SurfStats Help Desk

Home | Knowledgebase | Ask Question | My Info | Browser Toolbar


  • SurfStatsLive User Types
  • Profile Group
  • Account Details Location
  • Bypass SurfStatsLive login screen
  • Web Browser Administration
  • Profile Group Import
  • SurfStatsLive and ZIP files
  • SurfStatsLive and Javascript
  • Can SurfStatsLive hang my web server?
  • Report per sub-directory
  • SurfStatsLive Reporting Language
  • SurfStatsLive Machine ID
  • Upgrading SurfStatsLive
  • SurfStatsLive Permissions
  • Glossary of Terms
  • Report Accuracy
  • Hints and Tips
  • Referrer Information
  • Demo Title
  • New in SurfStats Log Analyzer
  • New in SurfStatsLive
  • Print All Reports
  • Create more 20 entries on reports
  • Record lock was unsuccessful
  • SurfStatsLive Overviews not showing
  • Removing Robots Traffic from SurfStats
  • Default page in reports
  • Page Title Lookup Loop
  • Upgrading SurfStatsLive
  • PPC (pay per click) campaigns - Google and Overture
  • Specifying reporting period on a schedule
  • Scenario Analysis
  • Administering SurfStatsLive from the command line
  • Service does not start if I change Merging Service user account
  • Empty reports with SurfStats Log Analyzer and SurfStatsLive on Win 2003 SP1 and Win XP SP2
  • Visitor Origin Database
  • SurfStatsLive appears to hang when user logs in
  • RecordIndex out of range error.
  • surfstats could not determine the format of your log files
  • Error with using .zip files in Windows 2003 and Windows XP
  • Generating reports manually works but scheduling reports does not work
  • Login page hangs
  • bandwidth not shown in reports
  • Empty or blank reports when using FTP (AutoFTP retrieval method on profile)
  • Moving a SurfStatsLive installation and/or data
  • Page Title Lookups in SurfStatsLive 3100
  • Problemming accessing SurfStatsLive installaion on Windows 2003
  • COM+ username not accepted during installation
  • MergeServer not updating database
  • Vista Compatability
  • Installing SurfStats or SurfStatsLive on Windows Vista
  • Apache Log File Rotation
  • SurfStatsLive Visitor info button error - Windows 2003 64-bit
  • Most Downloaded Files
  • COM Surrogate Encountered a Problem and must close
  • HTTP 500 error on install

    Question: SurfStatsLive User Types
    What types of users are there in SurfStatsLive?

    Server Administrators, Profile Administrators and SurfStatsLive Users (also called end-users).

    Server Administrators administers the SurfStatsLive installation, assigns users the right to be Profile Administrators, reset profiles etc. The membership of a user to a group (specified in the Global Setup application) in the Windows user database determines whether a user is classified as a Server Administrator or not. The username and password of a Server Administrator can be validated by the Windows user database or by SurfStatsLive itself depending on the set up in the SurfStatsLive Global Setup Application.

    Profile Administrators administers site profiles for one or more virtual servers. The Profile Administrator user type was introduced to handle the situation of sub-hosting. Sub-hosting is where a customer of a site host sub-sells parts of a virtual web server to other customers. Server Administrators can also administer profiles so in the case of a host that do not allow sub-hosting there is no need actually to have Profile Administrators. The username and password of a Profile Administrator is validated by SurfStatsLive itself.

    SurfStatsLive Users or end-users have access to request and view reports. A SurfStatsLive User is a user that logs in with a site profile name and password to view reports. A SurfStatsLive user is synonymous with a site profile.

     Top Next

    Question: Profile Group
    What is a Profile Group?


    A Profile Group normally corresponds to a virtual web server or to a logical grouping of virtual web servers from different servers (for instance a collection of load balanced servers). These groups are stored by SurfStatsLive in its own database. Profile Administrators administers the site profiles in a profile group.

    Previous Top Next

    Question: Account Details Location
    Where are Server Administrator user accounts  and SurfStatsLive user information stored?


    Server Administrator user accounts Depending on the Authentication setup in the Global Setup application they are either stored on the local Windows user database, on a Windows 2000 domain or by SurfStatsLive itself. Note that you cannot create user accounts for Server Administrators from within SurfStatsLive, except when you use SurfStatsLive authentication which only allows one username.

