I have started a cobalt security project on sourceforge.

I decided to give AWStats a try on the RaQ4. The package installation worked great except for one problem: AWStats would miss calculating stats every few days.

Analysis:

The package installation (NuOnce) of AWStats will run once a day on the /home/sites/www.site.com/logs/weblog files. A problem occurs because of the way the RaQs split/rotate their logs.

The RaQ4 collects all the web logs to the common /var/log/httpd/access file.

Once a day logrotate runs and splits the log file up, and then checks the size of all the individual /home/sites/www.site.com/web/weblog files and will compress/archive if necessary.

By default AWStats runs first on the cron.daily job. This causes to analyze yesterday’s logs, and only the ones that might be left after the compression/archive routine ran on them. Meaning, you might loose log information every N days or so. (On our higher traffic sites it was every 3rd or 4th day.)

Fix:

1. Move AWStats-run.pl to /etc/cron.d

   mv /etc/cron.daily/AWStats-run.pl /etc/cron.d

2. Then modify /etc/logrotate.d/apache like so:

   		/var/log/httpd/access {
   		    prerotate
   		        /usr/local/sbin/split_logs web < /var/log/httpd/access
   		    endscript
   		    missingok
   		    postrotate
   		        /usr/bin/killall -HUP httpd 2> /dev/null || true
   		        /etc/cron.d/AWStats-run.pl
   		    endscript
   		    daily
   		}