Sawmill Documentation

   

Technical Manual

  

FAQ

  

User Guide

  

WWW Sawmill

    
DOCUMENTATION
FAQ

Sections of the FAQ

Licensing, Upgrading, and the Trial Version

    Q: What's the difference between the full version of Sawmill and the Trial version?
    A: The Trial version is identical to the full version, except that it expires after 30 days. For full details, see Difference Between Trial and Full.

    Q: What's the difference between Sawmill Enterprise and Sawmill Professional?
    A: Enterprise supports MySQL, RBAC, multithreaded database builds, real-time reporting, and full interface customization. For full details, see Difference Between Enterprise and Professional.

    Q: When I purchase, do I have to download a new version of Sawmill, or can I "unlock" my existing trial installation?
    A: You can unlock your trial installation by entering your license key in the Licensing page. For full details, see Unlocking a Trial Installation.

    Q: My 30-day trial has expired, and I haven't finished evaluating Sawmill yet. How can I get a new trial?
    A: Go to the Licensing page, delete your expired license, and click "Try Sawmill For 30 Days." For full details, see Resetting the Trial Period.

    Q: How can I upgrade to a new version of Sawmill without losing my profiles, databases, and other data?
    A: When upgrading 8.5.x to a newer 8.5.x on Windows, just install the new version on top of the old. When upgrading from an older 8.1.x version to a newer 8.5.x version on Windows, just install the new version on top of the old; when you next view the profiles, it will ask you to convert the older-format profiles and databases to the new. When upgrading 8.x to a newer 8.x on non-Windows, install the new and copy profiles, databases, etc. from the old LogAnalysisInfo to the new; if it's from 8.1.x to 8.5.x, it will prompt for conversion. When upgrading 7 to 8.5.x, use the Import link in the Admin menu. For full details, see Upgrading Without Losing Data.

Major Features

    Q: What platforms does Sawmill run on?
    A: Microsoft Windows 7/8/Vista/XP/2003/2008/2012, Mac OS X, most versions and variants of UNIX. For full details, see Available Platforms.

    Q: How much memory, CPU power, and disk space do I need to run Sawmill?
    A: At least 2GB RAM, 4 GB preferred; 500 MB disk space for an average database; and as much CPU power as you can get. For full details, see System Requirements.

    Q: What sorts of log files can Sawmill process?
    A: Sawmill can handle all major log formats and many minor formats, and you can create your own custom formats. For full details, see Supported Log Formats.

    Q: How is Sawmill different from other log analysis tools?
    A: Among other things, Sawmill does not generate static reports -- it generates dynamic, interlined reports. For full details, see Sawmill vs. The Competition.

    Q: How does a typical company use Sawmill; what does a typical Sawmill setup look like?
    A: Installations vary from customer to customer--Sawmill provides enough flexibility to let you choose the model that works best for you. For full details, see Typical Usage Patterns.

    Q: How large of a log file can Sawmill process?
    A: There are no limits, except those imposed by the limitations of your server. For full details, see Processing Large Log Files.

    Q: Does the log data I feed to Sawmill need to be in chronological order?
    A: It depends on the format, but in most cases, the log data can be in any order. For full details, see Log Entry Ordering.

    Q: How can I create many profiles in a batch, from a template?
    A: Use the create_many_profiles command-line option. For full details, see Creating many profiles in a batch.

Installation and Setup

    Q: What is a log file?
    A: Log files are text files created by your server, recording each hit on your site. Sawmill generates its statistics by analyzing log files. For full details, see What is a Log File?.

    Q: Can Sawmill be configured to automatically analyze the access log for my site on a shared server once a day at a given time?
    A: Yes, if you run it stand-alone, or if your server has a scheduling program. For full details, see Scheduling.

    Q: I'm running Sawmill on Windows, and it automatically starts itself up on IP 127.0.0.1 and port 8988. How can I tell it to use another IP address and port?
    A: Set the Server Hostname option and the Web Server Port option in the Network section of the Preferences. For full details, see Running on a Different IP.

