Licensing, Upgrading, and the Trial Version

What's the difference between the full version of Sawmill and the Trial version?
The Trial version is identical to the full version, except that it expires after 30 days.
For full details, see Difference Between Trial and Full
When I purchase, do I have to download a new version of Sawmill, or can I "unlock" my existing trial installation?
You can unlock your trial installation by entering your license key in the Licensing page.
For full details, see Unlocking a Trial Installation
How can I upgrade to a new version of Sawmill without losing my profiles, databases, and other data?
When upgrading 8.6.x to a newer 8.6.x on Windows, just install the new version on top of the old. When upgrading from an older 8.1.x version to a newer 8.6.x version on Windows, just install the new version on top of the old; when you next view the profiles, it will ask you to convert the older-format profiles and databases to the new. When upgrading 8.x to a newer 8.x on non-Windows, install the new and copy profiles, databases, etc. from the old LogAnalysisInfo to the new; if it's from 8.1.x to 8.6.x, it will prompt for conversion. When upgrading 7 to 8.6.x, use the Import link in the Admin menu.
For full details, see Upgrading Without Losing Data

Major Features

What platforms does Sawmill run on?
Microsoft Windows 7/8/Vista/XP/2003/2008/2012, Mac OS X, most versions and variants of UNIX.
For full details, see Available Platforms
How much memory, CPU power, and disk space do I need to run Sawmill?
At least 2GB RAM, 4 GB preferred; 500 MB disk space for an average database; and as much CPU power as you can get.
For full details, see System Requirements
What sorts of log files can Sawmill process?
Sawmill can handle all major log formats and many minor formats, and you can create your own custom formats.
For full details, see Supported Log Formats
How is Sawmill different from other log analysis tools?
Among other things, Sawmill does not generate static reports -- it generates dynamic, interlined reports.
For full details, see Sawmill vs. The Competition
How does a typical company use Sawmill; what does a typical Sawmill setup look like?
Installations vary from customer to customer--Sawmill provides enough flexibility to let you choose the model that works best for you.
For full details, see Typical Usage Patterns
How large of a log file can Sawmill process?
There are no limits, except those imposed by the limitations of your server.
For full details, see Processing Large Log Files
Does the log data I feed to Sawmill need to be in chronological order?
It depends on the format, but in most cases, the log data can be in any order.
For full details, see Log Entry Ordering
How can I create many profiles in a batch, from a template?
Use the create_many_profiles command-line option.
For full details, see Creating many profiles in a batch