    SurfStatsLive user information Site profiles (which is synonymous with SurfStatsLive users) are stored by SurfStatsLive in its own database.

    Previous Top Next

    Question: Bypass SurfStatsLive login screen
    Can I bypass the SurfStatsLive login screen for instance from site hosting automation software?


    Yes, you can by posting a form to the page called verifyUser.asp on the website SurfStatsLive is running on. See below for more detail and sample code.

    SurfStatsLive Automatic Login Sample

    You can bypass the SurfStatsLive login screen by posting a form to a page called verifyUser.asp on the website that SurfStatsLive is running on. verifyUser.asp will do the necessary validation of the username, password and user type and log the user into SurfStatsLive and show the relevant user interface, based on the user type.

    Three input fields must be present on the form performing the HTTP post: UserName, Password and selLoginType. selLoginType should be set to SurfStatsLiveUser, ProfileAdministrator or ServerAdministrator.

    When clicking the text Log me in automatically, the following sample HTML code in a web page will post the necessary fields to verifyUser.asp and automatically log the user johnny, with password foo into the SurfStatsLive service running on a server called as a profile administrator.
    <SCRIPT language=JavaScript>
    function autoLogin()
    <a href="JavaScript:autoLogin()">Log me automatically in</a>
    <form name=myForm method=post action="">
    <input type=hidden id=UserName name=UserName value=johnny></input>
    <input type=hidden id=Password name=Password value=foo></input>
    <input type=hidden id=selLoginType name=selLoginType value=ProfileAdministrator></input>

    Please note: SurfStatsLive unfortunately does not support the administration of profile groups and profiles and server options from third-party web pages or script files.

    Previous Top Next

    Question: Web Browser Administration
    Can all administration tasks be performed with a web browser?

    Solution: Nearly all tasks, except for setting up the virtual web server to be used by SurfStatsLive, setting up the authentication provider and stopping and starting the SurfStatsLive Merging Service. Remote control software (like Terminal Services, PCAnywhere etc.) can be used for this task.
    Previous Top Next

    Question: Profile Group Import
    I need to create a lot of Profile Groups, can I import them in some way?


    Yes, you can make use of the Administrative Script features in Server Administration. Also useful for SurfStatsLive upgrades.

    The script file has to be run from within SurfStatsLive Server Administration if you created a script file. You cannot run the script file from a DOS command line or by using the Windows Script Host.

    Previous Top Next

    Question: SurfStatsLive and ZIP files
    Can SurfStatsLive process compressed files?


    No it cannot. The problem is that unlike SurfStats Log Analyzer, SurfStatsLive keeps a record of each log file it processes and the last position in the log file. To process a zip file it would need to unzip the file first, check which files have changed and process the changed files, which gets tricky. You can set up SurfStatsLive to automatically move files after processing to a backup directory, where you can zip them.

    Previous Top Next

    Question: SurfStatsLive and Javascript
    Do I require JavaScript in my web pages to use SurfStatsLive?

    Solution: If the log files for the web server(s) is accessible on the same server or other servers on the network you don't. If the SurfStatsLive Server does not have access to the log files you can set up SurfStatsLive as Statistics Bureau to accept hits from browser clients generated by JavaScript.
    Previous Top Next

    Question: Can SurfStatsLive hang my web server?
    Can SurfStatsLive hang my web server?


    Nothing is impossible, but it is improbable that this application will hang your server. SurfStatsLive was designed to run on a web server and was rigorously tested by SurfStats and various web hosting companies. The following features improves reliability and performance:

  • Report generation is done through use of Component Services, an out-of-process with the IIS Processes.
  • The SurfStatsLive Merging application on the server is shutdown and restarted automatically from time-to-time to avoid memory problems.
  • In case of corruption of a site profile database a Server Administrator can reset the site profile to recreate the profile database from the existing log files.
  • Already processed log files can automatically be moved to a backup directory.
  • To further improve reliability, SurfStatsLive can be installed on a separate physical server (called the Multi Server Configuration) to provide statistics reports for virtual web servers residing on other servers (and operating systems).

  • Previous Top Next

    Question: Report per sub-directory
    Can SurfStatsLive generate reports per sub-directory?

