<?xml version="1.0" ?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Logmonster - log utility for merging, sorting, and processing web logs</title>
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
<link rev="made" href="mailto:matt@mattbook.simerson.net" />
</head>
<body style="background-color: white">
<!-- INDEX BEGIN -->
<div name="index">
<p><a name="__index__"></a></p>
<!--
<ul>
<li><a href="#name">NAME</a></li>
<li><a href="#synopsis">SYNOPSIS</a></li>
<li><a href="#usage">USAGE</a></li>
<li><a href="#description">DESCRIPTION</a></li>
<ul>
<li><a href="#motivation">MOTIVATION</a></li>
<li><a href="#features">FEATURES</a></li>
</ul>
<li><a href="#installation">INSTALLATION</a></li>
<li><a href="#diagnostics">DIAGNOSTICS</a></li>
<li><a href="#dependencies">DEPENDENCIES</a></li>
<li><a href="#bugs_and_limitations">BUGS AND LIMITATIONS</a></li>
<li><a href="#author">AUTHOR</a></li>
<li><a href="#acknowledgements">ACKNOWLEDGEMENTS</a></li>
<li><a href="#todo">TODO</a></li>
<li><a href="#see_also">SEE ALSO</a></li>
<li><a href="#licence_and_copyright">LICENCE AND COPYRIGHT</a></li>
</ul>
-->
</div>
<!-- INDEX END -->
<p>
</p>
<h1><a name="name">NAME</a></h1>
<p>Logmonster - log utility for merging, sorting, and processing web logs</p>
<p>
</p>
<hr />
<h1><a name="synopsis">SYNOPSIS</a></h1>
<p>logmonster.pl -i <interval> [-v] [-r] [-n] [-b N]</p>
<pre>
Interval is one of:</pre>
<pre>
hour (last hour)
day (yesterday)
month (last month)</pre>
<pre>
Optional:</pre>
<pre>
-v verbose - lots of status messages
-n dry run - do everything except feed the logs into the processor
-r report - last periods hit counts
-b N back N days - use with -i day to process logs older than one day</pre>
<p>
</p>
<hr />
<h1><a name="usage">USAGE</a></h1>
<p>To see what it will do without actually doing anything</p>
<pre>
/usr/local/sbin/logmonster -i day -v -n</pre>
<p>From cron:</p>
<pre>
5 1 * * * /usr/local/sbin/logmonster -i day</pre>
<p>From cron with a report of activity:</p>
<pre>
5 1 * * * /usr/local/sbin/logmonster -i day -v</pre>
<p>
</p>
<hr />
<h1><a name="description">DESCRIPTION</a></h1>
<p>Logmonster is a tool to collect log files from one or many web servers, split them based on the virtual host they were served for, sort the logs into cronological order, and pipe the sorted logs to a log file analyzer. Webalizer, http-analyze, and AWstats are currently supported.</p>
<p>
</p>
<h2><a name="motivation">MOTIVATION</a></h2>
<p>Log collection: I have several web sites that are mirrored. I only care agreggate statistics. To accomplish that, the logs must be collected from each server.</p>
<p>Sorting: Since most log processors require the log file entries to be in chronological order, simply concatenating them, or feeding them one after another does not work. Logmonster sorts all the log entries for each vhost into chronological order.</p>
<p>Agnostic: If I want to switch to another log processor, it is simple and painless. Each domain can have a preferred processor.</p>
<p>
</p>
<h2><a name="features">FEATURES</a></h2>
<ul>
<li><strong><a name="log_retrieval_from_one_or_many_hosts" class="item">Log Retrieval from one or many hosts</a></strong>
</li>
<li><strong><a name="ouputs_to_webalizer_http_analyze_and_awstats" class="item">Ouputs to webalizer, http-analyze, and AWstats.</a></strong>
</li>
<li><strong><a name="automatic_vhost_detection" class="item">Automatic vhost detection</a></strong>
<p>Logmonster generates config files as required (ie, awstats.example.com.conf).</p>
</li>
<li><strong><a name="efficient" class="item">Efficient</a></strong>
<p>Reads directly from compressed log files to minimize network and disk usage. Skips sorting if you only have logs from a single host.</p>
</li>
<li><strong><a name="flexible_update_intervals" class="item">Flexible update intervals</a></strong>
<p>runs monthly, daily, or hourly</p>
</li>
<li><strong><a name="reporting" class="item">Reporting</a></strong>
<p>logs an activity report and sends an email friendly report.</p>
</li>
<li><strong><a name="reliable" class="item">Reliable</a></strong>
<p>When something goes wrong, it provides useful error messages.</p>
</li>
</ul>
<p>
</p>
<hr />
<h1><a name="installation">INSTALLATION</a></h1>
<dl>
<dt><strong><a name="install" class="item">Step 1 - Download and install (it's FREE!)</a></strong></dt>
<dd>
<p><a href="https://www.tnpi.net/cart/index.php?crn=210&rn=385&action=show_detail">https://www.tnpi.net/cart/index.php?crn=210&rn=385&action=show_detail</a></p>
<p>Install like typical perl modules:</p>
<pre>
perl Makefile.PL
make test
make install</pre>
<p>To install the config file, 'make conf' or 'make newconf'. The newconf target will overwrite any existing config file.</p>
