I want to use AwStats to parse nginx access logs.
The specified nginx log format is
'$remote_addr - $remote_user [$time_local] $status '
'"$request" $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
and logs seem to be created correctly.
The AwStats log format is
LogFormat = "%host - %logname %time1 %code %methodurl %bytesd %refererquot %uaquot %otherquot"
When I try to run it from command line, I get the following error output:
Running '"/usr/lib/cgi-bin/awstats.pl" -update -config=default -configdir="/etc/awstats"' to update config default
Create/Update database for config "/etc/awstats/awstats.conf" by AWStats version 7.2 (build 1.992)
From data in log file "/.../****-access.log"...
Phase 1 : First bypass old records, searching new record...
Searching new records from beginning of log file...
AWStats did not find any valid log lines that match your LogFormat parameter, in the 50th first non commented lines read of your log.
Your log file /.../****-access.log must have a bad format or LogFormat parameter setup does not match this format.
Your AWStats LogFormat parameter is:
%host - %logname %time1 %code %methodurl %bytesd %refererquot %uaquot %otherquot
This means each line in your web server log file need to have the following personalized log format:
%host - %logname %time1 %code %methodurl %bytesd %refererquot %uaquot %otherquot
And this is an example of records AWStats found in your log file (the record number 50 in your log):
1.2.3.4 - - [20/Sep/2015:14:18:24 +0200] 200 "POST /somescript.php HTTP/1.1" 1277 "http://some.refer.er" "Mozilla/5.0 (Windows NT 6.3; WOW64; rv:40.0) Gecko/20100101 Firefox/40.0" "-"
Setup ('/etc/awstats/awstats.conf' file, web server or permissions) may be wrong.
Check config file, permissions and AWStats documentation (in 'docs' directory).
I already tried a few different variables (the tutorial I originally followed had %code and %methodurl switched and used %host_r instead of %logname) but so far I didn't get it to work.
I even tried replacing %logname with - because I figured the missing remote user name might confuse AwStats, but to no avail.
To me, the log format and the actual log line from the error message look like they should match. What did I miss?