    Solution: Yes it can. Just set up an Include File filter when creating or editing the site profile in server administration or profile administration.
    Previous Top Next

    Question: SurfStatsLive Reporting Language
    Can SurfStatsLive generate reports in different languages?


    Yes it can. When you log in as a SurfStatsLive user you can select the language from the Options tab.

    Unfortunately it is not feasible for us to provide language translations for every language and we have therefore provided an language editor so you can add or modify the report phrases in yur required language.

    Previous Top Next

    Question: SurfStatsLive Machine ID
    What is the machine code of the SurfStatsLive Server?


    SurfStatsLive is licensed per computer or machine. Every SurfStatsLive Server has a unique 8-character machine code, which is calculated by the program based on the characteristics of the server.

    When you purchase SurfStatsLive you need to provide the machine code. We use this to generate the activation code for the specific server.  Activating the program with the activation code will remove the expiry restriction and convert the trial edition to the edition you have purchased. 

    To find the Machine ID and to request an activation code for your computer, please do the following:

    1. Please ensure you have the latest trial version installed. It is available from our site at 

    2. Log in as a Server Administration and click Obtain Activation Codes from the Options tab. Connect to the Internet, fill in the details on the form and click to submit. You can also email us this 8 character Machine ID.

    Just unregister and remove the software and then request another activation code for the new machine if your Machine ID changes due to a hard disk crash, moving the software to another machine, etc.

    Previous Top Next

    Question: Upgrading SurfStatsLive
    I would like to upgrade to the new version. What do I have to do?


    We provide free updates and email support for one year after purchase. If you have purchased SurfStatsLive within the last 12 months, you can just request a new activation code for your machine. If you have purchased SurfStatsLive more than 12 months ago, you can request an upgrading price from

    Upgrading to a new version

    A data-migration facility is not so easy for this type of product. The program uses a complex interlinked relational database structure and the database structure changes between every sub-build e.g. 2.X (2.7, 2.8, etc.). The database structure changes to hold more information due to changes in log file formats and additional information required for new reports like e-commerce, conversion tracking, click-fraud and bounce rate reports. This makes it a nightmare, bug-ridden experience to convert an older log analysis database to a new database and to produce reports from a database that does not have the correct or required data. We are not the only website statistics development company with this dilemma and we do not know of any database-based log analysis program that provides easy and successful migration from an old log file database.

    The best solution we have come up with yet is to modify the program so that a newer sub-build version is installed in a new different sub-directory and can run independently from the other.

    As from version 2, site profiles can be backed up and restored. Version 2.8 and later can also backup and restore other settings.

    Option 1 – New installation

    If you have a dedicated statistics server, the best solution is probably to set up a new, clean, machine and let it scan the log files, then rename it and move the old IP address to it. 

    Option 2 – Parallel installation and removal of old version

    Install the new version and let it parse the log files. Your users can use the old version to view their stats while the new version is parsing the log files. Once you and your users are satisfied with the correct functioning of the new version, you can stop and remove the old version. The problem with this method is that it requires re-parsing of the log files.

    Option 3 – Serial installation with cut-off date

    You select a cut-off date when a new sub-build is installed. Stop the merge service on the older version on this date and let the new merge server parse from this date by removing the log files prior to the cut-off date from the directory. Provide your users with the log in details for the reports prior to the cut-off date and separate log in details for after the cut-off date.

    Previous Top Next

    Question: SurfStatsLive Permissions

    I get and error when trying to create a new virtual web server

     "Error creating virtual web server: permission denied (70)".


    You are most likely not logged in as a user with administrative rights.

    You would also need to set the identity for the COM+ package on the "Identities" tab in the SurfStatsLive Global Setup Application. The account specified there is the account that must have the necessary rights. You may also want to give that account the right to log in as a batch job (Control Panel - Admin Tools - Local Security Policy).

    Previous Top Next

    Question: Glossary of Terms

    Where can I find out what visitors, unique visitors, pages, hits, etc. mean?


    Absolute URL - The full Internet address of a page or other World Wide Web resource. The absolute URL includes a protocol, such as "http," network location, and optional path and file name. For example, is an absolute URL. See also URL.

    Active Server Page (ASP) - A document with a .ASP extension that contains embedded server-side scripting. ASP-compatible Web servers can execute these scripts. On the client side, an ASP is a standard HTML document that can be viewed on any platform using any Web browser.

