[root@test src]# wget http://prdownloads.sourceforge.net/awstats/awstats-6.95.tar.gz
[root@test src]# tar zxvf awstats-6.95.tar.gz
[root@test src]# mv awstats-6.95 /usr/local/awstats
[root@test src]# mkdir /var/lib/awstats
[root@test awstats]# mkdir -m 755 /usr/local/awstats/data/
[root@test src]# cd /usr/local/awstats/
[root@test awstat]# perl /usr/local/awstats/tools/awstats_configure.pl
只填写域名，其它选项全部y或默认
[root@test awstats]# vi/etc/awstats/awstats.www.123.com.conf
修改日志文件路径：
logfile=/usr/local/awstats/tools/logresolvemerge.pl/home/tool/access.20100817.11*.log |
此为用awstats脚本自动合并分析所有/home/tool/access.20100817.11*.log日志
如果日志使用tar -zcvf 压缩，logresolvemerge.pl会自动调用zcat
也可以同时列出多个日志文件，如以下格式：
logfile=/usr/local/awstats/tools/logresolvemerge.pl 1.log2.log |
合并日志也可用以下方式：
cat a.log b.log c.log | sort -m -t –k 4 > log
将三个日志以空格为分隔符，对第四列进行排序，结果保存在log
添加geoip插件使awstats可以显示用户地理位置
cpan install geo::ip
[root@test awstats]# cd /usr/local/src/
[root@test src]# wget http://geolite.maxmind.com/download/geoip/api/c/geoip.tar.gz
[root@test src]# tar zxvf geoip.tar.gz
[root@test src]# cd geoip-1.4.6/
[root@test geoip-1.4.6]# ./configure && make &&make install
[root@test src]# wget http://geolite.maxmind.com/download/geoip/api/perl/geo-ip-1.38.tar.gz
[root@test src]# tar zxvf geo-ip-1.38.tar.gz
[root@test src]#cd geo-ip-1.38
[root@test geo-ip-1.38]# perl makefile.pl && make&& make install
[root@test src]# wget http://geolite.maxmind.com/download/geoip/database/geolitecity.dat.gz
[root@test src]# gunzip geolitecity.dat.gz
[root@test src]# cp geolitecity.dat /usr/local/share/geoip/
[root@test src]# vi /etc/awstats/awstats.www.dayu360.com.conf
启用或添加以下选项：
loadplugin=tooltips
loadplugin=decodeutfkeys
loadplugin=geoip geoip_standard/usr/local/share/geoip/geoip.dat
loadplugin=geoip_city_maxmind geoip_standard/usr/local/share/geoip/geolitecity.dat
[root@test awstats]# perl/usr/local/awstats/wwwroot/cgi-bin/awstats.pl -config=www.dayu360.com –update
更新awstats数据库（即web页面显示的内容）
当登陆到awstats的web界面时出现提示：
error: access to statistics is only allowed from anauthenticated session to authenticated users.
