{
    "mode": "man",
    "parameter": "qslog",
    "section": "1",
    "url": "https://www.chedong.com/phpMan.php/man/qslog/1/json",
    "generated": "2026-06-02T20:22:04Z",
    "synopsis": "qslog  -f  <formatstring>  -o <outfile> [-p[c|u[c]] [-v]] [-x [<num>]] [-u <name>] [-m] [-c\n<path>]",
    "sections": {
        "NAME": {
            "content": "qslog - collects request statistics from access log data.\n",
            "subsections": []
        },
        "SYNOPSIS": {
            "content": "qslog  -f  <formatstring>  -o <outfile> [-p[c|u[c]] [-v]] [-x [<num>]] [-u <name>] [-m] [-c\n<path>]\n",
            "subsections": []
        },
        "DESCRIPTION": {
            "content": "qslog is a real time access log analyzer. It collects the data  from  stdin.  The  output  is\nwritten to the specified file every minute and includes the following entries:\n- requests per second (r/s)\n- number of requests within measured time (req)\n- bytes sent to the client per second (b/s)\n- bytes received from the client per second (ib/s)\n- response status codes within the last minute (1xx,2xx,3xx,4xx,5xx)\n- average response duration (av)\n- average response duration in milliseconds (avms)\n-    distribution   of   response   durations   in   seconds   within   the   last   minute\n(<1s,1s,2s,3s,4s,5s,>5s)\n- distribution  of  response  durations  faster  than  a  second  within  the  last  minute\n(0-49ms,50-99ms,100-499ms,500-999ms)\n- number of established (new) connections within the measured time (esco)\n- average system load (sl)\n- free memory (m) (not available for all platforms)\n- number of client ip addresses seen withn the last 600 seconds (ip)\n- number of different users seen withn the last 600 seconds (usr)\n- number of events identified by the 'E' format character\n-  number of modqos events within the last minute (qV=create session, qv=VIP IP,qS=session\npass, qD=access denied, qK=connection closed, qT=dynamic keep-alive, qL=request/response slow\ndown, qs=serialized request,  qA=connection abort, qU=new user tracking cookie)\n",
            "subsections": []
        },
        "OPTIONS": {
            "content": "",
            "subsections": [
                {
                    "name": "-f <format_string>",
                    "content": "Defines the log data format and the positions of data elements processed by this util‐\nity. See to the 'LogFormat' directive of the httpd.conf file to see the format defini‐\ntions of the servers access log data.\nqslog knows the following elements:\nI defines the client ip address (%h)\nR defines the request line (%r)\nS defines HTTP response status code (%s)\nB defines the transferred bytes (%b or %O)\ni defines the received bytes (%I)\nD defines the request duration in microseconds (%D)\nt defines the request duration in milliseconds (may be used instead of D)\nT defines the request duration in seconds (may be used instead of D or t) (%T)\nk defines the number of keepalive requests on the connection (%k)\nU defines the user tracking id (%{modqosuserid}e)\nQ defines the modqosev event message (%{modqosev}e)\nC defines the element for the detailed log (-c option), e.g. \"%U\"\ns arbitrary counter to add up (sum within a minute)\na arbitrary counter to build an average from (average per request)\nA arbitrary counter to build an average from (average per request)\nM arbitrary counter to measure the maximum value reached (peak)\nE comma separated list of event strings\nc content type (%{content-type}o), available in -pc mode only\nm request method (GET/POST) (%m), available in -pc mode only\n. defines an element to ignore (unknown string)\n\n",
                    "flag": "-f",
                    "arg": "<format_string>"
                },
                {
                    "name": "-o <out_file>",
                    "content": "Specifies  the  file  to store the output to. stdout is used if this option is not de‐\nfined.\n\n-p     Used for post processing when reading the log data from a file  (cat/pipe).  qslog  is\nstarted using it's offline mode (extracting the time stamps from the log lines) in or‐\nder to process existing log files. The option \"-pc\" may be used alternatively  if  you\nwant  to  gather  request information per client (identified by IP address (I) or user\ntracking id (U) showing how many request each client has performed within the captured\nperiod  of time). \"-pc\" supports the format characters IURSBTtDkMEcm. The option \"-pu\"\ncollects statistics on a per URL level (supports format characters RSTtD).  \"-puc\"  is\nvery similar to \"-pu\" but cuts the end (handler) of each URL.\n\n-v     Verbose mode.\n\n-x [<num>]\nRotates the output file once a day (move). You may specify the number of rotated files\nto keep. Default are 14.\n",
                    "flag": "-o",
                    "arg": "<out_file>"
                },
                {
                    "name": "-u <name>",
                    "content": "Becomes another user, e.g. www-data.\n\n-m     Calculates free system memory every minute.\n",
                    "flag": "-u",
                    "arg": "<name>"
                },
                {
                    "name": "-c <path>",
