AWStatsを利用してバーチャルホストのアクセスログを解析し、バーチャルホスト用へのアクセス統計をWebブラウザから参照出来るようにします。
ここでは、次の環境とします。
バーチャルホスト名： linux.zoah.net
バーチャルホストのアクセスログ： /var/log/httpd/linux.zoah.net-access_log
↑ 暗号化している場合は、/var/log/httpd/linux.zoah.net-ssl_access_log とします。
バーチャルホストドキュメントルート： /var/www/linux.zoah.net/
[root@server1 ~]# cp /etc/awstats/awstats.model.conf /etc/awstats/awstats.linux.zoah.net.conf ← 設定ファイルをサンプルからコピーします。
[root@server1 ~]# vi /etc/awstats/awstats.linux.zoah.net.conf ← 設定ファイルを編集します。
# "LogFile" contains the web, ftp or mail server log file to analyze. # Possible values: A full path, or a relative path from awstats.pl directory. # Example: "/var/log/apache/access.log" # Example: "../logs/mycombinedlog.log" # You can also use tags in this filename if you need a dynamic file name # depending on date or time (Replacement is made by AWStats at the beginning # of its execution). This is available tags : # %YYYY-n is replaced with 4 digits year we were n hours ago # %YY-n is replaced with 2 digits year we were n hours ago # %MM-n is replaced with 2 digits month we were n hours ago # %MO-n is replaced with 3 letters month we were n hours ago # %DD-n is replaced with day we were n hours ago # %HH-n is replaced with hour we were n hours ago # %NS-n is replaced with number of seconds at 00:00 since 1970 # %WM-n is replaced with the week number in month (1-5) # %Wm-n is replaced with the week number in month (0-4) # %WY-n is replaced with the week number in year (01-52) # %Wy-n is replaced with the week number in year (00-51) # %DW-n is replaced with the day number in week (1-7, 1=sunday) # use n=24 if you need (1-7, 1=monday) # %Dw-n is replaced with the day number in week (0-6, 0=sunday) # use n=24 if you need (0-6, 0=monday) # Use 0 for n if you need current year, month, day, hour... # Example: "/var/log/access_log.%YYYY-0%MM-0%DD-0.log" # Example: "C:/WINNT/system32/LogFiles/W3SVC1/ex%YY-24%MM-24%DD-24.log" # You can also use a pipe if log file come from a pipe : # Example: "gzip -d </var/log/apache/access.log.gz |" # If there is several log files from load balancing servers : # Example: "/pathtotools/logresolvemerge.pl *.log |" # LogFile="/var/log/httpd/access_log" ↓ LogFile="/var/log/httpd/linux.zoah.net-access_log" ↑ バーチャルホストのアクセスログを指定します。暗号化している場合は、 linux.zoah.net-ssl_access_log を指定します。 # "SiteDomain" must contain the main domain name, or the main intranet web # server name, used to reach the web site. # If you share the same log file for several virtual web servers, this # parameter is used to tell AWStats to filter record that contains records for # this virtual host name only (So check that this virtual hostname can be # found in your log file and use a personalized log format that include the # %virtualname tag). # But for multi hosting a better solution is to have one log file for each # virtual web server. In this case, this parameter is only used to generate # full URL's links when ShowLinksOnUrl option is set to 1. # If analysing mail log, enter here the domain name of mail server. # Example: "myintranetserver" # Example: "www.domain.com" # Example: "ftp.domain.com" # Example: "domain.com" # SiteDomain="localhost.localdomain" ↓ SiteDomain="linux.zoah.net" ← Webサーバー名を指定します。 # If you want to have hosts reported by name instead of ip address, AWStats # need to make reverse DNS lookups (if not already done in your log file). # With DNSLookup to 0, all hosts will be reported by their IP addresses and # not by the full hostname of visitors (except if names are already available # in log file). # If you want/need to set DNSLookup to 1, don't forget that this will reduce # dramatically AWStats update process speed. Do not use on large web sites. # Note: Reverse DNS lookup is done on IPv4 only (Enable ipv6 plugin for IPv6). # Note: Result of DNS Lookup can be used to build the Country report. However # it is highly recommanded to enable the plugin 'geoipfree' or 'geoip' to # have an accurate Country report with no need of DNS Lookup. # Possible values: # 0 - No DNS Lookup # 1 - DNS Lookup is fully enabled # 2 - DNS Lookup is made only from static DNS cache file (if it exists) # Default: 2 # DNSLookup=2 ↓ DNSLookup=1 ← アクセス元の名前解決を行います。(アクセス元をIPアドレスではなくホスト名で表示します。) # Plugin: GeoIPfree # Perl modules required: Geo::IPfree version 0.2+ (from Graciliano M.P.) # Country chart is built from an Internet IP-Country database. # This plugin is useless for intranet only log files. # Note: You must choose between using this plugin (need Perl Geo::IPfree # module, database less up to date) or the GeoIP plugin (need Perl Geo::IP # module from Maxmind, database more up to date). # Note: Activestate provide a corrupted version of Geo::IPfree 0.2 Perl # module, so install it from elsewhere (from www.cpan.org for example). # This plugin reduces AWStats speed of 10% ! # #LoadPlugin="geoipfree" LoadPlugin="geoipfree" ← 追加(アクセス元国情報を詳細に取得します。)
[root@server1 ~]# vi awstatsinit.sh ← AWStatsのデータベース初期作成スクリプトを作成します。
#!/bin/bash
# データベース作成先ディレクトリ作成
mkdir -p `grep ^DirData /etc/awstats/awstats.$1.conf | awk -F= '{print $2}'|tr -d \"`
# AWStats設定ファイルよりApacheログファイル名取得
logfile=`grep ^LogFile /etc/awstats/awstats.$1.conf|sed -e 's/LogFile="\([^ ]*\)"/\1/p' -e d`
# 過去ログを古い順に処理
grep dateext /etc/logrotate.conf > /dev/null 2>&1
if [ $? -eq 0 ]; then
# 過去ログファイル名に日付が設定されている場合
for log in `ls $logfile-*|sort`
do
`rpm -ql awstats|grep "awstats\.pl"` \
-config=$1 -update -logfile=$log
done
else
# 過去ログファイル名に通番が設定されている場合
for log in `ls $logfile.*|sort -r`
do
`rpm -ql awstats|grep "awstats\.pl"` \
-config=$1 -update -logfile=$log
done
fi
# 現在ログ処理
for log in `ls $logfile|sort`
do
`rpm -ql awstats|grep "awstats\.pl"` \
-config=$1 -update -logfile=$log
done
[root@server1 ~]# bash awstatsinit.sh linux.zoah.net ← AWStatsのデータベース初期作成スクリプトを実行します。
[root@server1 ~]# rm -f awstatsinit.sh ← AWStatsのデータベース初期作成スクリプトを削除します。
AWStatsのデータベースの更新は、/etc/cron.daily/awstatsにより毎日自動実行されます。
※注意
/etc/httpd/conf.d/virtualhost-linux.zoah.net.conf(バーチャルホスト用バーチャルホスト設定ファイル)に、
Alias / “/var/www/linux.zoah.net/” のように、エイリアスが / から始まる場合は、その前の行に以下のように記述して下さい。
/ より下から始まるエイリアスの場合、 / から始まるエイリアスより前に記述しないと正常に動作しません。
<VirtualHost *:80>
ServerName linux.zoah.net
DocumentRoot /var/www/linux.zoah.net
ErrorLog logs/linux.zoah.net-error_log
CustomLog logs/linux.zoah.net-access_log combined
Options ExecCGI FollowSymLinks Includes IncludesNOEXEC MultiViews
Alias /awstatsclasses "/usr/share/awstats/wwwroot/classes/" ← 追加します。
Alias /awstatscss "/usr/share/awstats/wwwroot/css/" ← 追加します。
Alias /awstatsicons "/usr/share/awstats/wwwroot/icon/" ← 追加します。
ScriptAlias /awstats/ "/usr/share/awstats/wwwroot/cgi-bin/" ← 追加します。
Alias / "/var/www/linux.zoah.net/"
<Directory "/var/www/linux.zoah.net">
AllowOverride All
Require all granted
</Directory>
</VirtualHost>
<VirtualHost *:443>
Alias /awstatsclasses "/usr/share/awstats/wwwroot/classes/" ← 追加します。
Alias /awstatscss "/usr/share/awstats/wwwroot/css/" ← 追加します。
Alias /awstatsicons "/usr/share/awstats/wwwroot/icon/" ← 追加します。
ScriptAlias /awstats/ "/usr/share/awstats/wwwroot/cgi-bin/" ← 追加します。
Alias / "/var/www/linux.zoah.net/"