则需把/etc/awstats/awstats.www.123.com.conf中：
allowaccessfromwebtoauthenticatedusersonly=0
访问web页：
http://192.168.0.80/awstats/awstats.pl?config=www.123.com
以上完成了基本设置，下面进行一些高级设置：
（1）不同的日志格式对应不同的日志格式的设置：
一、若对运行在apache上的网站产生的日志（combined格式）进行分析则在/etc/awstats/awstats.www.123.com.conf文件中配置：
logtype=w
logformat=1
二、若要对运行在nginx上的网站产生的日志进行分析，首先需要在nginx的配置文件nginx.conf中更改产生日志的格式：
log_format main '$remote_addr - $remote_user [$time_local] $request '
'$status$body_bytes_sent $http_referer '
'$http_user_agent$http_x_forwarded_for';
access_log logs/access.log main;
然后在/etc/awstats/awstats.www.123.com.conf文件中配置：
logtype=w
logformat=1
三、若nginx日志格式为：
log_format main '$remote_addr - $remote_user [$time_local] $request '
'$status$body_bytes_sent $http_referer '
'$http_user_agent';
access_log logs/access.log main;
则在/etc/awstats/awstats.www.123.com.conf文件中配置：
logtype=w
logformat=%host %other %logname%time1 %methodurl %code %bytesd %refererquot %uaquot
注：网上某些文章的nginx.conf中log_format后面加了$http_x_forwarded_for（来源ip），然而其在/etc/awstats/awstats.www.123.com.conf文件中配置还是：
logformat=%host %other%logname %time1 %methodurl %code %bytesd %refererquot %uaquot，则因为缺少对应关系而使得awstats报错。
可以通过修改nginx的日志格式（把$http_x_forwarded_for去掉）即可。
最后注意：通过测试发现%methodurl字段必须对应get的日志，若有post的日志或“-”则会报错。
sftp自动上传日志：
apache服务器：
useradd -u 1000 httplog -d /home/httplog/
passwd httplog
awstat 服务器：
创建get日志的脚本
vi /usr/local/shell/get_weblog.sh
#!/bin/sh
export web1=172.16.0.115;
export web2=172.16.0.116;
export web3=172.16.0.117;
export user=httplog;
exportpass=bdghs3ei4dsh86qbxjv9;
exportcpath=/home/httpdlog/`date +%y`/`date --date='1 days ago' +%m`/
exportweb1=web1.access.`date --date='1 days ago' +%y%m%d`.log
exportweb2=web2.access.`date --date='1 days ago' +%y%m%d`.log
exportweb3=web3.access.`date --date='1 days ago' +%y%m%d`.log
exportspath=/opt/weblogs/`date +%y`/`date --date='1 days ago' +%m`/
echo sftp start;
if [ ! -d $spath ]; then
mkdir -p $spath; fi
lftp -u ${user},${pass}sftp://${web1}
lcd $spath
get $cpath/$web1
open sftp://${user}:${pass}@$web2
get $cpath/$web2
open sftp://${user}:${pass}@$web3
get $cpath/$web3
bye
eof
echo get web logdone!!!;
创建awstat更新脚本
vi /usr/local/shell/awstat-update.sh
#!/bin/bash
configfiles=www
#configfiles=www bbsbuy
domain=123.com
command=/usr/local/awstats/wwwroot/cgi-bin/awstats.pl
for conf in ${configfiles};
do
${command} -update-config=${conf}.${domain} -databasebreak=month;
${command} -update-config=${conf}.${domain} -databasebreak=day;
done
日历显示cgi
vi/usr/local/awstat/wwwroot/cgi-bin/calendar.pl
#!/usr/bin/perl
@domain_allow=(www);
#@domain_allow=(www,prom,buy,tag,blog,member);
$site=$env{query_string};
if ($site eq ){
$site=www;
}else{
$reject=1;
foreach $sub_domain (@domain_allow){
if ($sub_domain eq $site){
$reject=0;
}
}
}
# the awstats config filename
$config=$site..123.com;
### begin program ###
@now=localtime(time);
$today_day=$now[3];
$today_month=$now[4]+1;
