Tping
Visitors / web log analysis

Read traffic as a story in data.

Visitors is a command-line web server log analyzer. This reference explains its report types, command options, filters, examples, and continuous stream workflow for controlled operational analysis.

Read the guideExplore downloads
log-lab — report 01
$ visitors -A -m 30 access.log \
  --output html > report.html

[parse ] access.log
[map  ] requests / referers / agents
[build] traffic report
[write] report.html

status analysis complete
scope: local log files

Reference guide

From raw lines to useful reports.

Visitors turns access logs into structured summaries of requests, visitors, navigation, clients, errors, and timing. Use the options below as a map of the original command-line interface.

Name

visitors — a fast web server log analyzer.

Synopsis

visitors [options] <filename> [filename ...]

Description

Visitors generates access statistics from one or more web log files. Apache-style logs work directly when the date is enclosed in square brackets, the client hostname is the first entry, and referers and requests are enclosed in double quotes.

The analyzer can also process standard input by using - as the filename. IIS logs can be prepared with a compatible conversion step before analysis.

Reports can include:

  • Requested pages and images
  • Referers, unique visitors, and page views per visit
  • Crawler activity and search phrases
  • User agents, operating systems, browsers, domains, and screen information
  • Weekday, hour, and month traffic maps
  • Navigation trails and Graphviz path data
  • Missing-document reports for HTTP 404 responses

Available options

-A, --all
Enable the optional reports covered by the standard all-reports preset.
-T, --trails
Show frequent movements between pages. This requires one or more --prefix values.
-G, --google
Report pages accessed by major search crawlers and their latest recorded access.
-K, --google-keyphrases
Show search phrases associated with visits from search results.
-H, --google-human-language
Summarize language hints found in search referral data.
-U, --user-agents
Report common client and crawler user-agent strings.
-W, --weekday-hour-map
Generate a 7-day by 24-hour traffic map for timing analysis.
-M, --month-day-map
Generate a month/day traffic map for seasonal comparison.
-R, --referers-age
Order referers by when they first appeared in the data.
-D, --domains
Summarize top-level domains and unresolved hosts.
-O, --operating-systems
Report operating-system popularity from recognized user agents.
-B, --browsers
Group recognized browsers by family.
-X, --error404
List missing documents ordered by request count.
-Y, --pageviews
Estimate the distribution of pages viewed during each visit.
-S, --robots
Summarize clients requesting the robots.txt resource.
--screen-info
Enable screen-resolution and color-depth reports when the required page data exists.
--stream
Continuously process incoming log data and refresh a report.
--update-every seconds
Set the refresh period for stream mode.
--reset-every seconds
Reset accumulated statistics after a defined interval.
-f, --output-file file
Write the generated report to a file instead of standard output.
-m, --max-lines number
Set a shared maximum number of entries across reports.
-P, --prefix value
Identify internal links for trails and referral classification.
-o, --output html|text
Select HTML or text output.
-V, --graphviz
Produce Graphviz-compatible navigation data from access patterns.
--tail
Monitor changing log files and emit newly appended records.
--time-delta delta
Shift report times to account for a difference between log and reader time.
--filter-spam
Filter referral entries using the configured keyword rules.
--ignore-404
Keep 404 lines for the error report while excluding them from other reports.
--grep pattern
Process only lines matching a shell-style pattern.
--exclude pattern
Process lines that do not match the supplied pattern.
--debug
Print additional diagnostics for invalid lines and processing errors.
-h, --help
Show usage information.
-v, --version
Show the program version.

Examples

For a quick text report from an access log:

visitors access.log | less

To generate a broader HTML report:

visitors -A -m 30 access.log -o html > report.html

To examine internal navigation patterns, define the site prefix and enable trails:

visitors -A -m 30 access.log --trails --prefix https://example.invalid > report.html

Multiple files and standard input are supported:

visitors /var/log/web/access.log.*
zcat access.log.*.gz | visitors -

Stream mode

Stream mode reads log records continuously from standard input and updates a report at a chosen interval. Because the report is rewritten, use --output-file.

tail -f /var/log/web/access.log | visitors --stream -A --update-every 60 \
  --output-file /tmp/report.html

A reset interval can provide a rolling view of recent traffic:

tail -f /var/log/web/access.log | visitors --stream -A \
  --update-every 30 --reset-every 3600 \
  --output-file /tmp/report.html
Operational noteAnalyze logs you are authorized to access. Remove credentials, private query data, and other sensitive values before sharing reports or command output.

Copying and maintenance

This page preserves the command concepts and report categories of the Visitors documentation while presenting them as a compact technical reference. Archived options may behave differently on modern systems, so validate commands in a controlled environment before operational use.

Practical workflow

Measure carefully. Interpret clearly.

Log analysis is most useful when collection, filtering, and reporting choices are explicit.

01 / Prepare
Confirm the log format, time zone, retention period, and permitted data scope.
02 / Select
Choose only the reports that answer the operational question you are investigating.
03 / Compare
Review periods and segments consistently rather than treating one count as a complete explanation.
04 / Protect
Keep raw logs and generated reports within the approved storage and access boundary.

Improve the documentation.

Send corrections or compatibility observations without including private log lines or confidential site data.

Contact Tping