Log Analysis
Your log file contains a vast amount of information on the traffic that your website receives. As the log is an ASCII (text) file, it can be read by human beings. However, the sheer amount of information contained within it makes it difficult to discern much. To fully gain an understanding of what your traffic is doing, where it's coming from etc. The log file must be processed by a program designed to glean all the information from your log and present it in a form which is easily digested.
One of the programs that makes up your netConsole - Log Analysis, does just this. It provides you with access to not just your account's raw HTTP log but to detailed reports that were created from the log file. To access Log Analysis, simply click on the "Log Analysis" link from the main page of your netConsole, as shown below:
Viewing Log Analysis Reports
Under the graph you will find a brief summary of the number of hits your site has received, broken down by month. Each month lists the total number of hits that month, the maximum number of hits that month, and the average number of hits that month, as shown below. Clicking on a particular month will take you to a page with much more detail related to the traffic your website has received.

The Monthly Detail Reports
Like the summary report you first see when entering the Log Analysis section of the netConsole, the monthly detail reports consist of graphical representations of the data from your log files as well as tabular views of the same data. As you would expect, the monthly reports contain much more information than the summary report:- Summary data on total Hits, Files, Pages, Visits, KBytes, Unique Sites, Unique URLs, Unique Referrers, Unique Usernames and Unique User Agents
- Summary data on average and maximum Hits per Hour, Hits per Day, Files per Day, Pages per Day, Visits per Day and KBytes per Day.
- Summary data on Hits by Response Code
- Detailed data for Hits, Files, Pages, Visits, Sites and KBytes data for every day of the month.
- Detailed data for average and total Hits, Files, Pages, Visits, Sites and KBytes data for every hour of the day.
- Detailed data for Top URLs, Top URLs by KBytes, Top Entry/Exit Pages, Top Sites, Top Sites by KBytes, Top Referrers, Top Usernames, Top User Agents and Top Countries.
Downloading Logs and Log Reports Below the summary graph and the traffic for your website broken down by month are a number of options that allow you to download your log file and the report that was generated from it:
Download a raw-uncompressed copy your logfile
Note: Depending on the size of your log file and the speed of your connection
to the Internet, this may be very time-consuming.
Download a Zip-compressed copy of your logfile
Download a gzip-compressed copy of your logfile
Note: Gzip is a free
compression utility. Gzip files can often be handled by other compression
utilities such as WinZip.
Download a gzip-compressed TAR archive of this report for offline viewing
Download a ZIP-compressed copy of this report for offline viewing
If you want to process your log using a different application, you will need to download the raw log file to your machine. We currently recommend OpenWebScope.
Terms Used In the Reports
To fully understand the reports generated from your log files you should recognize the terms used within them.Hits
The total number of requests made to the server during the given time period
(month, day, hour etc..).
Files
The total number of hits (requests) that actually resulted in something being
sent back to the user. Not all hits will send data, such as 404-Not Found
requests and requests for pages that are already in the browsers cache.
Pages
Are those URLs that would be considered the actual page being requested, and
not all of the individual items that make it up (such as graphics and audio
clips). Some people call this metric page views or page impressions, and defaults
to any URL that has an extension of .htm, .html or .cgi.
Visits
Occur when some remote site makes a request for a page on your server for
the first time. As long as the same site keeps making requests within a given
timeout period, they will all be considered part of the same Visit. If the
site makes a request to your server, and the length of time since the last
request is greater than the specified timeout period (default is 30 minutes),
a new Visit is started and counted, and the sequence repeats. Since only pages
will trigger a visit, remotes sites that link to graphic and other non- page
URLs will not be counted in the visit totals, reducing the number of false
visits.
Sites
The number of unique IP addresses/hostnames that made requests to the server.
Care should be taken when using this metric for anything other than that.
Many users can appear to come from a single site, and they can also appear
to come from many ip addresses so it should be used simply as a rough gauge
as to the number of visitors to your server.
KBytes
A unit for measuring data that is equivalent to 1024 bytes. Note: The information
given in your log reports for Kbytes is not a full representation of the bandwidth
used by your site.
URLs
Uniform Resource Locator. All requests made to a web server need to request
something. A URL is that something, and represents an object somewhere on
your server, that is accessible to the remote user, or results in an error
(ie: 404 - Not found). URLs can be of any type (HTML, Audio, Graphics, etc...).
Referrers
Are those URLs that lead a user to your site or caused the browser to request
something from your server. The vast majority of requests are made from your
own URLs, since most HTML pages contain links to other objects such as graphics
files. If one of your HTML pages contains links to 10 graphic images, then
each request for the HTML page will produce 10 more hits with the referrer
specified as the URL of your own HTML page.
Usernames
A username along with a password allows users to access certain resources.
These resources may be password-protected areas or even your netConsole itself.
User Agents
A user agent refers to the software making requests. Most often the software
used will be a web browser but search engine spiders/crawlers and other pieces
of software, such as wget,
will show as user agents as well.
Response Code
Are defined as part of the HTTP/1.1 protocol (RFC
2068; See Chapter 10). These codes are generated by the web server and
indicate the completion status of each request made to it. Also see the IC
Tech. Ref. Document: HTTP Response
Codes.
Entry/Exit Pages
Are those pages that were the first requested in a visit (Entry), and the
last requested (Exit). These pages are calculated using the Visits logic above.
When a visit is first triggered, the requested page is counted as an Entry
page, and whatever the last requested URL was, is counted as an Exit page.
Search Strings
Are obtained from examining the referrer string and looking for known patterns
from various search engines. Essentially, if a user finds your site through
a search engine, the keywords that they used will be displayed in the search
strings section of the log report.
Related Items
- IC Tech. Ref. Document: HTTP Response Codes
- RFC 2068: Hypertext Transfer Protocol -- HTTP/1.1
- Webalizer Quick Help