    Q: How do I see referrer (referring URL, search engines, and search terms), agent (browser and OS), or error statistics?
    A: Use "extended" or "combined" log format to see referrer and agent information, or analyze the log files with a separate profile. For error logs, analyze them with a separate profile. For full details, see Referrer, Agent, and Error Logs.

    Q: Is Sawmill available in languages other than English? How can I change the output of Sawmill to be in a different language, or to use different wording?
    A: Sawmill is currently available in English, German, and Japanese, and can be translated into any language fairly easily. Customization of output text is also easy. For full details, see Language Modules--Localization and Customization.

    Q: Can I set up Sawmill to start automatically when the computer starts up?
    A: Yes; run it as a Service on Windows; use StartupItems under MacOS X; use the /etc/rc.d mechanism on UNIX systems that support it. For full details, see Running Sawmill at System Startup.

    Q: When I run Sawmill in a UNIX terminal window, and then close the window, Sawmill stops working. What can I do about that?
    A: Add an ampersand (&) to the end of the command line to run it in the background. For full details, see Running Sawmill in the Background.

    Q: How can I move the LogAnalysisInfo folder somewhere else?
    A: Install Sawmill somewhere else, or make a symbolic link to LogAnalysisInfo, or put the pathname of the new location in the file LogAnalysisInfoDirLoc For full details, see Relocating LogAnalysisInfo.

    Q: How can I run Sawmill in CGI mode, and still use the Sawmill Scheduler?
    A: Use an external Scheduler to run jobs or to call the Sawmill Scheduler, or run Sawmill in both CGI and web server modes. For full details, see Using the Scheduler with CGI Mode.

    Q: Can Sawmill be configured to automatically FTP log files from multiple servers, and add them daily to a database?
    A: Yes. For full details, see Downloading Log Data by FTP.

    Q: Can Sawmill use scp, or sftp, or ssh, or https, to download log data? Can it uncompress tar, or arc, or sea, or hqx, etc.?
    A: Not directly, but you can do it by using a command-line log source to run a command line, script, or program that does whatever is necessary to fetch the data, and prints it to Sawmill. For full details, see Using a Command-line Log Source.

    Q: Can I run Sawmill as a Service on Windows? Can I run Sawmill while I'm logged out?
    A: As of version 8, Sawmill is installed as a service when you run the normal installer. For full details, see Running Sawmill as a Service.

    Q: My web site is hosted in another state. Does Sawmill provide browser based admin tools I can use to configure it and retrieve reports?
    A: Yes, Sawmill's interface is entirely browser based. For full details, see Remote Administration.

    Q: Can Sawmill generate separate analyses for all the web sites hosted on my server?
    A: Yes, Sawmill includes a number of features for just this purpose. For full details, see Statistics for Multiple Sites.

    Q: Can Sawmill process ZIPped, gzipped, or bzipped log data?
    A: Yes, all three. For full details, see Processing zipped, gzipped, or bzipped Log Data.

    Q: Can Sawmill combine the logs from multiple clustered or load balanced web servers, so that the user has one view of the data? Can it report separately on the different servers?
    A: Yes. For full details, see Clustered Servers.

    Q: Can Sawmill be configured to limit access to statistics, so that a customer can only see the statistics associated with their section of my web site?
    A: Yes, you can password protect statistics in several ways. For full details, see Protecting Clients' Statistics.

    Q: I want to deploy Sawmill to my customers, but I want it to look like part of my site. I don't want the name Sawmill to appear -- I want my own name to appear. Can I relabel or white-label Sawmill?
    A: Yes, but the degree to which you can relabel depends on your license. For full details, see Relabeling/White-labeling Sawmill.

    Q: What features can I use in Sawmill's regular expressions?
    A: You can use whatever's documented (Regular Expressions), and possibly more. How much more you can use depends on your platform. For full details, see Regular Expression Features.

