Virtual Domain not reporting visitors

Avatar
Dr. Who
  • updated
  • Answered
Am I correct that the Virtual Domain filter is looking at the cs-host field in the logfiles?

If so, we now host another website that is in our existing logfiles. The existing profile hasn't changed and I put an "exclude" filter for the new DNS. However, I created a new profile for the new DNS and I have tried exclude and include filters to only get the new DNS but the reports don't look correct. I show hits over time but visitors on only one day. Browser statistics only show for that one day too. The server is IIS 7.x and I have all the fields checked. I see the various values for cd-host in the logfiles.

When I look at the Virtual Domains report it shows all the hits for the "one" visitor on one day even though the Activity Statistics shows the hits over many days.
Replies 9
Avatar
0
Michael
Yes, the virtual domain filter checks the cs-host field.

It seems that for some reason you get report for one visitor host/IP only. You should check it in the Visitors > Hosts report.

The issue may appear if there is a problem with filters so requests from one IP only are included. You should check if you use the "Host" filter, maybe it includes just one host.

The issue may also appear if you use a firewall that causes log files to include its IP instead of real visitors' IPs. In this case the program may detect just one visitor with a very large number of hits.
Avatar
0
Dr. Who
That makes sense. The Load Balancer is sending the IP Address of the Load Balancer and not the IP Address of the client. I have requested the Network Staff correct this but it hasn't happened yet. On the profile that does report visitors correctly it only reports everything from our network such as all the spiders are coming from me and not worldwide.

So, I won't worry about good results on this profile until we get the Load Balancer fixed. Thank you for the reply.
Avatar
0
Dr. Who
The Load Balancer is finally going to be updated soon to send the Client IP Address in the "X-Forwarded-For" field. I am going to be using the Advanced Logging Module within IIS 7.x to record that field. The Client-IP (c-ip) evidently will still have the Load Balancer IP Address.

Do you have a recommended method to look at the "X-Forwarded-For" IP Address for analysis instead of the Client-IP field?
Avatar
0
Michael
The Advanced Logging module allows you to change the header name for logged fields, so you should just change the header name for the "X-Forwarded-For" field to "c-ip", so it will be recognized as visitor IP by the program.
Avatar
0
Dr. Who
I tried configuring the Advanced Logging module to mirror the normal format of the W3C logs with putting items into the same order. However, the Advanced Logging module put them in a different order. I tried running the log files through WebLog Expert and it didn't recognize the files (The analyzed log files don't contain any information, which can be analyzed by the program). I'll have to play around to see if I can get them into a W3C formatted log file.
Avatar
0
Michael
Field order doesn't matter as the program can get it from the log header. So there should be a problem with field names or their contents.

You should recheck that there are all the required fields and they are named the same way as in the usual logs. You can find information in it at http://www.weblogexpert.com/help/wlex.... You can also send a log created with the new settings to us at support@weblogexpert.com so we'll check why the program cannot read it.
Avatar
0
Dr. Who
Still not getting any logfiles to run through the program. I e-mailed you a logfile earlier today that you can look at when you have time.
Avatar
0
Michael
The problem appears because of the c-ip field that is blank now. I’ve tried to replace the field value in few log lines with an IP and the program analyzed the log correctly.
Avatar
0
Michael
We have added support for the X-Forwarded-For field in version 8.0 beta. If this field exist and isn't empty, the program uses its value as visitor IP instead of the c-ip field.