    Ad - A text, graphic or banner advertisement on a web page that takes the visitor to another site when clicked on.

    Ad Click - A mouse click on an advertisement on a web site, which takes the visitor to another site.

    Authentication - The verification of a user by matching a username and password in a multi-user or network environment. A user's name and password are compared against an authorized list, and, if the system detects a match, access is granted to the extent specified in the permission list for that user.

    Bandwidth - The measure of the traffic (in kilobytes of data) transmitted from the web site.

    Bookmark - Also referred to as an anchor. This is a named location on a Web page that can be the target of a hyperlink. A bookmark can be applied to a string of characters or exist on a page separately from any text. Bookmarks allow authors to link to a specific section of a target page. A bookmark is preceded by the hash sign (#) in an URL,.

    Browser - The program used to locate and view HTML documents.

    Cache – An area that stores text and image files from a web site already viewed. When returning to the web page again, the browser loads the files from the cache, thus saving time.

    CGI (Common Gateway Interface) - A standard method of extending Web server functionality by executing programs or scripts on a Web server in response to Web browser requests. A common use of CGI is in form processing, where the Web browser sends form data to a CGI script on the server, the script integrates the data with a database, and sends back the results as a Web page. Use of CGI can make a Web page much more dynamic and add interactivity for the user.

    Client (visitor or user) - A computer that accesses shared network resources provided by another computer on a local area network or the Internet. A unique IP address or URL identifies this visitor.

    Client Session or visit - A client session or visit is started when a request for a file (of any type) was made from a unique IP Address. If no more file requests were made in the cut-off or idle time, the program assumes that the visit was terminated. If a file quest is then made after the cut-off time from the same IP Address, a new visit is counted. The program's default cut-off time is thirty minutes.

    Client or visit tracking

    There are three commonly used methods to track visitors.

    1.      The most accurate way to track unique visitors is by forcing them to log on every time they visit your site. This way the authenticated name is used to track a client's activity on the site.

    2.      Using cookies can improve the accuracy of tracking unique visitors. The cookie (saved on the client's pc) is used to differentiate between visitors that used the same IP Address.

    3.      Tracking file requests from IP Addresses. Determining the uniqueness of a visitor by tracking their IP address is not always accurate because most ISP’s use dynamic IP Address allocation. The following illustrates this:

    ·        A visit can be incorrectly counted as a new visit. The same user can have a different IP Address if the session was terminated and he logged on again. The program will count this visit as a new visit.

    ·        A visit can be incorrectly continued. If the IP Address was allocated to another user, which logs on to your site within the cut-off time, he will be seen as the previous visitor.

    ·        Some ISPs provides the same client with different IP Addresses during a logon session. This can increase the number of unique visitors significantly.

    Client error codes - Status Error Codes in the 4XX range indicating the type of errors that occurred during a file/page request. Also refer to the Status Codes.

    Cookies - Files containing information about visits to a web site (e.g., user name and preferences). The user’s browser provides this information during the visit to a Web server. The server informs the browser to store some of this information (and perhaps other) on the client machine in a cookie file. When the visitor accesses the same web site again, the cookie is automatically presented to the server by the browser and the server can then configure it based on the information provided or react upon the information in the cookie.

    Country Internet Codes - Top Level Domains or ISO Internet Codes are the suffix added to a domain name, e.g. You can find the latest list at

    Database - A file containing records of information that are organized and presented to  serve a specific purpose, such as the facilitation of searching, sorting, and recombination of data. Databases can be published on the World Wide Web to let site visitors look up information in records or add new information to the database.

    Directory - World Wide Web pages consist of varying files. These files are often set up in a directory structure, resembling "tree branches". Directories are usually structured to keep similar topics within a specifically named directory.

    Domain Name - The text name corresponding to the numeric IP address of a computer or domain on the Internet.

    Domain Name Lookup - Also called DNS lookup or IP Resolving. This is the process of converting a numeric IP address into a domain name or URL.

    Domain Name Suffix - The last digits of a domain name can be used to identify the country or type of organization. Possible suffixes for the organization type includes:

    .com = Commercial
    .edu = Educational
    .int = International
    .gov = Government
    .mil = Military
    .net = Network
    .org = Organization 
    .xx = where the xx is a two digit country code, e.g. .uk for United Kingdom

    Download Manager – A program that is used to download large files from a host computer. This type of program can usually resume the download process after an aborted file transfer thus reducing bandwidth requirements. There are various download managers available like GetRight, Gozilla, ReGet, BullitproofFTP, NetVampire, etc.