$today_year=$now[5]+1900;
@yesterday=localtime(time-3600*24);
$ytd_day=$yesterday[3];
$ytd_month=$yesterday[4]+1;
$ytd_year=$yesterday[5]+1900;
$lastmonth=$today_month-1;
$lastmonth_year=$today_year;
if($lastmonth
{
$lastmonth=1;
$lastmonth_year=$today_year-1;
}
$lastyear=$today_year-1;
print content-type:text/html\n\n;
print\n;
if ($reject==1){
print subdomain:'$site' is notaccepted, please contact admin;
}else{
print choose subdomain:;
foreach $subdomain (@domain_allow){
if($subdomain eq $site) {
$selected=selected='selected';
}else{
$selected=;
}
print $subdomain;
}
;
print today;
print yesterday;
print thismonth;
print lastmonth;
print thisyear ;
print lastyear ;
print \n\n;
printcal($today_year, $today_month);
print \n
\n;
printcal($lastmonth_year, $lastmonth);
}
print\n\n;
##### methods ######
sub getlink
{
my($year, $month, $day)=@_;
$query=;
if($day)
{
$query=databasebreak=day&day=${day}&month=${month}&year=${year};
}
elsif($month)
{
$query=month=${month}&year=${year};
}
elsif($year)
{
$query=year=${year}&month=all;
}
return awstats.pl?config=${config}&$query;
}
sub printcal
{
my($y, $m)=@_;
open(cal, cal $m $y|);
@days = ;
close(cal);
$month = $days[0];
$month=~ s/\s\s\s*//g;
$mbg=;
if($m==$today_month&& $y==$today_year)
{
$mbg=bgcolor='#ffaaaa';
}
print $month
\n;foreach $dy (split(/ /,$days[1]))
{
$dy ;}
\n;shift(@days);
shift(@days);
foreach $line (@days)
{
chomp $line;
$line =~ s/^\s+//;
$line =~ s/\s+$//;
print ; foreach $d (split(/\s+/, $line))
{
$bg=;
if($d==$today_day &&$m==$today_month && $y==$today_year)
{
$bg=bgcolor='#ffaaaa';
}
$d ; }
\n;
}
\n;
}
chmod +x/usr/local/awstat/wwwroot/cgi-bin/calendar.pl
awstats 6.9.5默认即为gbk编码，改为utf-8后部分搜索词乱码按照网上所述方式未能解决，gbk状态即无乱码
修改awstatspagecode为gbk
cd /usr/local/awstats/wwwroot/cgi-bin/lang
cp awstats-cn.txtawstats-cn-gbk.txt
viawstats-cn-gbk.txt
pagecode=utf-8
修改为
pagecode=gbk
iconv -f utf-8 -t gbkawstats-cn-gbk.txt > awstats-cn.txt
添加qq ip库
wget http://blog.pcware.cn/downloads/ip_geo_qqwry.zip
wget http://www.ieasy.org/download/qqwry.pl
wget http://www.ieasy.org/download/qqhostinfo.pm
ip_geo_qqwry.zip 和 qqwry.pl 任选其一
unzip ip_geo_qqwry.zip
chmod 755 ip_geo_qqwry.pl
mv ip_geo_qqwry.pl /usr/local/awstats/wwwroot/cgi-bin/
wget http://update.cz88.net/soft/qqwry.rar
wget http://packages.sw.be/unrar/unrar-3.9.10-1.el5.rf.x86_64.rpm
rpm -ivhunrar-3.9.10-1.el5.rf.x86_64.rpm
mkdir qqwry && cdqqwry
unrar e ../qqwry.rar
mkdir/usr/local/share/ip_geo/
mv qqwry.dat/usr/local/share/ip_geo/
cd ..
mv qqhostinfo.pm/usr/local/awstats/wwwroot/cgi-bin/plugins/
vi/usr/local/awstats/wwwroot/cgi-bin/plugins/qqhostinfo.pm
require${dir}/plugins/qqwry.pl;
修改为：
require /usr/local/awstats/wwwroot/cgi-bin/ip_geo_qqwry.pl;
解决awstats gbk页面ip 物理地址乱码：
vi/usr/local/awstats/wwwroot/cgi-bin/ip_geo_qqwry.pl
注释掉以下两行
#use encode;
# $ip_geo_addr=decode(gbk,$ip_geo_addr);
附上ip_geo_qqwry.pl源码，以防下载链接失效
#/* copyright (c) 2002-2009proguru.
