0

My apache-2.4 LogFormat:

LogFormat "%h %l %u %t \"%r\" %>s %b ref=\"%{Referer}i\" ua=\"%{User-Agent}i\" host=\"%{Host}i\" xff=\"%{X-Forwarded-for}i\""

Sample Logfile line for reference: 

"10.10.10.200 - - [29/Jan/2017:03:45:15 +0100] "GET /health-check/97b0d3c3dd9cfaf7f532aed814f2a049 HTTP/1.0" 200 19 ref="-" ua="-" host="10.10.10.10" xff="-""

My problem seems to be to get the IPs that are written here host="10.10.10.10" into the %host variable for awstats. I think it's because of the quotes around the IP. As you can see I've tried to quote the quotes, but that doesn't seem to work. So I am basically looking for a away to tell awstats that the IP is in double quotes and it should write that IP into the %host variable.

My tries for awstats LogFormat so far (+ some slight variation on these). On early tries I still thought the first column had the right IP for me, which is not the case:

#LogFormat="%host - - %time1 %methodurl %code %bytesd ref=%refererquot ua=%uaquot host=\"%extra1\" xff=\"%extra2\""
#LogFormat="%host %other %other %time1 %methodurl %code %bytesd %refererquot %uaquot %other %other"
#LogFormat="%h %l %u %t \"%r\" %>s %b ref=\"%{Referer}i\" ua=\"%{User-Agent}i\" host=\"%{Host}i\" xff=\"%{X-Forwarded-for}i\""
#LogFormat="%host - - %time1 %methodurl %code %bytesd %refererquot %uaquot \"%extra1\" \"%extra2\""
#LogFormat="%other - - %time1 %methodurl %code %bytesd ref="-" ua=%uaquot host=\"%host\" xff=%otherquot"
#LogFormat='%other - - %time1 %methodurl %code %bytesd ref="-" ua=%uaquot host="%host" xff=%otherquot'

Errors I get are either:

Error: Your personalized LogFormat does not include all fields required by AWStats (Add %host in your LogFormat string).

or

AWStats did not find any valid log lines that match your LogFormat parameter, in the 50th first non commented lines read of your log.

Or I might be on the completely wrong path here, in which case I am open for suggestions ;-)

cptPH
  • 163
  • 2
  • 11

1 Answers1

0

This is what i came up with in the end: 

LogFormat="%other - - %time1 %methodurl %code %bytesd ref=\"%referer\" ua=\"%ua\" host=%host xff=%extra1"

Apparently using %uaquote and %refererquot was misleading because it didn't work for me with double quotes as I thought it would. And the only way to get the real host into awstats was to use host=%host, which means that the hosts are now double quoted in awstats.

cptPH
  • 163
  • 2
  • 11