5

I have 3 log analyzer tools pre-installed on my server. In your opinion, which of the 3 analyzer tools do you find best?

My Objective: basically to analyze the error log file

Software Installed:

* Analog
* Awstats
* Webalizer

I did read through this question --> Log Analyzer for Apache

Thank you.

Community
  • 1
H. Ferrence
  • 523
  • 3
  • 10
  • 18
  • 1
    Please define "the best", and elaborate "to analyze the error log". What do you want to know? A fancy image? A plain text list? The [linked question](http://serverfault.com/q/48928/51929) has [an accepted answer](http://serverfault.com/questions/48928/log-analyzer-for-apache/48942#48942), which is useful for error logs. – Lekensteyn Feb 17 '11 at 14:01
  • Basically, I need it to analyze the error log file and give me the ability to that quickly and easily review a formatted report. Optional extras = if it has low overhead and limited drain on my server - great. If it can send me a report via email vs. me having to log into the server -- awesome. If it can organize and group errors by host (domain) -- that too is awesome. @Lekensteyn, do you have any experience with them or a personal preference? Thanks. – H. Ferrence Feb 17 '11 at 15:06
  • as my Apache logs are not that big now, I'm reading them manually, using `less` or `zless` (for compressed logs). This is certainly not the best method, but it suits me for now. For the server, I'm `logwatch`, which also has an ability for summarizing Apache logs. – Lekensteyn Feb 17 '11 at 15:22
  • @Lekensteyn -- thanks for the feedback. I have the 3 packages listed above pre-installed, so I am just looking for some experienced advice on which one to use...have a great day. – H. Ferrence Feb 17 '11 at 16:08
  • I have just setup a Graylog2 server using [this](http://deanperry.me/2011/getting-started-with-graylog2-for-logging/) tutorial. Yeah, I made the tutorial... I have just asked a question about how to add multiple error log files - http://serverfault.com/questions/310695/sending-logs-to-graylog2-server –  Sep 12 '11 at 22:53

2 Answers2

6

The three log analysers you list (Analog, Awstats & Webalizer) don't do much with Apache Error logs.

I've used ScanErrLog to summarise the Apache error_log file for several years now. I run it from Cron once or twice a day, and it remembers where it finished, to be able to pick up and add to the output. Usually, I have it produce a HTML page with counts and URLs of problems. I can produce other formats though.

tovmeod
  • 103
  • 3
Alister Bulman
  • 1,624
  • 13
  • 13
  • Thanks @Alister Bulman. Do you have a sample screen shot you could show or send me? I tried the demo on the home page of ScanErrLog but it did not work. – H. Ferrence Feb 22 '11 at 10:27
  • I've not got a live server running with it right now, but it's easy to install, just one dependency from the same site if you can't install it directly by the OS. From there, just follow the instructions and point it at an error_log file. – Alister Bulman Feb 22 '11 at 19:46
  • I use ScanErrLog in my /etc/logotate.d/lognames as a "prerotate" script. – blau Jul 02 '13 at 07:17
4

Looked around for an apache error log parser until I found this command that will parse your error file ordered by error occurrences:

sed 's^\[.*\]^^g' error.log | sed 's^\, referer: [^\n]*^^g' | sort | uniq -c | sort -n

Output: error occurrences - error text

1 AH00126: Invalid URI in request GET HTTP/1.1
1 PHP Fatal error: Allowed memory size of 536870912 bytes exhausted (tried to allocate 32 bytes) in /var/www/con/libraries/joomla/database/driver/mysql.php on line 425
108 PHP Fatal error: Allowed memory size of 536870912 bytes exhausted (tried to allocate 512 bytes) in /var/www/es/libraries/joomla/database/driver/mysql.php on line 425
156 PHP Notice: Undefined index: select in /var/www/con/cli/form_output.php on line 3
156 PHP Notice: Undefined index: inputfrom_value in /var/www/con/cli/form_output.php on line 2
157 PHP Fatal error: Allowed memory size of 536870912 bytes exhausted (tried to allocate 83 bytes) in /var/www/es/libraries/joomla/database/driver/mysql.php on line 425
202 PHP Fatal error: Allowed memory size of 536870912 bytes exhausted (tried to allocate 32 bytes) in /var/www/es/libraries/joomla/database/driver/mysql.php on line 425
218 PHP Fatal error: Allowed memory size of 536870912 bytes exhausted (tried to allocate 80 bytes) in /var/www/es/libraries/joomla/database/driver/mysql.php on line 425
316 PHP Notice: Undefined index: in /var/www/con/cli/unit.php on line 513
520 PHP Fatal error: Allowed memory size of 536870912 bytes exhausted (tried to allocate 81 bytes) in /var/www/es/libraries/joomla/database/driver/mysql.php on line 425

Gist: https://gist.github.com/marcanuy/a08d5f2d9c19ba621399

marcanuy
  • 248
  • 1
  • 3
  • 11