FAQ: Clustered Servers

Can Sawmill combine the logs from multiple clustered or load balanced web servers, so that the user has one view of the data? Can it report separately on the different servers?

Short Answer

Yes.

Long Answer

Sawmill can read any number of log files, from any number of servers, into a single database to show a single aggregate set of reports of all the data. If the logs also contain information about which server handled each request (or if each server has a separate log file, or a set of separate log files), then Sawmill can also show per-server statistics, if desired. Unlike many log analysis tools, Sawmill does not care if the files are in order, or if their date ranges overlap -- any combinations of any number of files with data in any order are possible.

To see per-server statistics, look in the reports for a report which breaks down the overall events by server. This might be called "Server domains" or "Server hosts" or "Server IPs" or something else, depending on the log data. Click on a particular server in that report; that zooms you in on that server. Now choose any other report from the "Default report on zoom" dropdown menu, to see a breakdown of the statistics for that server only. Alternatively, you can use the global filters to zoom "permanently" on a particular server, and then all reports will automatically show numbers for that server only.

If you don't have a field that tracks the server, you may still be able to get per-server statistics, by using the current_log_pathname() function detect which server each hit came from. You'll need to create a custom field in that case, with a log field to track the server, a filter to compute the field from the log pathname, and a database field and report for the field. For information on creating custom fields, see Creating Custom Fields.