    Entry pages - This is the first requested page from a client or how the client enters your site. If the client entered your site from a search engine, this would be the file name part of the URL submitted to the search engine. The server looks for the default page that can be any of the following in the order:


    The first page that it finds will be displayed and if none of these files are found, it will display the list of files in the directory.

    Exit pages - This is the last page your client has requested.

    External hyperlink - A hyperlink pointing to a page or file that is outside of the current web, i.e. not on the current server.

    Favicon.ico - An icon file that is placed on a visitor's links to a book-marked site (only in Internet Explorer 5 or later). Hits to this file can be an indication of how many visitors bookmarks your site. Also see how to generate one.

    Filters - A means of narrowing the scope of a report by specifying ranges or types of data to included or excluded.

    Firewall - A method of protecting the files and programs on one network from users on another network. A firewall blocks unwanted access to a protected network, while giving the protected network access to networks outside of the firewall. A company will typically install a firewall to give users access to the Internet while protecting their internal information

    Forms - An HTML page, which passes variables back to the server. These pages are used to gather information from users.

    Folder - A named storage area on a computer containing files and other folders.

    Frame - An area of a Web browser window defined by a frames page. A frame appears in a Web browser as one of a number of different areas in which pages can be displayed. A frame may be scrollable and resizable, and may have a border. You display a page in a frame by creating a hyperlink to the page and specifying the frame as part of the hyperlink.

    Frames page - A page that divides a Web browser's window into different areas called frames that can independently display several Web pages.

    FTP - File Transfer Protocol is a standard method of transferring files between computers over the Internet. You can do so with a FTP client program.

    GIF - Graphics Interchange Format is a raster based image file format commonly used in HTML documents. The PNG format is slowly replacing this format as the GIF format is a proprietary format from Unisys.

    Hit - A request for any object or file that is on a web site. This could be an html page, a file or a graphic on a page. A request for a page can generate a lot of hits depending on how many sub-elements of files the page consists of. This is an indicator of web site traffic but not an indicator of how pages were looked at. Also see Page and User.

    Home Page - The main or default page in HTML (Hyper Text Markup Language) format of a Web site. This page usually provides visitors with an overview and links to the rest of the site. This page's address is referred to as URL.

    HTML - Hyper Text Markup Language is used to write documents for the Internet.  It specifies hypertext links between related objects and documents.

    HTTP - Hyper Text Transfer Protocol is a standard method of transferring data between a Web server and a Web client.

    IP Address - The Internet Protocol address identifies a computer connected to the Internet.

    Log File - A file created by a web or proxy server, which contains all of the access information regarding the activity on that server.

    Log Source - A set of log files from a web server (for instance c:\winnt\system32\logfiles\w3svc15\*.log). A site profile can point to one or more log sources.

    META tag - An HTML tag that must appear in the HEAD portion of the page. META tags supply information about a page but do not affect its appearance. Some search engines when adding a web site to the catalogue use these tags.

    Organization - A commercial, academic, non-profit, government, or military entity that connects users to the Internet, identified by an entity's Internet domains.

    Page - Any document, dynamic page, or form defined as a page file, e.g. .html pages..

    Page (HTML) View or Request - The request for a file defined as a page file. The page is basically what you see after the transfer and can consist of many other files. Page requests do not include hits to images, component pages of a frame or other non-html files. The number of page Hits = the number of page views. Also see hit.

    Platform - The operating system (i.e. Windows 95/98, Windows NT/2000, Linux, Unix, Macintosh, etc.) used by a visitor to the site.

    Protocol - An established method of exchanging data over the Internet (e.g. FTP, HTTP, etc).

    Proxy server - An Internet server that acts as a firewall, mediating traffic between a protected network and the Internet.

    Referrer - The URL of an HTML page that refers to the site. Referrer data is useful to determine how users came to your site.

    Relative URL - The Internet address of a page or other World Wide Web resource relative to the Internet address of the current page. A relative URL gives the path from the current page to the destination page or resource. A relative URL can include a protocol. For example, the relative URL Test/Sample.htm refers to the page Sample.htm in the folder Test, below the current folder.