    Q: Are Sawmill's regular expressions case-sensitive?
    A: Yes. For full details, see Regular Expression Case-sensitivity.

    Q: How can I debug my custom log format, or my log filters?
    A: Build the database from the command line with the -v option: sawmill -p profilename -a bd -v egblpfd. For full details, see Using Debugging Output.

    Q: Sawmill doesn't work in CGI mode with SELinux enabled; how do I get it to work?
    A: Use semodule to allow the operations that Sawmill uses; see the long answer. For full details, see Configuring Sawmill to work with Security Enhanced Linux, in CGI mode.

    Q: How can I create a new profile, by copying an old one?
    A: Take an existing profile and change the first line to the new name. For full details, see How to Copy a Profile.

    Q: How can I rename a profile, after it has been created?
    A: Either recreate it with the new name, or edit the profile .cfg with a text editor, and change the label. For full details, see Renaming a profile.

Log Filters

    Q: How can I exclude hits from my own IP address, or from my organization's domain?
    A: Add a Log Filter to exclude those hits. For full details, see Excluding an IP Address or Domain.

    Q: How can I throw away all the spider hits, so I only see statistics on non-spider hits?
    A: Use a Log Filter to reject all hits from spiders (and worms). For full details, see Discarding hits from spiders.

    Q: Can Sawmill generate statistics on just one domain, from a log file containing log data from many domains?
    A: Yes. Add a log filter that rejects hits from all other domains. For full details, see Filtering All but One Domain.

    Q: How can I remove a particular file or directory from the statistics?
    A: Use a Log Filter to reject all hits on that file or directory. For full details, see Excluding a File or directory.

    Q: How can I group my events in broad categories (like "internal" vs. "external" or "monitoring" vs. "actual"), and see the events on each category separately, or see them combined? How can I create content groups? How can I include information from an external database in my reports, e.g. include the full names of users based on the logged username, or the full names of pages based on the logged URL? How can I extract parts of the URL and report them as separate fields?
    A: Create a new log field, database field, report, and report menu item to track and show the category or custom value, and then use a log filter to set the log field appropriately for each entry. For full details, see Creating Custom Fields.

    Q: How do I remove fields from the database to save space?
    A: Delete the database.fields entry from the profile .cfg file, and delete any xref groups and reports that use it. For full details, see Removing Database Fields.

    Q: Most of the referrers listed in the "Top referrers" view are from my own site. Why is that, and how can I eliminate referrers from my own site from the statistics?
    A: These are "internal referrers"; they represent visitors going from one page of your site to another page of your site. You can eliminate them by modifying the default "(internal referrer)" log filter, changing http://www.mydomain.com/ in that filter to your web site URL. For full details, see Eliminating Internal Referrers.

    Q: I use parameters on my pages (e.g. index.html?param1+param2), but Sawmill just shows "index.html?(parameters)." How can I see my page parameters?
    A: Delete the Log Filter that converts the parameters to "(parameters)." For full details, see Page Parameters.

    Q: How can I see just the most recent day/week/month of statistics?
    A: Use the Calendar, or the Filters, or use a recentdays filter on the command line. For full details, see Recent Statistics.

    Q: How can I combine referrers, so hits from http://search.yahoo.com, http://dir.yahoo.com, and http://google.yahoo.com are combined into a single entry?
    A: Create a log filter converting all the hostnames to the same hostname. For full details, see Combining Referring Domains.

    Q: How can I debug my custom log format, or my log filters?
    A: Build the database from the command line with the -v option: sawmill -p profilename -a bd -v egblpfd. For full details, see Using Debugging Output.

    Q: When I look at the top hosts and top domains, all I see are numbers (IP addresses). How do I get the domain information?
    A: Turn on reverse DNS lookup in the Network options (or in your web server), or use Sawmill's "look up IP numbers using DNS" feature. For full details, see Resolving IP Numbers.

