3 ms·
Yes, I've also been using awstats for many years. It definitely works for a small site, has a lot of useful features and occasional releases still keep up with
by avian 7y ago
Yes, I've also been using awstats for many years. It definitely works for a small site, has a lot of useful features and occasional releases still keep up with new user agents, etc. that pop up over time. Each time I want to switch I fail to find a suitable replacement.
That said, behind the curtain, awstats has plenty of problems and shows its age. Most of it is a single ~20 kline script with hundreds of global variables, so it's very challenging to debug. There are no tests. Over time it also had plenty of security issues [1]. I wouldn't recommend running it in any other mode than for generating static HTML reports from an unprivileged cronjob.
I've made my own test suite and I'm using a slightly patched version with ~20 commits on top of the latest release that fix problems I found and that upstream didn't merge (still from the times of SourceForge - since they switched to GitHub they do seem to be a bit better in accepting pull requests). However it doesn't help with submitting patches that, for example, concerns regarding GDPR compliance are met with responses like [2].
[1] https://security-tracker.debian.org/tracker/source-package/awstats https://security-tracker.debian.org/tracker/source-package/a...
[2] https://github.com/eldy/awstats/issues/110 https://github.com/eldy/awstats/issues/110
- xfitm3 7y agoI read issue [2] and I think its reasonable to do this at the LogFormat level. awstats doesn't need to do everything, that is probably how it got to be 20,000 lines. I always use awstats to generate static pages, and that's what any security conscientious operator should do.
- avian 7y agoYou see a reasonable technical response. I see users with a valid issue (even quoting relevant laws) being called names and told in a patronizing tone that widely accepted interpretations of said laws are wrong.