I am attempting to use AWStats 7.0 to parse Glassfish 4 HTTP access logs. Here is an example line:
"65.112.10.87" "NULL-AUTH-USER" "06/Mar/2018:05:22:41 -0500" "GET / HTTP/1.1" 200 52598
I'm running awstats_updateall.pl now and getting the following error:
Running '"/usr/share/awstats/wwwroot/cgi-bin/awstats.pl" -update -config=localhost.localdomain -configdir="/etc/awstats"' to update config localhost.localdomain
Create/Update database for config "/etc/awstats/awstats.localhost.localdomain.conf" by AWStats version 7.0 (build 1.971)
From data in log file "/usr/local/glassfish4/glassfish/domains/domain1/logs/access/server_access_log.2018-03-06.txt"...
Phase 1 : First bypass old records, searching new record...
Searching new records from beginning of log file...
AWStats did not find any valid log lines that match your LogFormat parameter, in the 50th first non commented lines read of your log.
Your log file /usr/local/glassfish4/glassfish/domains/domain1/logs/access/server_access_log.2018-03-06.txt must have a bad format or LogFormat parameter setup does not match this format.
Your AWStats LogFormat parameter is:
%host %otherquot %time1 %methodurl %code %bytesd
This means each line in your web server log file need to have the following personalized log format:
%host %otherquot %time1 %methodurl %code %bytesd
And this is an example of records AWStats found in your log file (the record number 50 in your log):
"65.112.10.87" "NULL-AUTH-USER" "06/Mar/2018:05:22:41 -0500" "GET / HTTP/1.1" 200 52598
Setup ('/etc/awstats/awstats.localhost.localdomain.conf' file, web server or permissions) may be wrong.
Check config file, permissions and AWStats documentation (in 'docs' directory).
As you can see above in the error, my LogFormat is set to the following:
LogFormat = "%host %otherquot %time1 %methodurl %code %bytesd"
I think the problem is that all the values in the Glassfish logs are quoted, like this:
"65.112.10.87" "NULL-AUTH-USER" "06/Mar/2018:05:22:41 -0500" "GET / HTTP/1.1" 200 52598
https://serverfault.com/questions/829694/looking-for-logformat-for-awstats-to-read-my-custom-apache-logfiles/830071 mentions a syntax that appears to be trying to handle double quotes with ref=\"%referer\" for example but I've tried something similar for %time1 and it doesn't seem to work for me (and I can't find any documentation on this syntax). \"%time1\" doesn't work either.
Can someone please help me figure out the right LogFormat definition? The options are described at http://www.awstats.org/docs/awstats_config.html#LogFormat but I don't see how deal with the host or timestamp being quoted (and the timestamp isn't in brackets).