# changuoqiang[at]gmail[dot]com
# http://blog.pcware.cn
#
# the source code is free; you canredistribute it and/or
# modify it under the terms of the gnu lessergeneral public
# license as published by the free softwarefoundation; either
# version 2.1 of the license, or (at youroption) any later version.
#
# the source code is distributed in the hopethat it will be useful,
# but without any warranty; without even theimplied warranty of
# merchantability or fitness for a particularpurpose. see the gnu
# lesser general public license for moredetails.
#
# you should have received a copy of the gnulesser general public
# license along with the kwinui; if not, writeto the free
# software foundation, inc., 59 temple place,suite 330, boston, ma
# 02111-1307 usa. */
#
#/*
# * jun 14,2009
# */
#use encode;
sub ipwhere{
my $ip = shift;
my @ip = split(/\./, $ip);
my $ip_num = $ip[0]*256**3 + $ip[1]*256**2 + $ip[2]*256+ $ip[3];
#my$qqwry_dat=${dir}/plugins/qqwry.dat;
my $qqwry_dat =/usr/local/share/ip_geo/qqwry.dat;
open(infile, $qqwry_dat);
binmode(infile);
my $first_index_of_begin_ip,$last_index_of_begin_ip;
sysread(infile,$first_index_of_begin_ip, 4);
sysread(infile,$last_index_of_begin_ip, 4);
$first_index_of_begin_ip =unpack(l,$first_index_of_begin_ip);
$last_index_of_begin_ip =unpack(l,$last_index_of_begin_ip);
my $total_index_of_begin_ip =($last_index_of_begin_ip - $first_index_of_begin_ip)/7 + 1;
#binary search the begin ip
my $begin_index, $end_index =$total_index_of_begin_ip;
my $middle_index, $middle_ip,$middle_ip_num;
# while(1){
# if($begin_index >= $end_index-1){
# last;
# }
# $middle_index = int(($end_index +$begin_index)/2);
# seek(infile, $first_index_of_begin_ip +$middle_index*7, 0);
# read(infile, $middle_ip, 4);
# $middle_ip_num = unpack(l,$middle_ip);
# if($ip_num
# $end_index = $middle_index ;
# } else {
# $begin_index = $middle_index ;
# }
# }
while($begin_index
$middle_index = int (($end_index +$begin_index)/2);
seek(infile, $first_index_of_begin_ip +7*$middle_index, 0);
read(infile, $middle_ip, 4);
$middle_ip_num = unpack(l,$middle_ip);
if($ip_num == $middle_ip_num){
$begin_index = $middle_index;
last;
} elsif ($ip_num
$end_index = $middle_index;
} else {
$begin_index = $middle_index;
}
}
my $end_ip_index_offset, $end_ip,$end_ip_num, $end_ip_offset;
$end_ip_index_offset =$first_index_of_begin_ip + 7*($begin_index) + 4;
seek(infile, $end_ip_index_offset, 0);
read(infile, $end_ip_offset, 3);
$end_ip_offset = unpack(l,$end_ip_offset.\0);
seek(infile, $end_ip_offset, 0);
read(infile, $end_ip, 4);
$end_ip_num = unpack(l,$end_ip);
if($ip_num
my $offset, $position_mode,$geo_country_mode_2_pos=0;
$/=\0;
read(infile,$position_mode,1);
#position mode 1
if ($position_mode eq \1) {
read(infile,$offset,3);
$offset =unpack(l,$offset.\0);
seek(infile,$offset,0);
read(infile,$position_mode,1);
}
#position mode 2
if ($position_mode eq \2) {
read(infile,$offset,3);
$geo_country_mode_2_pos =tell(infile);
$offset =unpack(l,$offset.\0);
seek(infile,$offset,0);
} else {
seek(infile,-1,1);