</dd>
<dt><strong><a name="step_2_edit_logmonster_conf" class="item">Step 2 - Edit logmonster.conf</a></strong></dt>
<dd>
<pre>
vi /usr/local/etc/logmonster.conf</pre>
</dd>
<dt><strong><a name="step_3_edit_your_web_servers_config" class="item">Step 3 - Edit your web servers config</a></strong></dt>
<dl>
<dt><strong><a name="apache" class="item">Apache</a></strong></dt>
<dd>
<p>Adjust the CustomLog and ErrorLog definitions. We make two changes, appending %v (the vhost name) to the CustomLog and adding cronolog to automatically rotate the log files.</p>
<pre>
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %v" combined
CustomLog "| /usr/local/sbin/cronolog /var/log/apache/%Y/%m/%d/access.log" combined
ErrorLog "| /usr/local/sbin/cronolog /var/log/apache/%Y/%m/%d/error.log"</pre>
</dd>
<dt><strong><a name="lighttpd" class="item">Lighttpd</a></strong></dt>
<dd>
<pre>
accesslog.format = "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %v"
accesslog.filename = "|/usr/local/sbin/cronolog /var/log/http/%Y/%m/%d/access.log"
server.errorlog = "/var/log/http/error.log"</pre>
</dd>
</dl>
</dd>
<dt><strong><a name="step_4_test_manually_then_add_to_cron" class="item">Step 4 - Test manually, then add to cron.</a></strong></dt>
<dd>
<pre>
crontab -u root -e
5 1 * * * /usr/local/sbin/logmonster -i day</pre>
</dd>
<dt><strong><a name="step_5_read_the_faq" class="item">Step 5 - Read the FAQ</a></strong></dt>
<dd>
<p><a href="http://tnpi.net/wiki/Logmonster_FAQ">http://tnpi.net/wiki/Logmonster_FAQ</a></p>
</dd>
<dt><strong><a name="step_6_enjoy" class="item">Step 6 - Enjoy</a></strong></dt>
<dd>
<p>Enjoy the daily summary emails.</p>
</dd>
</dl>
<p>
</p>
<hr />
<h1><a name="diagnostics">DIAGNOSTICS</a></h1>
<p>Run in verbose mode (-v) to see additional status and error messages. Verbosity can be increased by appending another -v, or even (-v -v -v) maximal verbosity. If that is not enough, the source is with you.</p>
<p>Also helpful when troubleshooting is the ability to skip cleanup (so logfiles do not have to be fetched anew) with the --noclean command line option.</p>
<p>
</p>
<hr />
<h1><a name="dependencies">DEPENDENCIES</a></h1>
<p>Not perl builtins</p>
<pre>
Compress::Zlib
Date::Parse (TimeDate)
Params::Validate</pre>
<p>Builtins</p>
<pre>
Carp
Cwd
FileHandle
File::Basename
File::Copy</pre>
<p>
</p>
<hr />
<h1><a name="bugs_and_limitations">BUGS AND LIMITATIONS</a></h1>
<p>Report problems to author. Patches welcome.</p>
<p>
</p>
<hr />
<h1><a name="author">AUTHOR</a></h1>
<pre>
Matt Simerson (msimerson@cpan.org)</pre>
<p>
</p>
<hr />
<h1><a name="acknowledgements">ACKNOWLEDGEMENTS</a></h1>
<pre>
Gernot Hueber - sumitted the daily userlogs feature
Lewis Bergman - funded authoring of several features
Raymond Dijkxhoorn - suggested not sorting the files for one log host
Earl Ruby - a better regexp for apache log date parsing</pre>
<p>
</p>
<hr />
<h1><a name="todo">TODO</a></h1>
<p>Add support for analog.</p>
<p>Add support for individual webalizer.conf file for each domain (this will likely not happen until someone submits a diff. I don't use webalizer any more).</p>
<p>Delete log files older than X days/months - low priority, it's easy and low maintenance to manually delete a few months log files when I'm sure I don't need them any longer.</p>
<p>Do something with error logs (other than just compress)</p>
<p>If files to process are larger than 10MB, find a nicer way to sort them rather than reading them all into a hash. Now I create two hashes, one with data and one with dates. I sort the date hash, and using those sorted hash keys, output the data hash to a sorted file. This is necessary as wusage and http-analyze require logs to be fed in chronological order. Look at awstats logresolvemerge as a possibility.</p>
<p>Add config file setting for the location of awstats.pl</p>
<p>
</p>
<hr />
<h1><a name="see_also">SEE ALSO</a></h1>
<p><a href="http://tnpi.net/wiki/Logmonster">http://tnpi.net/wiki/Logmonster</a></p>
<p>
</p>
<hr />
<h1><a name="licence_and_copyright">LICENCE AND COPYRIGHT</a></h1>
<p>Copyright (c) 2003-2012, The Network People, Inc. (<a href="mailto:info@tnpi.net">info@tnpi.net</a>) All rights reserved.</p>
<p>Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:</p>
<p>Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.</p>
<p>Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.</p>
<p>Neither the name of the The Network People, Inc. nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.</p>
<p>THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DIS CLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.</p>
</body>
</html>