30
maxrefurls = 30
maxos = 50
maxhosts = 30
maxentrypages = 10
maxexitpages = 10
maxindexedpages = 20
maxua = 30
maxreqprot = 10
maxreqmeth = 10
maxstatuscodes = 10
maxrobots = 20
maxbookmarks = 20
maxbrokenlinks = 20
maxsearchengines= 20
maxsearchstrings= 30
maxinteralerrors= 20
maxcountries = 20
# colors
# the notation is #RRGGBB (HTML-color-tripple)
background = #c0c0c0
shadow = #808080
pages = #00c0ff
files = #0080ff
visits = #ffff00
xfer = #ff0000
hosts = #ff8000
hits = #00C030
grouping = #D0D0E0
body = #FFFFFF
# the different colors of the country pie
country_circle = #0000FF
country_circle = #00FFFF
country_circle = #FF00FF
country_circle = #FFFFFF
country_circle = #80FF00
country_circle = #FFFF00
country_circle = #FF0000
country_circle = #8080FF
# pagestyle
## the modlogan output plugin supports different output styles
## - seppage
## - onepage
## - (a mixture of both)
pagestyle = seppage
showdailygraph = 1
showmonthlygraph= 1
showhourlygraph = 1
showcountrygraph= 1
showvalidationlinks = 1
# assumed protocol for the url completition
## the requested file in the logfile is only the path in the
## documentroot of the server. for the report it is often
## neccesary the complete the path to a full url.
## <assumedprotocol>://<hostname>/<path> is the completed path.
##
## if this option isn't set this feature is disabled
assumedprotocol = http
# filenames for the replacements of the html-header/footer
## take a look at ./doc/plugin-options.txt for more information
#htmlheader = header.ihtml
#htmlfooter = footer.ihtml
# output modules (webalizer)
[output_webalizer]
# hostname (default: localhost)
#hostname=##HOST##
# number of lines per report
# 0 - disabled
# >0 - number of lines per report
maxrequrls = 30
maxrefurls = 30
maxos = 50
maxhosts = 30
maxentrypages = 10
maxexitpages = 10
maxindexedpages = 20
maxua = 30
maxreqprot = 10
maxreqmeth = 10
maxstatuscodes = 10
maxrobots = 20
maxbookmarks = 20
maxbrokenlinks = 20
maxsearchengines= 20
maxsearchstrings= 30
maxinteralerrors= 20
maxcountries = 20
# colors
# the notation is #RRGGBB (HTML-color-tripple)
background = #c0c0c0
shadow = #808080
pages = #00c0ff
files = #0080ff
visits = #ffff00
xfer = #ff0000
hosts = #ff8000
hits = #00C030
grouping = #D0D0E0
body = #FFFFFF
# output modules (text)
[output_text]
# hostname (default: localhost)
#hostname=##HOST##
# number of lines per report
# 0 - disabled
# >0 - number of lines per report
maxrequrls = 30
maxrefurls = 30
maxos = 50
maxhosts = 30
maxentrypages = 10
maxexitpages = 10
maxindexedpages = 20
maxua = 30
maxreqprot = 10
maxreqmeth = 10
maxstatuscodes = 10
maxrobots = 20
maxbookmarks = 20
maxbrokenlinks = 20
maxsearchengines= 20
maxsearchstrings= 30
maxinteralerrors= 20
maxcountries = 20
# output modules (tkcontrol)
[output_tkcontrol]
# hostname (default: localhost)
#hostname=##HOST##
maxcallednumbers = 20
maxcallingnumbers = 20
background = #c0c0c0
shadow = #808080
outgoing = #00c0ff
incomming = #00C030
grouping = #D0D0E0
body = #FFFFFF
calls = #00ffff
# input modules (clf)
[input_clf]
# filename of the input file
## '-' for stdin or a uncompressed logfile
inputfile=-
# read ahead
## multiple server can write into the same logfile which can lead to wrong
## order of records in the logfile itself because noone can guarentee that
## two servers can access the logfile in the same order how they handled the
## requests
## to get to correct results these records have to be re-sorted. the
## readaheadlimit tells the parser what the longest distance of two
## non-sorted records is.
## Example:
## ... [01/May/2000:00:01:50 +0200] "GET ...
## ... [01/May/2000:00:01:52 +0200] "GET ... <-+ 1.
## ... [01/May/2000:00:01:53 +0200] "GET ... | 2.
## ... [01/May/2000:00:01:51 +0200] "GET ... --+ 3.
## ... [01/May/2000:00:01:54 +0200] "GET ...
##
## -> readaheadlimit = 3
readaheadlimit=2
# these strings are used to detect the operating system in the useragent
# string
matchos="^Win"
matchos="^Linux"
matchos="^FreeBSD"
matchos="^Macintosh"
matchos="^PPC"
matchos="^AIX"
matchos="^IRIX"
matchos="^SunOS"
matchos="^OSF1"
matchos="^OpenBSD"
matchos="^Mac_PowerPC"
matchos="^Solaris"
matchos="^OS/2"
matchos="^HP-UX"
matchos="^NetBSD"
matchos="^BSD/OS"
# these strings are used to detect the requerying useragent in the useragent
# string
matchua="^iCab"
matchua="^MSIE"
matchua="^StarOffice"
matchua="^Lotus-Notes"
matchua="^BorderManager"
matchua="^Powermarks"
matchua="^NetMind-Minder"
matchua="^WebCapture"
matchua="^Squid"
matchua="^Mozilla"
matchua="^Konqueror"
# input modules (msiis)
[input_msiis]
# filename of the input file
## '-' for stdin or a uncompressed logfile
inputfile=-
# these strings are used to detect the operating system in the useragent
# string
matchos="^Win"
matchos="^Linux"
matchos="^FreeBSD"
matchos="^Macintosh"
matchos="^PPC"
matchos="^AIX"
matchos="^IRIX"
matchos="^SunOS"
matchos="^OSF1"
matchos="^OpenBSD"
matchos="^Mac_PowerPC"
matchos="^Solaris"
matchos="^OS/2"
matchos="^HP-UX"
matchos="^NetBSD"
matchos="^BSD/OS"
# these strings are used to detect the requerying useragent in the useragent
# string
matchua="^iCab"
matchua="^MSIE"
matchua="^StarOffice"
matchua="^Lotus-Notes"
matchua="^BorderManager"
matchua="^Powermarks"
matchua="^NetMind-Minder"
matchua="^WebCapture"
matchua="^Squid"
matchua="^Mozilla"
matchua="^Konqueror"
# input modules (wuftpd)
[input_wuftpd]
# filename of the input file
## '-' for stdin or a uncompressed logfile
inputfile=-
[input_realserver]
inputfile=-
[input_squid]
inputfile=-
|