    Q: Can I configure Sawmill to recognize search engines other than the ones it knows already?
    A: Yes -- just edit the search_engines.cfg file in the LogAnalysisInfo directory with a text editor. For full details, see Adding Search Engines.

    Q: My server logs times in GMT, but I'm in a different time zone. How can I get the statistics in my own time zone?
    A: Set the date_offset option in the profile. For full details, see Changing the Time Zone in Statistics.

Reports

    Q: In web server analyses, what are "hits," "page views," "bandwidth" or "bytes," "visitors," or "sessions"? In media analyses, what are "stream duration," "play duration," "pause duration," "session duration," "events," "streams," or "concurrent connection," or "successful accesses"?
    A: Hits are accesses to the server; page views are accesses to HTML pages; visitors are unique visitors to the site, and sessions are visits to the site. Play duration is the most useful measure of time actually spent playing; pause duration is time spent paused; stream and session duration are the time spent connected; events is the total number of log lines; stream is the unique number of streams accessed; successful accesses are the number of non-error streaming events. For full details, see Definitions of Numerical Fields.

    Q: My web site uses dynamic URLs instead of static pages; i.e. I have lots of machine-generated URLs that look like /file?param1=value1&param2=value2.... Can Sawmill report on those?
    A: Yes, but you need to delete the "(parameters)" log filter first. For full details, see Dynamic URLs.

    Q: There's a line above some of the tables in the statistics that says, "parenthesized items omitted." What does that mean?
    A: It means that some items (probably useless ones) have been omitted from the table to make the information more useful--you can show them by choosing "show parenthesized items" from the Options menu. For full details, see Parenthesized Items Omitted.

    Q: In my reports, I see entries for /somedir/, and /somedir, and /somedir/ (default page). What's the difference? I seem to have two hits for each hit because of this; one on /somedir and then one on /somedir/; what can I do to show that as one hit?
    A: /somedir/ is the total hits on a directory and all its contents; /somedir is an attempt to hit that directory which was directed because it did not have the trailing slash; and the default page ones both indicate the number of hits on the directory itself (e.g., on the default page of the directory). For full details, see Default Page Hits.

    Q: How do I see the number of downloads for a particular file (i.e. a newsletter PDF, or a template file PDF)?
    A: Select PDF from the 'File Types' table and then use the Zoom Menu to Zoom to the URL's report, then Select the PDF you need to get an overview of that file. For full details, see Zooming on single files.

    Q: How do I see more levels of statistics (i.e. how can I zoom in further)?
    A: Increase the "suppress below" level for this database field in the profile options. For full details, see Zooming Further.

    Q: Can I see the number of hits per week? Can I see a "top weeks" report?
    A: Yes, by using the Calendar, and/or creating a database field and a report tracking "weeks of the year." For full details, see Weekly Statistics.

    Q: Can Sawmill count unique visitors?
    A: Yes, using unique hostname or using cookies. For full details, see Unique Visitors.

    Q: Can Sawmill count visitors using cookies, rather than unique hostnames?
    A: Yes -- it includes a built-in log format to do this for Apache, and other servers can be set up manually. For full details, see Counting Visitors With Cookies.

    Q: Sawmill shows IP addresses, or hostnames, in the Sessions reports, but I want it to show usernames instead. How can I do that?
    A: Edit the profile .cfg, and change sessions_visitor_id_field to the username field. For full details, see Tracking Sessions with Usernames instead of IPs.

    Q: Can Sawmill show me the paths visitors took through my web site?
    A: Yes; its "session paths (clickstreams)" report is very powerful. For full details, see Clickstreams (Paths Through the Site).

    Q: I want to track conversions-- i.e. I want to know which of my ads are actually resulting in sales. Can Sawmill do that?
    A: Yes -- encode source information in your URLs and use global filters to show the top entry pages for your "success" page. For full details, see Tracking Conversions.

