Evaluating the Web server access log

Overview

This tool supports the analysis of LogWeb/Ajax transactions that have been logged in an access log ("Web Access Log") by a servlet container (such as Tomcat) or by a Web server or proxy server (such as Apache).

This tool can be very useful, not because an access log file is especially complex (on the contrary, access log files have very simple line structures), but because of the large size of such files: files containing millions of lines per day are not uncommon. In most cases, it is practically impossible to open the file in an editor and click around in the content to find out what happened.

The tool is used in a dialog:

The result of the first step is displayed in five different views:

You can hide each section by clicking the corresponding check box.

Displaying all transactions of a specific LogWeb/Ajax session in detail can be useful in many cases.
Alternatively, extracting and listing all server accesses within a specific time period or with specific text content can also be helpful.
You can hide these detailed views by clicking the corresponding check box, or you can remove these views completely.

The window on the left side of the program provides shortcuts to individual views.

The following sections show examples of the structures of the individual views; you can find further information in the detailed help when starting the program.

LogWeb/Ajax sessions

The sessions summary displays one line for each LogWeb/Ajax session:

LogWeb/Ajax session transactions server request interval client response delay
#ID session ID ip User RemoteAddr Admin Stop first last total max sec at time hits/sec sessions max millis at time
#1 81d0d12411328883fba 100.0.1.12 sp2742 78.48.131.27 _Response 06:40:24 10:35:39 1377 35 10:23:05 19 52 17797 10:23:05

If you double-click the column header of the table, the selected column is sorted either in ascending or descending order.

If you right-click one of the rows, a detailed filter dialog opens:

HTTP errors

One HTTP error is displayed per line:

URLhttp rc first last total
/logwebVT/ 302 06:33:39 08:44:26 13
/logwebVT/__login/de/logics/ajax/JSBridgeBeanInfo.class 404 10:20:59 10:20:59 1

Details about HTTP error codes can be found, for example, at http://de.selfhtml.org/servercgi/server/httpstatuscodes.htm

Server load

This view shows the server load in one-minute intervals:

                      = 1 server hit per second
                      = 10 concurrent sessions
time  sess  hits
06:24     0     1    
06:26     1     1    
06:29     1     1    
06:30     2     3      
06:31     2     3      
06:32     3     3      
06:33     6     7          
06:34     6     2     
06:35     6     1    
06:36     6     3      
06:37     6     2     

Details view

Details View displays one access log line per output line:


           ---server-- ---------access log---------- --bytes-- ---interval-- --client- ---delay ms--  --------------AJAX--------------       
   line    sess   hits     time              ip verb  in   out server client ---time-- client server  Action SessionID  ScreenID Admin PARAMS
  12669       4      3 09:21:39  10.222.111.142 POST      1574      3      2   281.175    181           Send       #39    115/44       __15001001.0: %3CENTER%3E
  12712       4      3 09:21:55  10.222.111.141  GET       166 ==== 10.222.111.141 - - [11/Dec/2007:09:21:55 +0100] "GET /as400/_empty.jsp HTTP/1.1" 200 166