How to analyze multiple gz log files for Awstats?

Solution 1:

What you probably want to do here is to analyze all these logfiles once, then keep analyzing only the current logfiles from then on.

The simplest thing to do is unzip all those files into a single file, then have awstats run over it once, then point awstats at your access.log file from then on.

awstats normally has a script called logresolvemerge.pl, which can read the compressed files, and will merge them appropriately for awstats to do analsyis.

To merge all your existing ones, run

perl /usr/share/awstats/tools/logresolvemerge.pl /var/log/nginx/access.log* > /tmp/nginx.tmplog

This will probably take a while.

You can then have awstats run once over this file (set LogFile appropriately).

From then on, you should have awstats run over the most recent logfile - which is what your current configuration is doing.

Depending on how often you are running awstats vs rotating nginx logfiles, you may want to have it read both the current logfile and the previous one. (eg, if you rotate nginx logfiles every day at 12, but have awstats run every day at 1, then whenever awstats runs the logfile will only contain what's been written since the last rotation). You can use logresolvemerge.pl inside your LogFile command like this:

LogFile="/usr/share/awstats/tools/logresolvemerge.pl /var/log/nginx/access.log /var/log/nginx/access.log.1.gz |"

This tells awstats to run the logresolvemerge.pl command with the two logfiles as parameters, and awstats will read in the output of that script (that's what the pipe | does)

Solution 2:

Alternatively, you can use a real-time log analyzer, such as GoAccess. It's really fast and you don't need to unzip any log. apache & nginx

https://goaccess.io/

zcat -f access.log* | goaccess -a -s -b

OR

zcat access.log.*.gz | goaccess -a -s -b