    Q: How can I see the top (insert field here) for each (insert field here)? For instance, how can I see the pages hit by particular visitor? Or the top visitors who hit a particular page? Or the top referrers for a particular day, or the top days for a particular referrer? Or the top search phrases for a search engine, the top authenticated users for a directory, the top directories accessed by an authenticated user, etc.?
    A: Click on the item you're interested in, and chose the other field from "default report on zoom". For full details, see Finding the Top (field) for a Particular (field).

    Q: How can I see only the visitors that entered at a particular page, or only the visitors that hit a particular page at some point in their session?
    A: Use the global filters to show only sessions containing that page; reports will only show sessions including that page. For full details, see Sessions For A Particular Page.

    Q: How can I see only the visitors that came from a particular search engine?
    A: Direct that search engine to a particular entry page, and then use global filters to show only sessions for that page. For full details, see Sessions For A Particular Search Engine.

    Q: Why doesn't the number of visitors in the Overview match the number of session users in the "Sessions Overview" report?
    A: Session information only shows users contributing page views, and other views show all visitors. Also, long sessions are discarded from the session information. For full details, see Visitors vs. Session Users.

    Q: How can I see just the most recent day/week/month of statistics?
    A: Use the Calendar, or the Filters, or use a recentdays filter on the command line. For full details, see Recent Statistics.

    Q: Can I export the data from Sawmill reports to Excel or other programs?
    A: Yes; click the "export" link in the toolbar above reports to export the data from that report's table in CSV format. Many programs, including Excel, can import CSV format files. For full details, see Exporting Data From Statistics.

    Q: I've heard that statistics like visitors, "sessions," and "paths through the site" can't be computed accurately. Is that true? Are the statistics reported by Sawmill an accurate description of the actual traffic on my site?
    A: Sawmill accurately reports the data as it appears in the log file. However, many factors skew the data in the log file. The statistics are still useful, and the skew can be minimized through server configuration. For full details, see Are the Statistics Accurate?.

    Q: How does Sawmill compute session information, like total sessions, repeat visitors, paths through the site, entry pages, exit pages, time spent per page, etc.?
    A: Sawmill uses the visitor id field to identify unique visitors. It decides that a new session has begun if a visitor has been idle for 30 minutes. For full details, see Session Computation.

    Q: How do I change the field which is graphed, e.g. from page view to bandwidth?
    A: Edit the profile .cfg file, and change the field name in the numerical_fields section of that report element. For full details, see Changing the graph field.

    Q: Does Sawmill do "peak period" reports (by weekday, or hour)?
    A: Yes. For full details, see Peak Period Reports.

    Q: Does Sawmill do time of day?
    A: Yes. For full details, see Time of Day Statistics.

    Q: How can I tell where visitors went when they left the site?
    A: Normally, you can't. However, you can set up "reflector" pages if you need this information. For full details, see Tracking Exit URLs.

    Q: How can I see all files that were hit on my web site, not just the pages?
    A: Delete or disable the 'Strip non-page-views' log filter, and rebuild the database For full details, see Showing All Files.

    Q: Why do I see hits on a file called "robots.txt" in my statistics?
    A: robots.txt is a file that tells search engine spiders and robots what they can do, so a hit on robots.txt means that a spider visited your site. For full details, see robots.txt.

    Q: Why do I see a hits on a file called "favicon.ico" in my statistics?
    A: favicon.ico is a special icon file that Internet Explorer looks for when it first visits the site. For full details, see favicon.ico.

    Q: How can I add additional columns to report tables, e.g. to add a single report which reports source IP, destination IP, source port, and destination port?
    A: Edit the report in the profile .cfg file to add a new item to the columns group. For full details, see Adding columns to report tables.

    Q: Does Sawmill produce reports for HIPAA and Sarbanes-Oxley (SOX) compliance?
    A: Yes, run the Single-Page Summary report. For full details, see Support for HIPAA and Sarbanes-Oxley Compliance.

