Access (visitor) Logs

Every time someone visits your web site make a note of the pages they look at plus other information that can be helpful in working out how effective your site is.

This section explains what this information tells you about your visitors and the meaning of some of the more common terms you might come across.

The logs are created in the "NCSA combined log" format with each line containing a single request to the server. The section on log files gives an example entry and explains what all the information means.

As a whole mass of raw data is not really very interesting to read, we process the logs for you and display an overview in graphical and tabular form.

If your site is busy the log file can grow quite quickly so each week we archive it and begin a new one. We then e-mail the archive to you so you can process it more thoroughly, keep for your records or drop it in the bin.

If you want to process the log files more thoroughly there are a number of good log analysis programs available that will crunch the data and turn it into graphs and charts, most will also allow you to export the data in the form of a web page (HTML) or word processor document. FastStats is our preferred choice, as its name suggests it is very fast and is also reasonably priced. Webmanage.com also offer a very good program. They used to distribute a freeware version called NetIntellect Lite which was excellent. You may still find a download site for this program by searching the Internet for the program name or the install file, "nilite.exe".

With access logs, like most things to do with the Internet, the terminology can be a bit confusing. You will hear people talking about 'hits' or 'page views' or 'visits' or 'unique visitors' with, most probably, a different definition for each.

These are the usual definitions:-

Hit - a request by a browser for a page, an image, a program, anything, even for something that isn't there such as an old page that has been removed.
The server doesn't necessarily have to answer or send anything back to the browser although it will usually respond with at least an error code.
File - a request by a browser that was answered by the server and resulted in something being sent back to the browser, again this may be a page, an image or anything else.
Page - a request by a browser for an actual page - The overview of your access logs we provide counts this is as either an HTML document or a call to a script that generates one.
Often also referred to as a "page view" or "page impression".
Visitor - a request, or number of requests from an individual IP address.
Also referred to as a "site"
Note: this is not the actual number of real people who have visited your site - we explain why below.
Unique visits - a series of requests, all from the same IP address, without a break of a given amount of time. The overview of your access logs we provide counts a break of more than 30 minutes as a new visit.
Bandwidth - How much data has been transferred.
When talking about web site hosting, bandwidth is how much data you are allowed to transfer i.e serve up to your visitors, in a given period (usually a month) and when talking of connections it's how fast data can be transferred in a given time period (usually per second

It is important to note that the access logs are not necessarily an accurate record of everyone who looks at your site. Many ISP's employ a 'cache' which is used to store a copy of your page for anything from a few minutes to many hours. If another of their subscribers requests the page they will serve them the cached copy rather than get a fresh one from your site. The advantage of this is that they can provide their users with the information much more quickly, the disadvantage is that that they could serve the page to literally hundreds of visitors and you would never know.

Another thing to bear in mind is that many ISP's also have a number of IP addresses and hostnames and swap their users between them. A user might therefore be moved from one IP address to another part way through a visit making it appear as if two people have been to look around.

Here's an actual example from our own access log:

205.188.209.102 - - [26/Sep/2000:01:03:15 +0100] "GET /
205.188.209.101 - - [26/Sep/2000:01:03:16 +0100] "GET /images/jensys.gif
205.188.209.169 - - [26/Sep/2000:01:03:16 +0100] "GET /images/bkgrnd.gif

This was almost definitely one visitor although in the space of just two seconds the ISP had swapped the user between 3 different IP addresses. A log analysis program would assume there was actually 3 individuals.

Just to keep life really interesting it is possible to configure some browsers to report they are actually a different one or to hide who they are or where they came from. This is sometimes done by search engine 'spiders' to try and catch people who may be attempting to trick them.