    Robots - Also called search spiders. These are the programs used by search engines to catalog web sites.

    Robots.txt - A file that instructs the search engine's robot which directories to catalog or to skip. If you do not have this file, it will show up as a 404 error (file not found) when a search robot visits your site. You can use an empty file.

    Root web - The default, top-level web provided by a Web server. To access the root web, you supply the URL of the server without specifying a page name or sub-web.

    Script - A type of computer code that can be directly executed by a program that understands the language in which the script is written. Scripts do not need to be compiled to be run.

    Status Codes - A code entered in every hit or log line in the log file that indicates the status of a file/page request.

    Information codes 1XX - This code indicates a provisional response, consisting only of the Status-Line and optional headers, and is terminated by an empty line. It is usually only for experimental purposes.

    100 Continue
    101 Switching Protocols

    Successful 2XX - This status code indicates that the client's request was successfully received, understood, and accepted. Possible Successful Status Codes are:

    200 OK
    201 Created
    202 Accepted
    203 Non-Authoritative Information
    204 No Content
    205 Reset Content
    206 Partial Content

    Redirection 3xx - This code indicates that further action needs to be taken by the user agent in order to complete the request.

    300 Multiple Choices
    301 Moved Permanently
    302 Moved Temporarily
    303 See Other
    304 Not Modified
    305 Use Proxy
    306 Unused
    307 Temporary Redirect

    Client Error 4XX – These are errors that occurred due to an invalid or failed request by the client or visitor's browser. Possible client error codes are:

    400 Bad Request
    401 Unauthorized
    402 Payment Required
    403 Forbidden
    404 Not Found. This is the most common error on the reports, and means that someone has requested an object that is not within your site. This could be because of:

    Bad or outdated links to pages or files within your site.
    Bad or outdated links to pages or files from outside your site
    Someone mistyped or misspelled the URL to get to an object on your site.

    405 Method Not Allowed
    406 None Acceptable
    407 Proxy Authentication Required
    408 Request Timeout
    409 Conflict
    410 Gone
    411 Length Required
    412 Precondition Failed
    413 Request Entity Too Large
    414 Request-URI Too Long
    415 Unsupported Media Type
    416 Requested Range Not possible
    417 Expectation Failed

    Server Error 5XX - These are errors that occurred due to an invalid or failed task on the server. Possible server error codes are:

    500 Internal Server Error
    501 Not Implemented
    502 Bad Gateway
    503 Service Unavailable
    504 Gateway Timeout
    505 HTTP Version not supported

    Internal Errors 6XX - These are errors that occurred in the link checking program itself (these are unofficial error codes used to report problems).

    600 Malformed URI
    601 Connection Timed Out
    602 Unknown Error
    603 Could Not Parse Reply
    604 Protocol Not Supported

    SSL or Secure Sockets Layer - A proposed open standard developed by Netscape Communications for establishing a secure communications channel to prevent the interception of critical information, such as credit card numbers. The primary purpose of SSL is to enable secure electronic financial transactions on the World Wide Web, although it is designed to work with other Internet services as well. This technology, which uses public key encryption, is incorporated into many Web browser and Web servers. Refer to for more on public key encryption and the subject of cryptography.

    Server - Also called host. This is a computer that offers services on a network. On the World Wide Web, a server is a computer that runs the Web server software that responds to HTTP protocol requests.

    Server Error Codes - Status Error Codes in the 5XX range indicating the type of errors that occurred during a file/page request. See Status Codes 

    Shared Client Session - A Session, which is, shared among 2 or more views i.e. a client who has visited more than 1 Page. Other Log File Analyzers shows this as separate clients, which do not tally with the total clients. Some show it as "Not Applicable"

    Spiders or robots - An automated program, which searches the Internet and add data to search engines. On a web site the robots.txt file specifies which directories the spider should catalog.

    Time Zone - This is the time relative to Greenwich Mean Time ( 0:00 ), e.g. GMT - 6 for Central America. Most World Wide Web servers record hits or requests in local time where the server is located. Microsoft IIS servers use GMT by default.