    Q: Some of the IP addresses in my data are not resolved properly to country/region/city by Sawmill. I know that Sawmill uses the MaxMind GeoIP database, and when I go to the MaxMind site, their demo resolves these IPs properly. Why isn't Sawmill doing the same as the online GeoIP demo?
    A: Sawmill uses the GeoLite City database, a less accurate (and less expensive) version of the GeoIP City database. To get full accuracy, buy GeoIP City from MaxMind. For full details, see GeoIP database in Sawmill is not as accurate as the one on the Maxmind site.

    Q: When I export CSV, durations appear as numbers, which Excel doesn't understand. How can I format durations to work with Excel?
    A: Add an extra column to the spreadsheet to convert them to fractional days; or use a custom database field in the report element. For full details, see Formatting Durations for Excel.

    Q: When I'm saving a report for the first time but what about my filters?
    A: If you have no filters active, then they will not be saved with your report. For full details, see Saving filters during Save as New Report.

Troubleshooting

    Q: When I run Sawmill, it tells me that the server is started (it shows me the URL), but when I try to access that URL, the browser says it's not available. How can I fix this?
    A: You may be using a proxy server which prevents you from accessing a server running on your own machine. Try reconfiguring the proxy to allow it, or try running Sawmill on IP 127.0.0.1 (the loopback interface). For full details, see Can't Access the Server.

    Q: On Windows 2003, I can't access the Sawmill server using Internet Explorer. Why not?
    A: The "Internet Explorer Enhanced Security Configuration" may be enabled, blocking access; uninstall it or add 127.0.0.1:8988 to the trusted sites. For full details, see Can't access server with Windows 2003 and IE.

    Q: When I try to log in to Sawmill, I get to the Admin page, but the next thing I click takes me back to the login page. Why?
    A: Your browser isn't storing the cookie Sawmill needs to maintain the login, or something is blocking the browser from sending the cookie. Make sure cookies are on in the browser, firewalls aren't blocking cookies, and don't use Safari 1.2.1 or earlier as your browser. For full details, see Login Loops Back to Login.

    Q: Why can't Sawmill see my mapped drive, share, directory, or mount points when I run it as a Windows Service?
    A: The Service must run with the same privileged user account that has the mapped drive, share, directory, or mount point privilege. For full details, see Can't See Network Drives with Sawmill as Service.

    Q: Why can't Sawmill see my mapped drive, share, directory, or mount points when I run it under Windows 2003?
    A: Windows 2003 has a strict security policy which prevents access to network drives from Sawmill. To make it work, you need to let "everyone" permissions apply to anonymous, and remove the restriction on anonymous access to named pipes and shares (in Administrative Tools). For full details, see Can't See Network Drives in Windows 2003.

    Q: When I build or update my database with Sawmill, it uses a huge amount of memory. Then, when I view statistics, it's very slow. What can I do about that?
    A: Decrease the complexity of the database. For full details, see Sawmill uses too much memory for builds/updates, and is slow to view.

    Q: I get an error 'Unable to allocate N bytes of memory' while building a database, and Sawmill seems to have used all my available memory. What can I do about it?
    A: Use a 64-bit computer and operating system with sufficient RAM, and/or simplify your database For full details, see Database Memory Usage.

    Q: When I try to build a database, or view reports, I get an error, "The total number of locks exceeds the lock table size". How can I fix this?
    A: Increase the innodb_buffer_pool_size in my.cnf (my.ini), to 256M. For full details, see Error with MySQL: "The total number of locks exceeds the lock table size".

    Q: When building a database with Oracle, I get an error, "ORA-01000: maximum open cursors exceeded." What can I do to fix this?
    A: Increase open_cursors to 1000 in your Oracle server. For full details, see Error with Oracle: "ORA-01000: maximum open cursors exceeded".