<Directory "/var/www/linux.zoah.net">
AllowOverride All
Require all granted
</Directory>
# General setup for the virtual host, inherited from global configuration
DocumentRoot /var/www/linux.zoah.net
ServerName linux.zoah.net:443
# Use separate log files for the SSL virtual host; note that LogLevel
# is not inherited from httpd.conf.
ErrorLog logs/error_log
#TransferLog logs/linux.zoah.net-ssl_access_log
CustomLog "logs/linux.zoah.net-ssl_access_log" combined
LogLevel warn
# SSL Engine Switch:
# Enable/Disable SSL for this virtual host.
SSLEngine on
# List the protocol versions which clients are allowed to connect with.
# The OpenSSL system profile is used by default. See
# update-crypto-policies(8) for more details.
#SSLProtocol all -SSLv3
SSLProtocol All -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
#SSLProxyProtocol all -SSLv3
# User agents such as web browsers are not configured for the user's
# own preference of either security or performance, therefore this
# must be the prerogative of the web server administrator who manages
# cpu load versus confidentiality, so enforce the server's cipher order.
SSLHonorCipherOrder on
# SSL Cipher Suite:
# List the ciphers that the client is permitted to negotiate.
# See the mod_ssl documentation for a complete list.
# The OpenSSL system profile is configured by default. See
# update-crypto-policies(8) for more details.
SSLCipherSuite ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS
SSLProxyCipherSuite PROFILE=SYSTEM
# Point SSLCertificateFile at a PEM encoded certificate. If
# the certificate is encrypted, then you will be prompted for a
# pass phrase. Note that restarting httpd will prompt again. Keep
# in mind that if you have both an RSA and a DSA certificate you
# can configure both in parallel (to also allow the use of DSA
# ciphers, etc.)
# Some ECC cipher suites (http://www.ietf.org/rfc/rfc4492.txt)
# require an ECC certificate which can also be configured in
# parallel.
SSLCertificateFile /etc/letsencrypt/live/linux.zoah.net/cert.pem
# Server Private Key:
# If the key is not combined with the certificate, use this
# directive to point at the key file. Keep in mind that if
# you've both a RSA and a DSA private key you can configure
# both in parallel (to also allow the use of DSA ciphers, etc.)
# ECC keys, when in use, can also be configured in parallel
SSLCertificateKeyFile /etc/letsencrypt/live/linux.zoah.net/privkey.pem
# Server Certificate Chain:
# Point SSLCertificateChainFile at a file containing the
# concatenation of PEM encoded CA certificates which form the
# certificate chain for the server certificate. Alternatively
# the referenced file can be the same as SSLCertificateFile
# when the CA certificates are directly appended to the server
# certificate for convenience.
SSLCertificateChainFile /etc/letsencrypt/live/linux.zoah.net/chain.pem
# Certificate Authority (CA):
# Set the CA certificate verification path where to find CA
# certificates for client authentication or alternatively one
# huge file containing all of them (file must be PEM encoded)
#SSLCACertificateFile /etc/pki/tls/certs/ca-bundle.crt
# Client Authentication (Type):
# Client certificate verification type and depth. Types are
# none, optional, require and optional_no_ca. Depth is a
# number which specifies how deeply to verify the certificate
# issuer chain before deciding the certificate is not valid.
#SSLVerifyClient require
#SSLVerifyDepth 10
# Access Control:
# With SSLRequire you can do per-directory access control based
# on arbitrary complex boolean expressions containing server
# variable checks and other lookup directives. The syntax is a
# mixture between C and Perl. See the mod_ssl documentation
# for more details.
#<Location />
#SSLRequire ( %{SSL_CIPHER} !~ m/^(EXP|NULL)/ \
