Re: my log analyzer and bytes_sent are not matching

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Jeremy Hansen wrote:
| I'm trying to use mod_log_sql to calculate daily bandwidth usage stats
| for clients.  I'm basically using this:
|
| select sum(bytes_sent) from `access_domain_com`;
<snip>
| What could cause this?  I really need to figure this out because
customers
| are either getting charged too much or too little.

Jeremy,
The routine used in mod_log_sql to extract the bytes sent is exactly the
same as that used in mod_log_config, Apache's text logging mechanism.
It uses the ap_bgetopt() call with the BO_BYTECT argument to extract the
bytes output to the client; so, whatever mod_log_sql says at least
agrees with whatever ordinary logging would say.

I am not familiar enough with awstats to really offer any insight into
its behavior.  I can only speculate why awstats is consistently higher
than the module, but a couple of ideas:

* awstats is ignoring any mod_gzip compression in place; it is just
multplying the (document disk size in bytes) by (number of hits on the doc).
* awstats is somehow figuring in extra bandwidth for the HTTP headers,
which are not factored into Apache's 'bytes output' formula.
* awstats' algorithm somehow 'sees' data transfer that apache's 'bytes
output' forumula ignores or misses.
* and, of course: awstats is broken / apache's bytecount formula is broken.

Regards,
Chris Powell
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFABXrqYLVoao8MjQkRAkqmAJ0Y24bQmpHMrxL5DMelUHy+A7Z8hACeLzvj
NhmQbFtE1E3NJPci+/ve3qQ=
=F+jF
-----END PGP SIGNATURE-----