hi, >Not only will it not report the size of the http headers, but it won't report >the TCP and IP frame information and any ICMP messages that may be required. > >What is the problem with automatically sucking the sizes out of webalizer >files and reporting them in some other format?
the answer ist simple: Paranoia. :) Webalizer crashed several times and we lost all statistics (didn't keept the lof-files so long). And i dont't like to mess around in HTML-Code that isn't written by me. nat-acct gives me simple textfiles and i can fiddle around with them with perl, shell-skript or s.th. else. (Now i keept them for three month an rotate them daily with logrotate :) I wrote a little perlskript that summarize them daily and put the sums in an mysql database, so i got daily stats for other protocols (ftp,mail,...) too. Back to questioning: recently i did some calculation and find out that webalizer results are about about 85% of the net-acct results. Ist that an realistic overhead form http-headers, ICMP (on or to port 80?), and TCP/IP frame info, etc.? PS: we pay for the traffic "on the cable" and webalizer only gets the "pay-load" from http.