}
$ip_geo_country=;
if($geo_country_mode_2_pos != 0){
seek(infile,$geo_country_mode_2_pos, 0);
}
#geo local, geo local only positionmode 2
read(infile,$position_mode,1);
if($position_mode eq \2) {
read(infile,$offset,3);
$offset =unpack(l,$offset.\0);
seek(infile,$offset,0);
} else {
seek(infile,-1,1);
}
$ip_geo_local=;
} else{
$ip_geo_country = 未知数据;
}
chomp($ip_geo_country, $ip_geo_local);
$/=\n;
close(infile);
my $ip_geo_addr=$ip_geo_country$ip_geo_local;
$ip_geo_addr =~ s/cz88\.net//isg;
# $ip_geo_addr=decode(gbk,$ip_geo_addr);
return $ip_geo_addr;
}
1;
更新ip库脚本：
# task file of update ipdatabase in [crontab]
tmp_path=/tmp/ipdata
geo_path=/usr/local/share/geoip/
qip_path=/usr/local/share/ip_geo/
#last file stat
stat/usr/local/share/geoip/geolitecity.dat >> /var/log/ipdata.log
stat/usr/local/share/geoip/geoip.dat >> /var/log/ipdata.log
stat/usr/local/share/ip_geo/qqwry.dat >> /var/log/ipdata.log
mkdir $tmp_path
cd $tmp_path
#
/usr/bin/wgethttp://geolite.maxmind.com/download/geoip/api/c/geoip.tar.gz
/usr/bin/wgethttp://www.maxmind.com/download/geoip/database/geolitecity.dat.gz
/usr/bin/wgethttp://update.cz88.net/soft/qqwry.rar
#--> end of download
/bin/tar zxf geoip.tar.gz
/usr/bin/gzip -dfgeolitecity.dat.gz
/usr/bin/unrar e qqwry.rar
mv -f geoip-*/data/geoip.dat$geo_path
mv -f geo*.dat $geo_path
mv -f qqwry.dat $qip_path
cd ..
rm -rf $tmp_path
#new file stat
stat/usr/local/share/geoip/geolitecity.dat >> /var/log/ipdata.log
stat/usr/local/share/geoip/geoip.dat >> /var/log/ipdata.log
stat/usr/local/share/ip_geo/qqwry.dat >> /var/log/ipdata.log
改进：
apache server使用如下脚本处理日志
策略： crontab每天执行此脚本，自动备份前一天日志，并删除一周前的未压缩日志，30天前的压缩日志
#!/bin/sh
host=web1
log_path=/home/httpdlog/`date+%y`/`date --date='1 days ago' +%m`/
bak_path=/opt/backup/weblog/`date+%y`/`date --date='1 days ago' +%m`/
yesterday=`date --date='1days ago' +%y%m%d`
bak_file=$host-$yesterday.tgz
log_file=$host.access.$yesterday.log
if [ ! -d $bak_path ]; then
mkdir -p $bak_path; fi
tar zcfp $bak_path/$bak_file$log_path/$log_file
find /opt/backup/ -mtime +30-name *.log -exec rm -rf {} \;
find /opt/backup/ -depth -empty -type d -exec rmdir -p {} \;
find /home/httpdlog/ -mtime+7 -name *.log -exec rm -rf {} \;
find /home/httpdlog/ -depth -empty-type d -exec rmdir -p {} \;
echo done!
awstats server：
cat get_weblog_tgz.sh
#!/bin/sh
export web1=172.16.0.115;
export web2=172.16.0.116;
export web3=172.16.0.117;
export user=httplog;
exportpass=bdghs3ei4dsh86qbxjv9;
export cpath=/opt/backup/weblog/`date+%y`/`date --date='1 days ago' +%m`/
export web1=web1-`date--date='1 days ago' +%y%m%d`.tgz
export web2=web2-`date--date='1 days ago' +%y%m%d`.tgz
export web3=web3-`date--date='1 days ago' +%y%m%d`.tgz
export spath=/opt/weblogs/`date+%y`/`date --date='1 days ago' +%m`/
echo sftp start;
if [ ! -d $spath ]; then
mkdir -p $spath; fi
lftp -u ${user},${pass}sftp://${web1}
lcd $spath
get $cpath/$web1
opensftp://${user}:${pass}@172.16.0.116
get $cpath/$web2
opensftp://${user}:${pass}@172.16.0.117
get $cpath/$web3
bye
eof
echo get web logdone!!!;