    Q: I can't access Sawmill where I usually do (http://www.xxx.yyy.zzz:8988/) -- is your (Flowerfire's) server down?
    A: No -- your server is down. Sawmill runs on your computer, not on ours -- contact your network administrator if you're having problems accessing it. For full details, see Sawmill Server is Down.

    Q: Sawmill displays the following error: "The background process terminated unexpectedly, without returning a result." What does that mean, and how can I fix it?
    A: Sawmill has probably crashed, so this could be a bug in Sawmill. See the long answer for suggestions. For full details, see The background process terminated unexpectedly.

    Q: When I run Sawmill on Windows, I get an error: "A required DLL is missing: WS2_32.DLL." What's going on?
    A: You need Winsock 2. For full details, see Winsock 2.

    Q: When I run Sawmill on Windows 98, I get an error: "A required DLL is missing: OLEACC.DLL." What's going on?
    A: You need to download and install the latest Service Pack for Windows 98. For full details, see Missing DLL: OLEACC.DLL.

    Q: When I run Sawmill on Windows, I get an error: "A required DLL is missing: URLMON.DLL." What's going on?
    A: Install the latest Internet Explorer, and the problem should go away. For full details, see Missing DLL: URLMON.DLL.

    Q: When I run Sawmill, I get an error: './sawmill: error while loading shared libraries: libstdc++.so.5: cannot open shared object file: No such file or directory'. What's going on?
    A: Sawmill requires the libstdc++ library. This is available by default on many platforms, and is included in the Sawmill distribution on others (including Solaris) For full details, see libstdc++ missing.

    Q: When I try to run Sawmill, I get an error "relocation error: sawmill: undefined symbol: __dynamic_cast_2". How can I fix this?
    A: This is a GNU library incompatibility; build Sawmill from source instead of using the binary distribution. For full details, see Relocation error: __dynamic_cast_2.

    Q: Sawmill only shows me the IP addresses of my visitors, even when I turn on DNS lookup. Why?
    A: Try deleting the IPNumbersCache file in LogAnalysisInfo -- see the long answer for other solutions. For full details, see Problems With DNS Lookup.

    Q: I run Sawmill in CGI mode, and all the images in the menus and the reports are missing or broken. Why?
    A: You may have set the "temporary directory" incorrectly during installation. Try deleting the preferences.cfg file in LogAnalysisInfo, and access Sawmill to try again. For full details, see No Images in CGI Mode.

    Q: The statistics show the wrong years -- when I analyze data from previous years, it appears as this year, or data from this year appears in last year. Why?
    A: Your log format does not include year information, so Sawmill has to guess the year. Use a different log format if possible (one which includes year information). See the long answer for a way of manually setting the year for blocks of log data. For full details, see Years are wrong in the statistics.

    Q: When I run Sawmill as a CGI program under IIS, I get an error message "CGI Timeout: The specified CGI application exceeded the allowed time for processing. The server has deleted the process." What can I do about that?
    A: Set the IIS CGI timeout to a high value, like 999999. For full details, see IIS CGI Timeout.

    Q: I've forgotten the password I chose for Sawmill when I first installed; how can I reset it?
    A: As of version 8.0.2, there is a custom action reset_root_admin. For full details, see Resetting the Administrative Password.

    Q: When I run Sawmill as a CGI, it runs as a special user (nobody, web, apache, etc.). Then when I want to use Sawmill from the command line or in web server mode, the permissions don't allow it. What can I do about this?
    A: Loosen the permissions in the Preferences, or run your CGI programs as a different user, or run your command line programs as the CGI user. For full details, see CGI User Permissions.

    Q: How much memory/disk space/time does Sawmill use?
    A: It depends on how much detail you ask for in the database. It uses very little if you use the default detail levels. For full details, see Resource Usage.