Installation and Setup

What is a log file?
Log files are text files created by your server, recording each hit on your site. Sawmill generates its statistics by analyzing log files.
For full details, see What is a Log File?
Can Sawmill be configured to automatically analyze the access log for my site on a shared server once a day at a given time?
Yes, if you run it stand-alone, or if your server has a scheduling program.
For full details, see Scheduling
I'm running Sawmill on Windows, and it automatically starts itself up on IP and port 8988. How can I tell it to use another IP address and port?
Set the Server Hostname option and the Web Server Port option in the Network section of the Preferences.
For full details, see Running on a Different IP
How do I see referrer (referring URL, search engines, and search terms), agent (browser and OS), or error statistics?
Use "extended" or "combined" log format to see referrer and agent information, or analyze the log files with a separate profile. For error logs, analyze them with a separate profile.
For full details, see Referrer, Agent, and Error Logs
Is Sawmill available in languages other than English? How can I change the output of Sawmill to be in a different language, or to use different wording?
Sawmill is currently available in English, German, and Japanese, and can be translated into any language fairly easily. Customization of output text is also easy.
For full details, see Language Modules--Localization and Customization
Can I set up Sawmill to start automatically when the computer starts up?
Yes; run it as a Service on Windows; use StartupItems under MacOS X; use the /etc/rc.d mechanism on UNIX systems that support it.
For full details, see Running Sawmill at System Startup
When I run Sawmill in a UNIX terminal window, and then close the window, Sawmill stops working. What can I do about that?
Add an ampersand (&) to the end of the command line to run it in the background.
For full details, see Running Sawmill in the Background
How can I move the LogAnalysisInfo folder somewhere else?
Install Sawmill somewhere else, or make a symbolic link to LogAnalysisInfo, or put the pathname of the new location in the file LogAnalysisInfoDirLoc
For full details, see Relocating LogAnalysisInfo
How can I run Sawmill in CGI mode, and still use the Sawmill Scheduler?
Use an external Scheduler to run jobs or to call the Sawmill Scheduler, or run Sawmill in both CGI and web server modes.
For full details, see Using the Scheduler with CGI Mode
Can Sawmill use scp, or sftp, or ssh, or https, to download log data? Can it uncompress tar, or arc, or sea, or hqx, etc.?
Not directly, but you can do it by using a command-line log source to run a command line, script, or program that does whatever is necessary to fetch the data, and prints it to Sawmill.
For full details, see Using a Command-line Log Source
Can I run Sawmill as a Service on Windows? Can I run Sawmill while I'm logged out?
As of version 8, Sawmill is installed as a service when you run the normal installer.
For full details, see Running Sawmill as a Service
Can Sawmill generate separate analyses for all the web sites hosted on my server?
Yes, Sawmill includes a number of features for just this purpose.
For full details, see Statistics for Multiple Sites
What features can I use in Sawmill's regular expressions?
You can use whatever's documented (Regular Expressions), and possibly more. How much more you can use depends on your platform.
For full details, see Regular Expression Features
How can I debug my custom log format, or my log filters?
Build the database from the command line with the -v option: sawmill -p profilename -a bd -v egblpfd.
For full details, see Using Debugging Output
Sawmill doesn't work in CGI mode with SELinux enabled; how do I get it to work?
Use semodule to allow the operations that Sawmill uses; see the long answer.
For full details, see Configuring Sawmill to work with Security Enhanced Linux, in CGI mode
How can I create a new profile, by copying an old one?
Take an existing profile and change the first line to the new name.
For full details, see How to Copy a Profile
How can I rename a profile, after it has been created?
Either recreate it with the new name, or edit the profile .cfg with a text editor, and change the label.
For full details, see Renaming a profile

Log Filters

How can I throw away all the spider hits, so I only see statistics on non-spider hits?
Use a Log Filter to reject all hits from spiders (and worms).
For full details, see Discarding hits from spiders
How can I remove a particular file or directory from the statistics?
Use a Log Filter to reject all hits on that file or directory.
For full details, see Excluding a File or directory
How do I remove fields from the database to save space?
Delete the database.fields entry from the profile .cfg file, and delete any xref groups and reports that use it.
For full details, see Removing Database Fields
Most of the referrers listed in the "Top referrers" view are from my own site. Why is that, and how can I eliminate referrers from my own site from the statistics?
These are "internal referrers"; they represent visitors going from one page of your site to another page of your site. You can eliminate them by modifying the default "(internal referrer)" log filter, changing http://www.mydomain.com/ in that filter to your web site URL.
For full details, see Eliminating Internal Referrers
How can I see just the most recent day/week/month of statistics?
Use the Date Picker, or -df filter on the command line.
For full details, see Recent Statistics
How can I debug my custom log format, or my log filters?
Build the database from the command line with the -v option: sawmill -p profilename -a bd -v egblpfd.
For full details, see Using Debugging Output
When I look at the top hosts and top domains, all I see are numbers (IP addresses). How do I get the domain information?
Turn on reverse DNS lookup in the Network options (or in your web server), or use Sawmill's "look up IP numbers using DNS" feature.
For full details, see Resolving IP Numbers
Can I configure Sawmill to recognize search engines other than the ones it knows already?
Yes -- just edit the search_engines.cfg file in the LogAnalysisInfo directory with a text editor.
For full details, see Adding Search Engines