                    "content": "Enables the collection of log statitics for different request types. 'path'  specifies\nthe necessary rule file. Each rule consists of a rule identifier and a regular expres‐\nsion to identify a request seprarated by a colon, e.g., 01:^(/a)|(/c). The regular ex‐\npressions  are  matched  against the log data element which has been identified by the\n'C' format character.\n",
                    "flag": "-c",
                    "arg": "<path>"
                }
            ]
        },
        "VARIABLES": {
            "content": "The following environment variables are known to qslog:\n\nQSEVENTPATH=<path>\nDefines a file containing a comma or new line separated list of  known  event  strings\nexpected within the log filed identified by the 'E' format character.\n\nQSCOUNTERPATH=<path>\nDefines a file containing a by new line separated list of rules which reflect possible\nQSClientEventLimitCount directive settings (for simulation purpose / -pc option). The\n'E' format character defines the event string in the log to match (literal string) the\n'event1' and 'event2' event names against.\n\nRule syntax: <name>:<event1>-<n>*<event2>/<duration>=<limit>\n'name' defines the name you have given to the rule entry and is logged along with\nwith the number of times the 'limit' has been reached within the 'duration'.\n'event1' defines the variable name (if found in 'E') to increment the counter.\n'event2'  defines  the  variable  name (if found in 'E') to decrement the counter\n(and the parameter 'n' defines by how much).\n'duration' defines the measure interval  (in  seconds)  used  for  the  QSClien‐\ntEventLimitCount directive.\n'limit'  defines  the threshold (number) defined for the QSClientEventLimitCount\ndirective.\n\nNote: If the 'name' parameter is prefixed by 'STATUS', the rule is applied against the\nHTTP  status  code 'S' and the 'event1' string shall contain a list of relevant status\ncodes separated by an underscore (while 'event2' is ignored).\n",
            "subsections": []
        },
        "EXAMPLE": {
            "content": "Configuration using pipped logging:\n\nCustomLog  \"|/usr/bin/qslog  -f  ISBDQ  -x  -o  /var/log/apache/stat.csv\"  \"%h  %>s  %b  %D\n%{modqosev}e\"\n\nPost processing:\n\nLogFormat \"%t %h \\\"%r\\\" %>s %b \\\"%{User-Agent}i\\\" %T\"\ncat access.log | qslog -f ..IRSB.T -o stat.csv -p\n\n",
            "subsections": []
        },
        "SEE ALSO": {
            "content": "qsdt(1),  qsexec(1),  qsfilter2(1),  qsgeo(1),  qsgrep(1),  qshead(1), qslogger(1), qspng(1),\nqsre(1), qsrespeed(1), qsrotate(1), qssign(1), qstail(1)\n",
            "subsections": []
        },
        "AUTHOR": {
            "content": "Pascal Buchbinder, http://mod-qos.sourceforge.net/\n\n\n\nmodqos utilities 11.63                       May 2019                                      QSLOG(1)",
            "subsections": []
        }
    },
    "summary": "qslog - collects request statistics from access log data.",
    "flags": [
        {
            "flag": "-f",
            "long": null,
            "arg": "<format_string>",
            "description": "Defines the log data format and the positions of data elements processed by this util‐ ity. See to the 'LogFormat' directive of the httpd.conf file to see the format defini‐ tions of the servers access log data. qslog knows the following elements: I defines the client ip address (%h) R defines the request line (%r) S defines HTTP response status code (%s) B defines the transferred bytes (%b or %O) i defines the received bytes (%I) D defines the request duration in microseconds (%D) t defines the request duration in milliseconds (may be used instead of D) T defines the request duration in seconds (may be used instead of D or t) (%T) k defines the number of keepalive requests on the connection (%k) U defines the user tracking id (%{modqosuserid}e) Q defines the modqosev event message (%{modqosev}e) C defines the element for the detailed log (-c option), e.g. \"%U\" s arbitrary counter to add up (sum within a minute) a arbitrary counter to build an average from (average per request) A arbitrary counter to build an average from (average per request) M arbitrary counter to measure the maximum value reached (peak) E comma separated list of event strings c content type (%{content-type}o), available in -pc mode only m request method (GET/POST) (%m), available in -pc mode only . defines an element to ignore (unknown string)"
        },
        {
            "flag": "-o",
            "long": null,
            "arg": "<out_file>",
            "description": "Specifies the file to store the output to. stdout is used if this option is not de‐ fined. -p Used for post processing when reading the log data from a file (cat/pipe). qslog is started using it's offline mode (extracting the time stamps from the log lines) in or‐ der to process existing log files. The option \"-pc\" may be used alternatively if you want to gather request information per client (identified by IP address (I) or user tracking id (U) showing how many request each client has performed within the captured period of time). \"-pc\" supports the format characters IURSBTtDkMEcm. The option \"-pu\" collects statistics on a per URL level (supports format characters RSTtD). \"-puc\" is very similar to \"-pu\" but cuts the end (handler) of each URL. -v Verbose mode. -x [<num>] Rotates the output file once a day (move). You may specify the number of rotated files to keep. Default are 14."
