Recently, I've been setting up awstats, a webserver log analyzer, to parse my Lighttpd logs. When I'm done, I might post some details on my setup and the glue scripts used, but for now, I just want to comment on the right LogFormat configuration value to use for lighttpd.

When googling around, a lot of people either not mention LogFormat at all, or suggest to use LogFormat=1, which means the Combined Log Format (CLF). However, lighttpd use a different log format!

In fact, the CLF is very similar to Lighttpd's log format, but it differs in the second field. In CLF, the second field is the identd username, which is ignored by awstats. In Lighttpd's format, this is the virtual host of the current request, which is very relevant if you're logging multiple virtual hosts to the same logfile. This similarity is th reason that LogFormat=1 does work for most people, but it's better to use the proper configuration:

LogFormat="%host %virtualname %logname %time1 %methodurl %code %bytesd %refererquot %uaquot"

I've taken this format string from the only correct posting I found online, but the forum of that posting seems to interpret the %ua in the last field as a newline (probably u for unicode and a for 0x0a, which is the ASCII code for a newline...), so it took me a while to realize that it was correct.