In web server analyses, what are "hits," "page views," "bandwidth" or "bytes," "visitors," or "sessions"? In media analyses, what are "stream duration," "play duration," "pause duration," "session duration," "events," "streams," or "concurrent connection," or "successful accesses"?
Hits are accesses to the server; page views are accesses to HTML pages; visitors are unique visitors to the site, and sessions are visits to the site. Play duration is the most useful measure of time actually spent playing; pause duration is time spent paused; stream and session duration are the time spent connected; events is the total number of log lines; stream is the unique number of streams accessed; successful accesses are the number of non-error streaming events.
For full details, see Definitions of Numerical Fields
There's a line above some of the tables in the statistics that says, "parenthesized items omitted." What does that mean?
It means that some items (probably useless ones) have been omitted from the table to make the information more useful--you can show them by choosing "show parenthesized items" from the Options menu.
For full details, see Parenthesized Items Omitted
In my reports, I see entries for /somedir/, and /somedir, and /somedir/ (default page). What's the difference? I seem to have two hits for each hit because of this; one on /somedir and then one on /somedir/; what can I do to show that as one hit?
/somedir/ is the total hits on a directory and all its contents; /somedir is an attempt to hit that directory which was directed because it did not have the trailing slash; and the default page ones both indicate the number of hits on the directory itself (e.g., on the default page of the directory).
For full details, see Default Page Hits
How do I see the number of downloads for a particular file (i.e. a newsletter PDF, or a template file PDF)?
Select PDF from the 'File Types' table and then use the Zoom Menu to Zoom to the URL's report, then Select the PDF you need to get an overview of that file.
For full details, see Zooming on single files
How do I see more levels of statistics (i.e. how can I zoom in further)?
Increase the "suppress below" level for this database field in the profile options.
For full details, see Zooming Further
Can I see the number of hits per week? Can I see a "top weeks" report?
Yes, by using the Calendar, and/or creating a database field and a report tracking "weeks of the year."
For full details, see Weekly Statistics
Can Sawmill count unique visitors?
Yes, using unique hostname or using cookies.
For full details, see Unique Visitors
Can Sawmill count visitors using cookies, rather than unique hostnames?
Yes -- it includes a built-in log format to do this for Apache, and other servers can be set up manually.
For full details, see Counting Visitors With Cookies
Sawmill shows IP addresses, or hostnames, in the Sessions reports, but I want it to show usernames instead. How can I do that?
Detach the "Sessions" snapon (detach the "Bounce Rate (package)" snapon first if it's attached), and reattach the Sessions snapon, selecting the username field as the session user field. See the Long Answer for more options.
For full details, see Tracking Sessions with Usernames instead of IPs
Can Sawmill show me the paths visitors took through my web site?
Yes; its "session paths (clickstreams)" report is very powerful.
For full details, see Clickstreams (Paths Through the Site)
I want to track conversions-- i.e. I want to know which of my ads are actually resulting in sales. Can Sawmill do that?
Yes -- encode source information in your URLs and use global filters to show the top entry pages for your "success" page.
For full details, see Tracking Conversions
How can I see only the visitors that entered at a particular page, or only the visitors that hit a particular page at some point in their session?
Use the global filters to show only sessions containing that page; reports will only show sessions including that page.
For full details, see Sessions For A Particular Page
How can I see only the visitors that came from a particular search engine?
Direct that search engine to a particular entry page, and then use global filters to show only sessions for that page.
For full details, see Sessions For A Particular Search Engine
Why doesn't the number of visitors in the Overview match the number of session users in the "Sessions Overview" report?
Session information only shows users contributing page views, and other views show all visitors. Also, long sessions are discarded from the session information.
For full details, see Visitors vs. Session Users
How can I see just the most recent day/week/month of statistics?
Use the Date Picker, or -df filter on the command line.
For full details, see Recent Statistics
Can I export the data from Sawmill reports to Excel or other programs?
Yes; click the "export" link in the toolbar above reports to export the data from that report's table in CSV format. Many programs, including Excel, can import CSV format files.
For full details, see Exporting Data From Statistics
I've heard that statistics like visitors, "sessions," and "paths through the site" can't be computed accurately. Is that true? Are the statistics reported by Sawmill an accurate description of the actual traffic on my site?
Sawmill accurately reports the data as it appears in the log file. However, many factors skew the data in the log file. The statistics are still useful, and the skew can be minimized through server configuration.
For full details, see Are the Statistics Accurate?
How does Sawmill compute session information, like total sessions, repeat visitors, paths through the site, entry pages, exit pages, time spent per page, etc.?
Sawmill uses the visitor id field to identify unique visitors. It decides that a new session has begun if a visitor has been idle for 30 minutes.
For full details, see Session Computation
How do I change the field which is graphed, e.g. from page view to bandwidth?
Edit the profile .cfg file, and change the field name in the numerical_fields section of that report element.
For full details, see Changing the graph field
How can I tell where visitors went when they left the site?
Normally, you can't. However, you can set up "reflector" pages if you need this information.
For full details, see Tracking Exit URLs
How can I see all files that were hit on my web site, not just the pages?
Delete or disable the 'Strip non-page-views' log filter, and rebuild the database
For full details, see Showing All Files
Why do I see hits on a file called "robots.txt" in my statistics?
robots.txt is a file that tells search engine spiders and robots what they can do, so a hit on robots.txt means that a spider visited your site.
For full details, see robots.txt
Why do I see a hits on a file called "favicon.ico" in my statistics?
favicon.ico is a special icon file that Internet Explorer looks for when it first visits the site.
For full details, see favicon.ico
When I export CSV, durations appear as numbers, which Excel doesn't understand. How can I format durations to work with Excel?
Add an extra column to the spreadsheet to convert them to fractional days; or use a custom database field in the report element.
For full details, see Formatting Durations for Excel
When I'm saving a report for the first time but what about my filters?
If you have no filters active, then they will not be saved with your report.
For full details, see Saving filters during Save as New Report