    Unknown Referrers - When the referrer field in a log file is not logged, the program reports the hit as an unknown referrer. The referrer field can be empty when the visitor as a spider, the visitor entered the URL directly in the browser or selected the link from favorites. Some browsers can also leave the field empty. Some log analysers ignore this field. SurfStats Log Analyzer V8 and SurfStatsLive V3 and later records only the original referrer. If a visitor used Google to find your site, it will be shown as the referrer but other links on your web site, e.g. from index.html to buy.html, will not show index.html as referrer.

    URL - Uniform Resource Locator is a means of identifying an exact location on the Internet. An URL consists of four parts:

    Protocol Type (HTTP),
    Machine Name (domain),
    Directory Path (/), and
    File Name (default.htm),


    User (client or visitor) - Anyone who visits the site at least once. A cookie or an IP address uniquely identifies a user. If there are no cookies available, the IP Address is used to determine a unique visitor. A unique visit is the number of unique visits in a specific time period from a unique IP Address or cookie used.

    User (client) Session - A series of consecutive requests from a user to an Internet site.  A user session is terminated when a user does not make another request for more than 30 minutes.

    If for example a visitor with IP Address, visits the site, logs out and another visitor logs in an hour later with the same IP Address, there would be two user sessions but one unique visitor. 

    Previous Top Next

    Question: Report Accuracy
    How accurate is log file analysing?


    Log file analysing is not an accurate science and you should not waste too much time on specific figures. You will also find that no two log analyzers report the same figures.

    Report accuracy

    There are many factors that influence the accuracy of reports from analyzing log files. If the generated reports look inconsistent, check that:

    You have specified the path and log file names correctly.
    The log files are parsed and entered in the database correctly. You can do this by specifying a small log file and comparing the reports to the actual entries in your log file.
    You have specified the log files correctly.
    You do not have many error lines in your log files that are being discarded by the program.
    You have specified filters correctly. Note that filters are not case sensitive.
    You have specified the period to report on correctly.
    You have used the correct method to populate the database. We recommend that the first option (overwrite the database) be used to populate the database. Changing filters when using the Add to database option would mean that the database could contain inconsistent entries.

    Unknown referrers

    The report will sometimes show up some fields as "Unknown" if the log line does not contain all the referrer information. The fields will show as “-“  in the log line. This may happen when:

    The user typed the URL of the web site directly into the Address field of the browser, i.e. the URL was not referred from another site.
    Software was used that blocks the sending of browser information to the server.
    The browser software does not send referrer information, e.g. some spiders and e-mail siphoning software. 


    Log Analyzers have to make certain assumptions when analyzing log files. These include how to track unique visitors (using IP Addresses or Cookies), the cut-off time to count a visitor as a new visitor and how errors in log files are handled during the parsing process.

    A user session includes a series of consecutive requests from a user to an Internet site.  A user session is terminated when a user does not make another request for more than 30 minutes. This is referred to as the cut-off time. This means a user may log in many times per day and if the requests are always less than 30 minutes in-between, the program will only report it as one user session.

    The period being analysed also plays a role. If you determine the number of unique users every day and add it up to get a week’s unique users, this would probably not be the same as the number of unique users determined per week. The reason for this is that a unique user might not be counted as a unique user early the next day when using the IP Address as unique identifier and the cut-off time is less than 30 minutes. A daily count would show 7 but a weekly count would show 1 when cookies are used and the same user visits every day.

    Dynamic IP Allocation

    Due to the shortage of IP Addresses, most ISP’s dynamically allocate IP Addresses to their users from their limited range of IP Addresses. This means that a visitor with a certain IP Address might not be the same visitor with the same IP Address a little later.

    Mapping individual IP addresses or requests onto users or even using cookies are not entirely accurate -- the exact number of individual users can only be determined by requiring them to log on individually to your site.


    One problem in providing accurate results is the caching performed by your PC and ISP. Caching reduces the number of pages requested at the host server, as popular pages are stored locally either as temporary files on your hard drive or in the ISP's page cache. Since log files only record files requested from the server, the number registered in the log file can be incorrectly low.

    Visitor’s Disk Cache

    If your web site has been visited, the downloaded files are on the visitor’s hard disk. Requests for files on your web site would be first served from the visitor’s cache and if not available (or old), would only then be served from your web site’s server. This would result in fewer hits in your web site’s log files.

    There are JavaScript code available on the Internet that you can put in your web pages to force a reload or refresh of your web page. You can search for  “force reload JavaScript” on a Search Engine to find a suitable script.

