awstats confused by 408 entries in apache log files

[James Troup]

We have a mostly idle (historical) site that we still run awstats
over. These days, for reasons I've yet to derermine, it generates a
lot of 408 responses, e.g.:

| 91.189.88.12 - - [01/Dec/2011:12:54:56 +0000] "-" 408 4808 "-" "-"

If enough of these are at the start of the logfile, awstats chokes on
the file:

| AWStats did not find any valid log lines that match your LogFormat parameter, in the 50th first non commented lines read of your log.
| Your log file /usr/share/doc/awstats/examples/logresolvemerge.pl /srv/webstats.canonical.com/logs/SERVER_NAME/SITE_NAME* | must have a bad format or LogFormat parameter setup does not match this format.
| Your AWStats LogFormat parameter is:
| 1
| This means each line in your web server log file need to have "combined log format" like this:
| 111.22.33.44 - - [10/Jan/2001:02:14:14 +0200] "GET / HTTP/1.1" 200 1234 "http://www.fromserver.com/from.htm" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)"
| And this is an example of records AWStats found in your log file (the record number 50 in your log):
| 91.189.88.12 - - [01/Dec/2011:13:10:24 +0000] "-" 408 4808 "-" "-"
| Setup ('/etc/awstats/awstats.SITE_NAME.conf' file, web server or permissions) may be wrong.
| Check config file, permissions and AWStats documentation (in 'docs' directory).

We're using LogFormat=1 and AFAIK the line quoted is valid combined
log format data.

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Ch. Tronche (ch-tronche)]

Problem present in 7.0~dfsg-5 (Ubuntu 12.04.2 LTS).

NB: 408 lines appears (notably) if the client has made a connection to the web server and not sent any request.

[Enrico Razzetti (o-enrico)]

Any solution in sight?

[Marius Gedminas (mgedmin)]

Upstream bug: https://sourceforge.net/p/awstats/bugs/914/

[Vincent Lefevre (vincent-vinc17-net)]

Any news? awstats spams me every 10 minutes! Here's the message:

Error while processing /etc/awstats/awstats.www.vinc17.net.conf
Create/Update database for config "/etc/awstats/awstats.www.vinc17.net.conf" by AWStats version 7.2 (build 1.992)
From data in log file "/srv/d_ioooi/www/www.vinc17.net/logs/www.vinc17.net-access.log"...
Phase 1 : First bypass old records, searching new record...
Direct access after last parsed record (after line 610309)
AWStats did not find any valid log lines that match your LogFormat parameter, in the 50th first non commented lines read of your log.
Your log file /srv/d_ioooi/www/www.vinc17.net/logs/www.vinc17.net-access.log must have a bad format or LogFormat parameter setup does not match this format.
Your AWStats LogFormat parameter is:
1
This means each line in your web server log file need to have "combined log format" like this:
111.22.33.44 - - [10/Jan/2001:02:14:14 +0200] "GET / HTTP/1.1" 200 1234 "http://www.fromserver.com/from.htm" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)"
And this is an example of records AWStats found in your log file (the record number 50 in your log):
72.69.147.250 - - [16/May/2016:06:20:12 +0200] "\x03" 400 0 "-" "-"
Setup ('/etc/awstats/awstats.www.vinc17.net.conf' file, web server or permissions) may be wrong.
Check config file, permissions and AWStats documentation (in 'docs' directory).

[Worik (worik-stanton)]

This is affecting me too. Possibly.

My access log has lines like:

69.199.239.200 - - [14/Jun/2016:01:59:16 +1200] "\x03" 400 0 "-" "-"

About 310 entries over a period of 10 minutes. My log format is set to 4.