        },
        {
            "flag": "-u",
            "long": null,
            "arg": "<name>",
            "description": "Becomes another user, e.g. www-data. -m Calculates free system memory every minute."
        },
        {
            "flag": "-c",
            "long": null,
            "arg": "<path>",
            "description": "Enables the collection of log statitics for different request types. 'path' specifies the necessary rule file. Each rule consists of a rule identifier and a regular expres‐ sion to identify a request seprarated by a colon, e.g., 01:^(/a)|(/c). The regular ex‐ pressions are matched against the log data element which has been identified by the 'C' format character."
        }
    ],
    "examples": [
        "Configuration using pipped logging:",
        "CustomLog  \"|/usr/bin/qslog  -f  ISBDQ  -x  -o  /var/log/apache/stat.csv\"  \"%h  %>s  %b  %D",
        "%{modqosev}e\"",
        "Post processing:",
        "LogFormat \"%t %h \\\"%r\\\" %>s %b \\\"%{User-Agent}i\\\" %T\"",
        "cat access.log | qslog -f ..IRSB.T -o stat.csv -p"
    ],
    "see_also": [
        {
            "name": "qsdt",
            "section": "1",
            "url": "https://www.chedong.com/phpMan.php/man/qsdt/1/json"
        },
        {
            "name": "qsexec",
            "section": "1",
            "url": "https://www.chedong.com/phpMan.php/man/qsexec/1/json"
        },
        {
            "name": "qsfilter2",
            "section": "1",
            "url": "https://www.chedong.com/phpMan.php/man/qsfilter2/1/json"
        },
        {
            "name": "qsgeo",
            "section": "1",
            "url": "https://www.chedong.com/phpMan.php/man/qsgeo/1/json"
        },
        {
            "name": "qsgrep",
            "section": "1",
            "url": "https://www.chedong.com/phpMan.php/man/qsgrep/1/json"
        },
        {
            "name": "qshead",
            "section": "1",
            "url": "https://www.chedong.com/phpMan.php/man/qshead/1/json"
        },
        {
            "name": "qslogger",
            "section": "1",
            "url": "https://www.chedong.com/phpMan.php/man/qslogger/1/json"
        },
        {
            "name": "qspng",
            "section": "1",
            "url": "https://www.chedong.com/phpMan.php/man/qspng/1/json"
        },
        {
            "name": "qsre",
            "section": "1",
            "url": "https://www.chedong.com/phpMan.php/man/qsre/1/json"
        },
        {
            "name": "qsrespeed",
            "section": "1",
            "url": "https://www.chedong.com/phpMan.php/man/qsrespeed/1/json"
        },
        {
            "name": "qsrotate",
            "section": "1",
            "url": "https://www.chedong.com/phpMan.php/man/qsrotate/1/json"
        },
        {
            "name": "qssign",
            "section": "1",
            "url": "https://www.chedong.com/phpMan.php/man/qssign/1/json"
        },
        {
            "name": "qstail",
            "section": "1",
            "url": "https://www.chedong.com/phpMan.php/man/qstail/1/json"
        }
    ]
}