Awstats traffic versus Ispcp traffic

[kvaes]

We've got an odd problem where the stats reported in by awstats on traffic differ a lot from the stats reported withing ispcp.

domain X (factor 6)
awstats says 325MB bandwidth
ispcp says 2.10GB

domain Y (factor 4)
awstats says 1.54 GB bandwidth
ispcp says 6.78GB

I've checked my crontab, and everything is setup correctly for the isp part (on the three stats scripts). Awstats seems like it's functioning normally too...

Anyone seen this situation before?

[BeNe]

Maybe it has something to do with this closed Ticket --> http://www.isp-control.net/ispcp/ticket/817

Greez BeNe

[kvaes]

okay... now it's totally weird

my awstats files have the wrong syntax, as stated in the ticket, but...

I change the syntax for domain Y, and run the awstats_updateall.pl script again. The values change, but instead of going towards the value indicated by ispcp, it goes down.

Before : Total 7724 13994 145573 302478 1.54 GB
After : Total 6090 59769 144087 850.25 MB

[kvaes]

after browsing to the tickets, I found the following one:
http://www.isp-control.net/ispcp/changeset/888
It's the changeset of today, but if you check the changes for the awstats file, you'll notice that it differs from the ticket above.

changes:
http://www.isp-control.net/ispcp/changes...nf&new=888


Before : HostAliases="www.{DOMAIN_NAME} REGEX[^.*\\{DOMAIN_NAME}$]"
Ticket : HostAliases="www.{DOMAIN_NAME} REGEX[^.*\.{DOMAIN_NAME}$]"
Patchset : HostAliases="www.{DOMAIN_NAME} REGEX[^.*\{DOMAIN_NAME}$]"

Where the before & patchset regex give the same results, and the ticket regex returns even less bandwidth...

I also checked the traffic files and the combined files on traffic sizes. They both report the same values, so I think the "masterdata" for both tools (ispcp & awstats) are correct, but that the error lies in the processing of one/both tool(s).

[Cube]

The HostAliases I recommended in the ticket will be in r889.
But is your site accessed very much through a domain which is not domain.tld and http://www.domain.tld? Only then the error in the config would result in awstats counting too less.

Quote:Where the before & patchset regex give the same results, and the ticket regex returns even less bandwidth...

This should not be the case. Are you sure?

Is there perhaps a logrotate causing this problem?

[kvaes]

Any idea how can I reset both logs to see how the difference evolves?

Is it clearing a certain table in the ispcp db, and deleting the logfiles for the domain?

[kvaes]

@cube: yes I'm sure, and to my knowledge there isn't a log rotate on the files

[kvaes]

tested again:

"before"-syntax : 864.40 MB
"ticket"-syntax : 864.52 MB
"patchset"-syntax : 864.68 MB

isp statistics : 6.92 GB web (7.40 GB all)

[kvaes]

removed the /var/cache/awstats files for domain Y, as the /var/log/apache2 logfiles for domain Y, and the did a "delete from domain_traf where domain_id = '*idY*'"

gonna see how the difference evolves

[kvaes]

after the reset:
- generated some traffic
- did a awstats_updateall.pl & ispcp-vrl-traff
- checked stats
-- awstats : 406.26 KB (viewed) + 418.19 KB (non-viewed)
-- ispcp : 0.00% [778.48 KB of unlimited]

looks more like it, don't know how the issue started then... let's give it a day to see if it says like this