Sep 30

Awstats shows most connections from 127.0.0.1 or most requested page is asterisk ‘*’

Category: Linux,webserver   — Published by tengo on September 30, 2011 at 4:14 am

No need to worry: this is the Apache's internal dummy connection. Apache / Apache2 uses it to wake up dormant processes/ requests. Read this.

There are a couple of ways to remove this noise from your logfiles. On my system I went down this path:

Go to your http.conf file, or the file containing the log directive, mine is in /etc/apache2/apache2.conf.
Edit the log directive as described here and here:

SetEnvIf Remote_Addr "::1" loopback
SetEnvIf Remote_Addr "127.0.0.1" loopback
CustomLog logs/access_log combined env=!loopback

Of course, even if you change the Apache's logging now, older logs still have these connections listed. So we need to tell awstats to skip these connections on data analysis. This can be done by using the SkipHosts rule:
SkipHosts
Version : 1.0+ (5.6+ for REGEX syntax)

# Do not include access from clients that match following criteria.
# If your log file contains IP adresses in host field, you must enter here
# matching IP adresses criteria.
# If DNS lookup is already done in your log file, you must enter here hostname
# criteria, else enter ip address criteria.
# The opposite parameter of "SkipHosts" is "OnlyHosts".
# Note: Use space between each value.
# Note: You can use regular expression values writing value with REGEX[value].
# Change : Effective for new updates only
# Example: "127.0.0.1 REGEX[^192.168.] REGEX[^10.0.0.]"
# Example: "localhost REGEX[^.*.localdomain$]"
# Default: ""
#
SkipHosts=""

So go to your awstats .conf file and edit this rule to include the local IP 127.0.0.1

awstats example diagram
More awstats related reading on this blog: Installing Apache on Debian Squeeze has a section about awstats; and Getting started with awstats provides some pointers on how to get it up and running in general.