awstats confused by 408 entries in apache log files

Bug #908901 reported by James Troup on 2011-12-26
This bug affects 6 people
Affects Status Importance Assigned to Milestone
awstats (Ubuntu)
Canonical Server Team

Bug Description

We have a mostly idle (historical) site that we still run awstats
over. These days, for reasons I've yet to derermine, it generates a
lot of 408 responses, e.g.:

| - - [01/Dec/2011:12:54:56 +0000] "-" 408 4808 "-" "-"

If enough of these are at the start of the logfile, awstats chokes on
the file:

| AWStats did not find any valid log lines that match your LogFormat parameter, in the 50th first non commented lines read of your log.
| Your log file /usr/share/doc/awstats/examples/ /srv/* | must have a bad format or LogFormat parameter setup does not match this format.
| Your AWStats LogFormat parameter is:
| 1
| This means each line in your web server log file need to have "combined log format" like this:
| - - [10/Jan/2001:02:14:14 +0200] "GET / HTTP/1.1" 200 1234 "" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)"
| And this is an example of records AWStats found in your log file (the record number 50 in your log):
| - - [01/Dec/2011:13:10:24 +0000] "-" 408 4808 "-" "-"
| Setup ('/etc/awstats/awstats.SITE_NAME.conf' file, web server or permissions) may be wrong.
| Check config file, permissions and AWStats documentation (in 'docs' directory).

We're using LogFormat=1 and AFAIK the line quoted is valid combined
log format data.

Changed in awstats (Ubuntu):
assignee: nobody → Canonical Server Team (canonical-server)
importance: Undecided → Medium
Launchpad Janitor (janitor) wrote :

Status changed to 'Confirmed' because the bug affects multiple users.

Changed in awstats (Ubuntu):
status: New → Confirmed
Ch. Tronche (ch-tronche) wrote :

Problem present in 7.0~dfsg-5 (Ubuntu 12.04.2 LTS).

NB: 408 lines appears (notably) if the client has made a connection to the web server and not sent any request.

Enrico Razzetti (o-enrico) wrote :

Any solution in sight?

To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Other bug subscribers