ip_analyser

Upload Apache access logs and see request counts by IP address, browser or bot, page path, and date. ip-analyser provides private reports directly in Drupal. -->

ip-analyser helps site administrators understand traffic recorded in Apache access logs. Upload a log file to see which IP addresses, browsers or bots, and page paths appear most often, along with request counts by date.

An access log is a text file your web server creates to record incoming requests. This module turns those records into readable tables inside Drupal, without sending them to an external analytics service.

Features

• View request counts by client IP address, full user agent, request path, and date.
• Analyze Apache combined access logs, including logs with Acquia trailing metadata.
• Support IPv4 and IPv6 addresses.
• Group requests by path without query strings.
• Upload uncompressed .log or .txt files up to 256 MiB, subject to hosting limits.
• Process files in batches and display paginated results with request totals and percentages.
• Count malformed or oversized lines that were skipped.
• Keep reports accessible only to the user who uploaded the file and block direct downloads of raw logs.
• Expire reports after 24 hours and remove expired reports and uploads through Drupal cron.

Use ip-analyser to investigate unusually high traffic, identify frequently requested paths, or review requests from particular IP addresses and user agents. It analyzes existing log files; it does not collect visitor activity or provide real-time monitoring.

Post-Installation

1. Enable the module through Drupal’s Extend page or with drush en ip_analyser -y.
2. Ask your site administrator to configure Drupal’s private file storage outside the public web root.
3. Go to People → Permissions and grant “Upload and analyze Apache access logs” only to trusted authenticated roles.
4. Go to Reports → Apache access log analyzer, or visit /admin/reports/apache-access.
5. Upload a supported log file and select “Analyze log.” After processing, choose Client IPs, User agents, Paths, or Dates to explore the results.

Ensure Drupal cron runs regularly so expired uploads and reports are removed. Reports become unavailable 24 hours after creation; physical deletion happens when cron processes them.

The module does not create a content type or require changes to text formats. Dates use the timezone recorded in each log entry. Client IPs come from the first field in the log; forwarded-for metadata is not used as the client identity.

Additional Requirements

• Drupal 11.
• PHP 8.3 or newer with the mbstring extension.
• Drupal core’s File module.
• Configured private file storage and regular cron execution.
• Apache combined access logs in uncompressed .log or .txt format.
• Sufficient database and file storage for uploaded logs and aggregated results.

For uploads approaching 256 MiB, your hosting environment must allow the request size. Recommended PHP settings are upload_max_filesize=256M and post_max_size=272M or higher, with a compatible reverse proxy limit.

No external API, analytics account, or Acquia subscription is required.

Recommended modules/libraries

No additional contributed modules or libraries are needed. A configured logging backend, such as Drupal core’s Syslog module, can help administrators investigate processing failures.

Similar projects

ip-analyser focuses on manually uploaded web-server logs. It is useful when you already have Apache logs and want to inspect request counts within Drupal. It does not offer the visitor journeys, dashboards, or continuous tracking commonly provided by broader analytics tools.

Supporting this Module

Help improve the module by reporting reproducible bugs, suggesting improvements, testing releases, and contributing documentation or code through the project’s issue queue.

Community Documentation

The README.md included with the module explains installation, supported log formats, upload limits, permissions, and retention.

Limitations and privacy considerations

Compressed files, JSON logs, and Apache common logs without referrer and user-agent fields are not supported. Reports aggregate the entire uploaded file; filtering and CSV export are not currently available.

Access logs can contain sensitive information. Restrict upload permission to trusted users. The module has no per-user storage quota, and site backup retention is managed separately from the module’s 24-hour report expiry.