# and %{SSL_CLIENT_S_DN_O} eq "Snake Oil, Ltd." \
# and %{SSL_CLIENT_S_DN_OU} in {"Staff", "CA", "Dev"} \
# and %{TIME_WDAY} >= 1 and %{TIME_WDAY} <= 5 \
# and %{TIME_HOUR} >= 8 and %{TIME_HOUR} <= 20 ) \
# or %{REMOTE_ADDR} =~ m/^192\.76\.162\.[0-9]+$/
#</Location>
# SSL Engine Options:
# Set various options for the SSL engine.
# o FakeBasicAuth:
# Translate the client X.509 into a Basic Authorisation. This means that
# the standard Auth/DBMAuth methods can be used for access control. The
# user name is the `one line' version of the client's X.509 certificate.
# Note that no password is obtained from the user. Every entry in the user
# file needs this password: `xxj31ZMTZzkVA'.
# o ExportCertData:
# This exports two additional environment variables: SSL_CLIENT_CERT and
# SSL_SERVER_CERT. These contain the PEM-encoded certificates of the
# server (always existing) and the client (only existing when client
# authentication is used). This can be used to import the certificates
# into CGI scripts.
# o StdEnvVars:
# This exports the standard SSL/TLS related `SSL_*' environment variables.
# Per default this exportation is switched off for performance reasons,
# because the extraction step is an expensive operation and is usually
# useless for serving static content. So one usually enables the
# exportation for CGI and SSI requests only.
# o StrictRequire:
# This denies access when "SSLRequireSSL" or "SSLRequire" applied even
# under a "Satisfy any" situation, i.e. when it applies access is denied
# and no other module can change it.
# o OptRenegotiate:
# This enables optimized SSL connection renegotiation handling when SSL
# directives are used in per-directory context.
#SSLOptions +FakeBasicAuth +ExportCertData +StrictRequire
<FilesMatch "\.(cgi|shtml|phtml|php)$">
SSLOptions +StdEnvVars
</FilesMatch>
<Directory "/var/www/cgi-bin">
SSLOptions +StdEnvVars
</Directory>
# SSL Protocol Adjustments:
# The safe and default but still SSL/TLS standard compliant shutdown
# approach is that mod_ssl sends the close notify alert but doesn't wait for
# the close notify alert from client. When you need a different shutdown
# approach you can use one of the following variables:
# o ssl-unclean-shutdown:
# This forces an unclean shutdown when the connection is closed, i.e. no
# SSL close notify alert is sent or allowed to be received. This violates
# the SSL/TLS standard but is needed for some brain-dead browsers. Use
# this when you receive I/O errors because of the standard approach where
# mod_ssl sends the close notify alert.
# o ssl-accurate-shutdown:
# This forces an accurate shutdown when the connection is closed, i.e. a
# SSL close notify alert is sent and mod_ssl waits for the close notify
# alert of the client. This is 100% SSL/TLS standard compliant, but in
# practice often causes hanging connections with brain-dead browsers. Use
# this only for browsers where you know that their SSL implementation
# works correctly.
# Notice: Most problems of broken clients are also related to the HTTP
# keep-alive facility, so you usually additionally want to disable
# keep-alive for those clients, too. Use variable "nokeepalive" for this.
# Similarly, one has to force some clients to use HTTP/1.0 to workaround
# their broken HTTP/1.1 implementation. Use variables "downgrade-1.0" and
# "force-response-1.0" for this.
BrowserMatch "MSIE [2-5]" \
nokeepalive ssl-unclean-shutdown \
downgrade-1.0 force-response-1.0
# Per-Server Logging:
# The home of a custom SSL log file. Use this when you want a
# compact non-error SSL logfile on a virtual host basis.
Header set Strict-Transport-Security "max-age=31536000"
Options ExecCGI FollowSymLinks Includes IncludesNOEXEC MultiViews
</VirtualHost>
http://linux.zoah.net/awstats/awstats.plへアクセスすると、アクセス統計ページが表示されます。