39.1. The Webalizer Logfile Analysis Module
Webalizer is a freely available program for analyzing and generating reports from Apache, Squid, and WU-FTPd log files. If you are running a website and want to see which pages are visited the most, at what times the most traffic comes, or which countries it comes from, Webalizer is the tool to use. If you manage a Squid proxy server and want to see which sites clients most commonly access and when the proxy is most heavily used, it can generate reports showing that information as well.
Unlike many of the other servers that Webmin can configure, Webalizer is relatively simple. When the webalizer command is run, it reads in a log file and generates HTML pages and images based on the records in that log. It can also read statistics gathered in previous runs from a history file, so that the report can include data that is no longer in the log file. The same history file is then updated with information from the latest report for use in subsequent processing. This allows the system administrator to safely delete the original log file once it has been summarized.
By default, Webalizer uses the global configuration file /etc/webalizer.conf, which specifies the kinds of tables and graphs to generate and titles to use. On a system that hosts multiple virtual servers, several configuration files usually exist so that different reporting options can be set for different sites. Unfortunately, there is no way to combine both options from both the global and per-log configuration files—only one can be used when generating a report.
Because log files are always having new requests appended to them, Webalizer is usually run on schedule by a program like Cron. It does not have its own server process or daemon, so it depends upon a scheduler to invoke it every day or two to reprocess each log file and regenerate each report.
Due to its relative simplicity, Webalizer behaves identically on all varieties of UNIX. This means that the functionality and layout of the Webmin module is identical as well, although the Scheduled Cron Jobs module must be installed and working for the scheduled reporting feature to work.
Webmin's Webalizer module icon can be found in the Servers category. When you first click on it, a page listing all the log files that Apache or Squid have been configured to use on your system will be displayed, as shown in Figure 39.1. By analyzing the configurations of those servers, the module can generally work out where all of the logs on your system that can be analyzed are located. However, you can easily add extra log files to the module for reporting as well.
Figure 39.1. The Webalizer module main page.
If the module detects that Webalizer is not actually installed on your system, the main page will display an error message. If this happens, you will need to install it either from your Linux distribution CD or the program's website at www.webalizer.org. Many versions of Linux include a Webalizer package as standard, which you can install using the Software Packages module (covered in Chapter 12).
If you plan to use the module to analyze multiple log files, it is important to make sure that the global Webalizer configuration is set up correctly to support this. The version that comes with some Linux distributions (like Red Hat) incorrectly uses absolute paths for the history and caches files that store information about previous processing runs. To fix this, follow these steps before setting the options for any log files:
1. | On the module's main page, click on the Edit Global Options button at the bottom. This will take you to a form for editing options that apply to all log files. |
2. | In the Webalizer history file field, make sure that the second radio button is selected and webalizer.hist appears in the text box. If some absolute path like /var/stats/webalizer.hist is displayed, change it. |
3. | Similarly, make sure that the Webalizer incremental file field is set to webalizer.current and not some full path. |
4. | The Webalizer DNS cache file can be left set to an absolute path, if you like, so that DNS information is shared between different reports. |
5. | Click the Save button at the bottom of the page to record the new settings. |