Two related questions.

Is there any good apache log analyzer other than awstats and webalizer?

and is there any error log analyzers?


  • 2
    Does "free" factor in this?
    – random
    Commented Aug 1, 2009 at 23:49
  • yes. free is a factor.
    – madphp
    Commented Aug 2, 2009 at 1:04
  • 1
    Perhaps you could elaborate on what you're trying to get out of the logs that webalyzer and awstats don't already do. Commented Aug 2, 2009 at 2:33
  • I'd like to be able to search the logs by host. Awstats and Webalizer really is very limitied in what you can do. Anyone can see that there rubbish.
    – madphp
    Commented Aug 2, 2009 at 12:04

6 Answers 6


splunk is great for error logs. there are free and paid versions available.

  • Splunk recently released 4.0, and have yet to release a free version (they say they will). Download the latest 3.x for a free version.
    – pgs
    Commented Aug 2, 2009 at 3:11
  • Correct. They are targeting Q3 for that.
    – Keith
    Commented Aug 2, 2009 at 3:54

Checkout Visitors . It is a ridiculously fast Apache Log parser. You can set it up to do even real time logging.


As far as I know, awstats is basically the standard. I haven't heard of anything widely considered better than it (not that I'm an expert on such things).

You're unlikely to find an analyzer for the error log because unlike the access log, there's no standard format for error log data. What shows up in the error log is entirely up to the web app or CGI script that puts it there. Perhaps the most common choice of format, or at least the one used by several standard Apache modules like mod_ssl, is

[date] [level] message

but I routinely see lines that don't even follow that format in my own server's logs. And anyway, I'm not sure what kind of analysis you'd be able to do on error log messages in general - it would be highly dependent on what's producing the log lines you'd want to analyze.


What about analog? Its pretty speedy.


If you don't mind paying, WebTrends is excellent. Last time I used them, they charged based on how much log you wanted to analyse. Be aware that you'll need a lot of disk space on your reporting server, as the database can get quite large.

Also, I know it's not really a log analyser, but have you considered Google Analytics?


OSSEC HIDS has 24 apache rules by default (at least in my setup) to monitor apache logs (errors and security events). You can also define your own if you're interested in a certain log pattern.

You can install the OSSEC webui if you need a webapp or use the aforementioned splunk with the Splunk for OSSEC app.

Not the answer you're looking for? Browse other questions tagged .