    Q: When I add up the number of visitors on each day of the month, and I compare it to the total visitors for the month, they're not equal. Why not? Also, why doesn't the sum of visitors on subpages/subdirectories add up to the total for the directory, and why doesn't the sum of visitors on subdomains add up to the total for the domain, etc.? Why are there dashes (-) for the visitor totals?
    A: Because "visitors" is the number of unique visitors, a visitor who visits every day will show up as a single visitor in each day's visitors count, but also as a single visitor for the whole month -- not 30 visitors! Therefore, simple summation of visitor numbers gives meaningless results. For full details, see Visitor Totals Don't Add Up.

    Q: When I look at my statistics, I see that some days are missing. I know I had traffic on those days. Why aren't they shown?
    A: Your ISP may be regularly deleting or rotating your log data. Ask them to leave all your log data, or rotate it over a longer interval. It's also possible that your log data does not contain those days for another reason. For full details, see Days Are Missing from the Log Data.

    Q: My log data contains referrer information, but I don't see referrer reports, or search engines, or search phrases. Why not?
    A: Sawmill includes referrer reports if the beginning of the log data includes referrers. If your log data starts without referrers, and adds it later, you won't see referrer reports. Create a new profile from the latest log file (with referrers), and change the log source to include all log data. For full details, see Referrer Reports Missing.

    Q: When I process log data with Sawmill, it uses most or all of my processor; it says it's using 90%, or even 100% of the CPU. Should it be doing that? Is that a problem?
    A: Yes, it should do that, and it's not usually a problem. Any CPU-intensive program will do the same. However, you can throttle it back if you need to, using operating system priorities. For full details, see Sawmill Uses Too High a Percentage of CPU.

    Q: How do I build a database from the command line?
    A: Run "executable -p profilename -a bd" from the command line window of your operating system. For full details, see Building a Database from the Command Line.

    Q: Sawmill does not recognize my Symantex SGS/SEF log data, because it is binary. How can I export this data to a text format so Sawmill can process it?
    A: Use flatten8, or remorelog8 For full details, see Exporting Symantec SGS/SEF data to text format.

    Q: How can I track full URLs, or HTTP domains, or resolved hostnames, when analyzing PIX log data?
    A: You can't track full URLs or HTTP domains, because PIX doesn't log them; but you can turn on DNS lookup in the PIX or in Sawmill to report resolved hostnames. For full details, see Tracking URLs in Cisco PIX log format.

    Q: I installed Sawmill on a 64-bit (x64) Mac, and now it says, "This profile uses a MySQL database, but MySQL is not enabled in this build." Why?
    A: MySQL does not currently work on x64 MacOS. For full details, see MySQL and x64 MacOS.

    Q: How do I backup and restore my Sawmill installation, or a particular profile and its database?
    A: Backup and restore the LogAnalysisInfo folder when no update or build is running, or for one profile. For MySQL also backup and restore the MySQL database. For full details, see Backup and Restore.

    Q: On Windows, I sometimes get "permission denied" errors, or "volume externally altered" errors, or "file does not exist" error when building a database. But sometimes, it works. What can cause this sort of sporadic file error?
    A: An anti-virus or anti-malware software, which is actively scanning your Sawmill installation folder, can cause this. Disable scanning of Sawmill's data folders, in the anti-virus product. For full details, see Permission Denied Errors.

    Q: Will my plug-in work with version 8?
    A: Most version 7 plug-ins will work with version 8. For full details, see Using version 7 plug-ins.

    Q: Why do my emailed reports from Outlook 2003 not line up, everything is out of alignment?
    A: Change the settings in Outlook to not load automatically. For full details, see Emailed Reports in Outlook 2003.

Miscellaneous

    Q: Where did the name "Sawmill" come from?
    A: A sawmill is a tool that processes logs, and so is Sawmill. For full details, see The Name "Sawmill".

    Q: Why are new versions of Sawmill released so often? Is it buggy? Do I need to download every new version?
    A: We ship new versions to provide our customers with the latest minor features and bug fixes quickly. Sawmill is no buggier than any other software, and you don't need to download a new release unless you're having problems with the current one. For full details, see Frequent New Versions of Sawmill.