When I run Sawmill, it tells me that the server is started (it shows me the URL), but when I try to access that URL, the browser says it's not available. How can I fix this?
You may be using a proxy server which prevents you from accessing a server running on your own machine. Try reconfiguring the proxy to allow it, or try running Sawmill on IP (the loopback interface).
For full details, see Can't Access the Server
On Windows 2003, I can't access the Sawmill server using Internet Explorer. Why not?
The "Internet Explorer Enhanced Security Configuration" may be enabled, blocking access; uninstall it or add to the trusted sites.
For full details, see Can't access server with Windows 2003 and IE
When I try to log in to Sawmill, I get to the Admin page, but the next thing I click takes me back to the login page. Why?
Your browser isn't storing the cookie Sawmill needs to maintain the login, or something is blocking the browser from sending the cookie. Make sure cookies are on in the browser, firewalls aren't blocking cookies, and don't use Safari 1.2.1 or earlier as your browser.
For full details, see Login Loops Back to Login
Why can't Sawmill see my mapped drive, share, directory, or mount points when I run it as a Windows Service?
The Service must run with the same privileged user account that has the mapped drive, share, directory, or mount point privilege.
For full details, see Can't See Network Drives with Sawmill as Service
Why can't Sawmill see my mapped drive, share, directory, or mount points when I run it under Windows 2003?
Windows 2003 has a strict security policy which prevents access to network drives from Sawmill. To make it work, you need to let "everyone" permissions apply to anonymous, and remove the restriction on anonymous access to named pipes and shares (in Administrative Tools).
For full details, see Can't See Network Drives in Windows 2003
I can't access Sawmill where I usually do (http://www.xxx.yyy.zzz:8988/) -- is your (Flowerfire's) server down?
No -- your server is down. Sawmill runs on your computer, not on ours -- contact your network administrator if you're having problems accessing it.
For full details, see Sawmill Server is Down
When I run Sawmill on Windows, I get an error: "A required DLL is missing: URLMON.DLL." What's going on?
Install the latest Internet Explorer, and the problem should go away.
For full details, see Missing DLL: URLMON.DLL
When I run Sawmill, I get an error: './sawmill: error while loading shared libraries: libstdc++.so.5: cannot open shared object file: No such file or directory'. What's going on?
Sawmill requires the libstdc++ library. This is available by default on many platforms, and is included in the Sawmill distribution on others (including Solaris)
For full details, see libstdc++ missing
When I try to run Sawmill, I get an error "relocation error: sawmill: undefined symbol: __dynamic_cast_2". How can I fix this?
This is a GNU library incompatibility; build Sawmill from source instead of using the binary distribution.
For full details, see Relocation error: __dynamic_cast_2
Sawmill only shows me the IP addresses of my visitors, even when I turn on DNS lookup. Why?
Your DNS server may not be responding, or may not know how to resolve those IPs.
For full details, see Problems With DNS Lookup
I run Sawmill in CGI mode, and all the images in the menus and the reports are missing or broken. Why?
You may have set the "temporary directory" incorrectly during installation. Try deleting the preferences.cfg file in LogAnalysisInfo, and access Sawmill to try again.
For full details, see No Images in CGI Mode
The statistics show the wrong years -- when I analyze data from previous years, it appears as this year, or data from this year appears in last year. Why?
Your log format does not include year information, so Sawmill has to guess the year. Use a different log format if possible (one which includes year information). See the long answer for a way of manually setting the year for blocks of log data.
For full details, see Years are wrong in the statistics
I've forgotten the password I chose for Sawmill when I first installed; how can I reset it?
As of version 8.0.2, there is a custom action reset_root_admin.
For full details, see Resetting the Administrative Password
When I run Sawmill as a CGI, it runs as a special user (nobody, web, apache, etc.). Then when I want to use Sawmill from the command line or in web server mode, the permissions don't allow it. What can I do about this?
