Sawmill 8.0.9

Sawmill 8.0.9 is created as a powerful, hierarchical log analysis tool which runs on every major platform. It is particularly well suited to web server access and referrer logs, but can process almost any log.

It runs either with a built-in web server, or as a CGI program on your web server, and publishes an intuitive graphical user interface which can be used from any web browser to configure and run Sawmill, or to view the statistics pages. The statistics pages are hierarchical, attractive, and heavily crosslinked for easy navigation. Complete documentation is built directly into the program. Sawmill provides an extensive set of features, including a persistent database, fine control over the appearance of stats pages, and versatile log filtering options.

Major Features:

1. Easy To Use
   • Sawmill presents an intuitive web-based user interface, which leads you through every step of browsing your log file's statistics. The New Profile Wizard asks questions when it needs information, so you only have to deal with the configuration options which are relevant to the task at hand.
2. Extensive Documentation
   • The manual for Sawmill is built right into the web interface program, so it's always at your fingertips as you use the program. Throughout the HTML interface, there are links to relevant sections of the online documentation, and wherever a configuration option is mentioned, or a value is requested for it, there is a link to that option's documentation page. You can browse the documentation by running any copy of Sawmill.
3. Live Reports & Graphs
   • Sawmill statistics are "live," for unparalleled flexibility while viewing the statistics. Sawmill shows you a collection of interlinked web pages which allow rapid navigation of the entire range of your log statistics.
4. Powerful Dynamic Filters
   • Sawmill allows dynamic segmentation of reports through its advanced filtering capabilities. Simple one-click "zoom" filters provide easy zooming into any item appearing in an report. For more advanced dynamic filtering, Sawmill provides advanced Boolean (AND/OR/NOT) selection based on multiple criteria, including wildcards and regular expressions. Log data can also be filtered on import using Log Filters, which use Salang, Sawmill's build-in scripting language, for extremely flexible filtering and conversion.
5. Attractive Statistics
   • Sawmill's statistics are attractive. The tables are colored for easy reading, and the graphs are designed to be easily readable. You'll be able to take the reports right out of Sawmill and show them to your boss, or your investors, or anyone else, without having to reformat them to make them look good - they already look good.
6. Database Driven
   • Sawmill stores your statistics in an optimized database. This can be Sawmill's own built-in high-performance database, or it can be a Microsoft SQL Server, Oracle, or MySQL database.
7. Role-based Authentication
   • Sawmill supports role-based authentication, allowing you to control in detail what your Sawmill users have permission to do.
8. True Real-time reporting
   • Sawmill can be configured to provide true real-time reporting--up-to-the-second reporting on the current contents of your log files. There is no need for explicit database refreshes, and no need to wait for the log data to finish loading into the database before viewing reports from the latest data.
9. Very Fast
   • Since Sawmill generates a new report every time you click the mouse, it has been heavily optimized for speed. Most pages load in less than five seconds, so you won't be waiting for your statistics. There is no limit to the amount of data Sawmill can analyze, and even really huge datasets (gigabytes of log data) can be browsed in real time.
10. Easy To Install
    • Sawmill is extremely easy to install. For Windows or MacOS, just run the installer and launch the program. For UNIX, just tar/gunzip it and run the executable. Sawmill starts its built-in web server, and you're ready to start using it immediately.
11. Highly Configurable
    • Sawmill is highly configurable using a large set of configuration options. These options can be configured through the graphical user interface from any web browser. The options let you choose which reports are available (or you can create your own custom reports), what types of information are tracked, which log entries are filtered out, what the statistics look like, and much, much more.

Enhancements:

• Bugs fixed in version 8.0.9:
• • [532124] Filtered reports show higher numbers than unfiltered reports, when using "is NOT" filters.
  • [532124] The description of report filters sometimes contains a "not" even when it isn't a "not" filter, if there is also another filter which is a "not" filter.
  • [554819] Multiprocessor database builds create zombie processes on UNIX systems, which last for the duration of the build; on systems with very few processes available, this can cause errors during build, including, "Error spawning process for multi-threaded SSQL query split."
  • [584458] The sort_by (-sb) and sort_direction (-sd) command line options for "-a ect" are not documented.
  • [586149] Profiles with duplicate labels are allowed by the Create Profile Wizard
  • [590678] Log detail report is very slow, when using with a large internal database and no filters.
  • [591432] The update.pl script in the Extras folder does not copy the system.cfg file, so installations updated with that script rerun the installation process.
  • [591629] Scheduled tasks with a single profile, and multiple actions, run all actions simultaneously, instead of running them in sequence.
  • [592187] Database indices, and unique-tracking lists, can become corrupted on 32-bit systems, when processing large datasets (typically, any dataset which would require an index > 2GB, though it could happen as low as 600MB). This can give various errors about "array caches" or "ranges."
  • [592295] When using file-by-file distributed parsing, and "skip previously seen files on update," the list of previously-seen files is not recorded properly, resulting in some files being re-processed on update.
  • [595619] Imported v7 profiles show integers in the sum row of "start time" or "end time" columns, instead of showing "-".
  • [596194] When filtered, the Sessions Overview sometimes shows a negative number for "sessions for one-time users", and shows a few other incorrect values.
  • [596597] Database fields with large aggregated values (more than about 10 billion) incorrectly show very small values (< 10) in the Overview.
  • [596753] The current_log_pathname() function returns the wrong pathname for some log lines, when using multiprocessor database builds.
  • [597095] Removing database data with a date range in a MS SQL database gives an error, "Invalid column name."
  • [597455] Database indices can become corrupt on update, when using the internal database. This can cause errors when displaying filtered reports, or errors during future database updates. Possible error messages include "Unable to allocate N bytes of memory (Reallocating array cache)", "Internal: list N in IntegerLists X ends with -M, which is the start of a range", and possible others.
  • [597949] In real-time profiles, reports hang at 33% during the initial database build, if the build is using parsing servers (multiple processors), or if the file-by-file option is turned on.
  • [597953] Date filter expressions containing capital letters give an error, "Date filter not valid."
  • [598038] Log format plug-ins which use "collected listed", where field values are quoted (e.g., Fortigate), ignore the values immediately after quoted fields.
  • [601338] Cross-reference tables of imported Sawmill 7 profiles do not contain numerical session fields, resulting in slow report generation.
  • [601365] Regular expression or wildcard filters on the "hour of day" or "day of week" field are displayed incorrectly in the yellow filter description at the top of reports, as "corrupt date/time".
  • [601810] Database updates applied to databases imported from Sawmill 7, or to databases using non-internal database servers, do not propagate the new data to the xref tables in some cases, resulting in reports which do not have the latest data.
• New features in 8.0.9:
• • [569464] Added support for a new format variant of the NcFTP Xfer log. For now, the new fields at the end of each line are being ignored.
  • [584392] Added support for overriding the port of SFTP, by using "hostname:port" in the hostname field.

Requirements:

• Window (x86 or x64)
• Linux (x86 or x64)
• Solaris (SPARC, x86, or x64)
• FreeBSD (x86)
• OpenBSD (x86).