How can I analyze different sites using the same Log?

You can set up a site profile for each site and specify an Include File Filter for it like *\MySite1\* for site 1, *\MySite2\* for site 2, etc.

Why is the Generate Report option greyed out (not available) in Windows Terminal Services mode?

Reports cannot be generated directly from a Windows Terminal Services client. This is to avoid Access Violation errors that occur when more than one instance of the program is running.

Reports can only be generated when running SurfStats Log Analyzer directly or through the scheduler. You can only administer the program in Terminal Services mode to set up the scheduler to generate reports.

How does the second method of database population work?

This method checks for existing entries in the database and only add entries that are not already in the database. You cannot use this mode if you want to combine results from different web sites.

Notes on Database Population

A typical log file line (or hit) in a log file looks like this (Note that this is one long line and the bold part of the log line contains the referrer information ): – – [25/Feb/2000:03:39:41 -0500] “GET /samples/clienterrors.htm HTTP/1.0” 200 3547
“http://www.altavista.com/cgi- bin/query?sc=on&hl=on&q=HTTP+errors&kl=XX&pg=q” “Mozilla/4.0 (compatible; MSIE 5.5; Windows NT)”

Surfstats parses the log line and applies the set filters in FAST mode before entering the fields into its database. This means that if you change filters, the second option would not work properly. It is advisable to always use the first option (overwrite all) of database population. You should never change the filters if you use the second option of database population in FAST mode.

Surfstats applies filters and then enters ALL fields in the database in Interactive mode. This is why this mode is slower, the database is bigger and the queries are more powerful.

Why is the average number of hits more than the total hits on the summary page?

Surfstats assumes that the day is measure from the first time:date entry of the log to the last time:date entry of the log which can be less than 1. The average is the total divided by the integer value, e.g. the average on a total hit count of 200 hits in 6 hours is 400 (200/0.5). The average value will be incorrect if all the hits of the day was just generated in a few hours of the day and your log file does not reflect it.

Why do the results differ between log analyzers?

Report results differ between most log analyzers. There are a number of possible reasons:

Not all the file and page types are reported on. Many log analyzers has the file and page types hard coded in the program. The Surfstats Log Analyzer has the feature to add and remove file and page types to track. Make sure that your file and page types are tracked by selecting Options – File Types from the button bar.
Method of determining a user session or a unique visitor. Most log analyzers (Surfstats included) counts the first occurrence of an unique IP Address as the start of a user session. Due to dynamic IP Address allocation by ISPs, this method is not always accurate. Unique visitors can only be reasonably accurately tracked if you have a cookie enabled site and the majority of your visitors have cookies enabled on their browsers. Some log analyzers uses cookies to determine clients, some uses the first request by an IP Address in a given time span and some uses a combination of the two.
The cut-off time frame setting differs. Most ISP dynamically allocates IP Addresses to users which mean that different users share IP Addresses. Log analyzers have to assume that if no hit was from an IP Address in a certain time frame, a hit by the same IP Address will be counted as from a new user as this IP Address might be allocated to a new user. The cut-off time might differ between log analyzers. Surfstats Log Analyzer uses a default cut-off time of 30 minutes.
The parsing methods and quality of log analyzers differ. The information in a hit or log line cannot be parsed if a log analyzer encounters an error in a log file.

Can I generate graphs in gif format?

No, you can generate graphs on reports in png format only. This format is supported in all the popular browsers. If you write a program that generates gif files, you have to pay royalties to Unisys who owns the gif compression patent.

Most free browsers (and Opera) can read the png format.

Do I need to be logged on to generate reports?

If you use the Standard Edition you must be logged (in Windows) on to generate reports. The Professional Edition can be run as a service under Windows NT/2000/XP which does not require a user to be logged on. To generate reports when running as a service, you need to:

Have a scheduled task and scheduling must be enabled. (Schedule Tasks)
The service must be installed and started. (Options – Service)

How to switch off shading on reports?

Netscape does not display graphs and tables with the shading correctly. Create a theme with a light background image (with the theme editor) and use this theme on reports.

Time Zone Adjusting

You can adjust the time zone of your log files to your time zone. Some log files are generated in Greenwich Mean Time (0 GMT) and you might want to see it in your time zone, e.g. GMT-7. To do this, select your site profile, click on Edit Site, then on general and enter your time offset. Also refer to the online help.

Saved reports.

When the output option is set to SCREEN and the report has been displayed, a copy of the report has been generated and would be in the directory \Program Files\Surfstats\Sites\SiteName\Html where SiteName is the name you gave the site.

Which fields need to be logged to get all reports?

See the online help (F1) to see how to set it up your server for extended logging. A sample line should look like this:, -, 10/25/96,11:27:01, W3SVC, MICRON,, 0, 271,111, 404, 2, GET, /test.htm, Mozilla/3.0 (WinNT; I), http://www.excite.com/servers,-,

These fields should be logged:

field 1: Clients IP address
field 2: Clients Username
field 3: Date (mm/dd/yy)
field 4: Time
field 5: Service
field 6: Computer name
field 7: Server IP address (Multihome domain field)
field 8: Processing time
field 9: Bytes received
field 10: Bytes sent
field 11: Status Code
field 12: Windows NT status Code
field 13: Operation
field 14: Target file
field 15: Browser/Platform
field 16: Referring URL
field 17: script or dll variables
Back to Top

Using filters to include and exclude files, referrers and visitors

Filters can be set in Edit Site – Filters or in the Control panel in Interactive mode.

You can set filters prior to generating reports. Select the site you want a report on, click on the Report button, click on Options, click on Filters, enter the filters and click on Start. The filters entered here will be saved.

In Interactive reporting mode, a control button is also available on the toolbar. Click the Control button, click on Filter, enter the filters and click on Apply. The reports requested after this will be filtered per specification.

Use the Include filter to include hits on reports to files, referrers and visitors only and the exclude filter to exclude hits. Multiple filters can be used in the same field. A filter must be flanked by * and multiple filters must be separated with a space like *filter1.htm* *filter2.htm* You can use a unique part of a field and use an * to complete the field.

To show only information from an IP Address in reports, enter the IP address in the Include IP Address field. To exclude information from an IP Address, enter the IP Address in the Exclude IP Address field.

You can also use wildcards, e.g. *206* *216* to filter on IP Addresses that includes the numbers 206 and 207. To enter multiple filters, use a space as separator. The current version cannot filter on a range of IP Addresses and the filter fields can take a maximum of 255 characters per field.

Tip. All hits are not equal. Robots from search engines can frequently increase the number of hits quite significantly. If you have a robots.txt file on your web site (we suggest you do), you can filter these hits by inserting *robots* in the Include or Exclude fields in the control panel of SurfStats. Also see the effect of search engine robots on the number of hits. For more information on the robots.txt file and to generate it, see http://reallybig.com/robogen/index.shtml

Finding out more about your visitors.?

You have to do a DNS (Domain Name Server) lookup of a visitor’s IP Address, also referred to as Resolving IP Addresses. You need to be connected to the internet to do this. The DNS (Domain Name Server) lookup queries database at DNS servers on the internet.

The country of origin will then be displayed in reports. Note that all IP addresses cannot be resolved due to various reasons like some ISP’s allocate dynamic IP addresses to their clients, the host is not available, etc.

If you have received e-mail from a visitor, you can also look at the suffix of his e-mail address and then look-up the country from the ISO country code list. This list is available in the online help in SurfStats (Help-Contents-Appendix-List of country and ISO internet codes).

You can also find out more about your visitors by clicking on the hyper-linked IP Address in a report and thereby visiting your visitor.