Loosen the permissions in the Preferences, or run your CGI programs as a different user, or run your command line programs as the CGI user.
For full details, see CGI User Permissions
How much memory/disk space/time does Sawmill use?
It depends on how much detail you ask for in the database. It uses very little if you use the default detail levels.
For full details, see Resource Usage
When I add up the number of visitors on each day of the month, and I compare it to the total visitors for the month, they're not equal. Why not? Also, why doesn't the sum of visitors on subpages/subdirectories add up to the total for the directory, and why doesn't the sum of visitors on subdomains add up to the total for the domain, etc.? Why are there dashes (-) for the visitor totals?
Because "visitors" is the number of unique visitors, a visitor who visits every day will show up as a single visitor in each day's visitors count, but also as a single visitor for the whole month -- not 30 visitors! Therefore, simple summation of visitor numbers gives meaningless results.
For full details, see Visitor Totals Don't Add Up
When I look at my statistics, I see that some days are missing. I know I had traffic on those days. Why aren't they shown?
Your ISP may be regularly deleting or rotating your log data. Ask them to leave all your log data, or rotate it over a longer interval. It's also possible that your log data does not contain those days for another reason.
For full details, see Days Are Missing from the Log Data
My log data contains referrer information, but I don't see referrer reports, or search engines, or search phrases. Why not?
Sawmill includes referrer reports if the beginning of the log data includes referrers. If your log data starts without referrers, and adds it later, you won't see referrer reports. Create a new profile from the latest log file (with referrers), and change the log source to include all log data.
For full details, see Referrer Reports Missing
When I process log data with Sawmill, it uses most or all of my processor; it says it's using 90%, or even 100% of the CPU. Should it be doing that? Is that a problem?
Yes, it should do that, and it's not usually a problem. Any CPU-intensive program will do the same. However, you can throttle it back if you need to, using operating system priorities.
For full details, see Sawmill Uses Too High a Percentage of CPU
How do I build a database from the command line?
Run "executable -p profilename -a bd" from the command line window of your operating system.
For full details, see Building a Database from the Command Line
How can I track full URLs, or HTTP domains, or resolved hostnames, when analyzing PIX log data?
You can't track full URLs or HTTP domains, because PIX doesn't log them; but you can turn on DNS lookup in the PIX or in Sawmill to report resolved hostnames.
For full details, see Tracking URLs in Cisco PIX log format
How do I backup and restore my Sawmill installation, or a particular profile and its database?
Backup and restore the LogAnalysisInfo folder when no update or build is running, or for one profile. For MySQL also backup and restore the MySQL database.
For full details, see Backup and Restore
On Windows, I sometimes get "permission denied" errors, or "volume externally altered" errors, or "file does not exist" error when building a database. But sometimes, it works. What can cause this sort of sporadic file error?
An anti-virus or anti-malware software, which is actively scanning your Sawmill installation folder, can cause this. Disable scanning of Sawmill's data folders, in the anti-virus product.
For full details, see Permission Denied Errors
Will my plug-in work with version 8?
Most version 7 plug-ins will work with version 8.
For full details, see Using version 7 plug-ins
Why do my emailed reports from Outlook 2003 not line up, everything is out of alignment?
Change the settings in Outlook to not load automatically.
For full details, see Emailed Reports in Outlook 2003


Where did the name "Sawmill" come from?
A sawmill is a tool that processes logs, and so is Sawmill.
For full details, see The Name "Sawmill"
Why are new versions of Sawmill released so often? Is it buggy? Do I need to download every new version?
We ship new versions to provide our customers with the latest minor features and bug fixes quickly. Sawmill is no buggier than any other software, and you don't need to download a new release unless you're having problems with the current one.
For full details, see Frequent New Versions of Sawmill