    Caching Servers

    Many ISP's are running cache servers to reduce web traffic and speed up the transfer of commonly accessed web sites by their users. There are also several national and international caching servers that many ISP's are using in order to speed up transfers. This means for instance that if one AOL user visits a site, then any of the other AOL users who visit that site after that would load the site from the AOL cache, and not from the visited site.  The larger ISP’s like AOL, Earthlink, MSN, Prodigy, MSN, Earthlink, etc., all use caching servers and hits from these users could be much more than reflected in the log file.

    Geographical location

    Visitors’ locations cannot always be accurately determined, as an IP address does not necessarily specify the geographical location of the user.  A large number of IP addresses can also remain unresolved.

    Hits from “non-visitors”

    Spiders or robots from search engines that catalogue your site can exaggerate your site statistics, as they are not true visitors. Eliminating them from your overall scores can provide more realistic figures.

    Firewall or proxy server

    The incoming web traffic that passes through a firewall or proxy server to reach the web server is in most cases identified by a single IP address of the firewall or proxy server.  This is called Address Translation. The log file will in a case like this only contain one unique IP Address even if multiple users from behind the same firewall or proxy server visited the web site. Analyzers will these visits as visits from the same user.

    Errors in log files

    Errors in log files are usually the first item to look for when you are getting inconsistent reports or reports that are not making sense. Errors in a log line may cause that the log analyzer discard the line’s information. If your log files are not very large, you can edit the log file with an editor like Wordpad or Notepad.  Look for strange characters or misplaced text strings and remove or correct it.

    You should correct the cause of the problem (e.g. an overloaded server) if your log file contains many errors. Your reports will only be as accurate as your source data.

    Page view and user sessions

    Some clients have reported that page views and user sessions do not tie up. Please keep the following in mind when interpreting report results:

    ·        Files not defined as a page type and graphic files also trigger a user session.

    ·        The user session cut-off time.

    ·        Dynamic IP Address location.

    ·        The effect of caching.

    One visit can include many hits.  A report on downloaded files may show a few hits but no user session. This is because the visit is counted at the start page where a visitor enters the site. Only a request for the entry page will count as the start of a user session.

    Previous Top Next

    Question: Hints and Tips
    Can you give me some tips how to analyze my log files?


    Tips & Tricks

    General tips
    Insist on referrer information in log files or find a host that provides log files with this information. You cannot get meaningful information of your web site's activity without referrer information.

    If you have multiple sites, set up a site profile for each site and also a profile that combines all of them.

    Use a third party submission service like World Submit to submit your site to search engines. When using a third party services your e-mail address is not supplied to search engines and you would not get the usual, mostly unwanted, e-mail replies.

    Do not over analyze. Use the Parento principle (also know as the 20 - 80 percent principle) when analyzing a web site. This means that you should first focus on the few clients that generate most of the traffic to your web site, the few referrers that refer most traffic to your web site, the few countries that most of your clients come from, the few incorrect links that causes most 404 errors, the search engines that generates most of the traffic, etc.

    Use keywords to improve popularity
    Use the Top Search Keywords and Top Search Phrases reports under the Referrer heading to see which keywords or phrases visitors use to find your site. Gather statistics for a couple of months before you decide on your search phrases.  Build focused pages around queries and ensure that you have pages within your web site with good, solid content for these terms to please the crawlers. Do not pick keywords that are too popular or broad. Once you have set everything up, add the keywords or phrases in the Meta tags and submit to search engines. Use the Page Ranking Tool supplied in SurfStats Log Analyzer to check your ranking at the most populare Search Engines.

    Look for visitors that never click past your homepage
    If the number of single access pages is unreasonably high or visitors seldom click past your homepage, this can indicate a weak page that does not inspire visitors to further explorer your web site. An image that takes a long time to load on a main entry page and that is used, as an entry page is a definite No-No. When using a Flash entry page, also create a link to bypass the Flash entry page. The result will surprise you when you compare hits between the Flash and Bypass pages..

    Look for visitors that bypass your payoff page
    If a substantial number of visitors exit your site without visiting your payoff page, the pages linking to your payoff page could be weak and may need some atention. Make sure you have clear links and a reason for visitors to visit your payoff page.

    Look for incomplete hits by noting the bytes transferred
    Incomplete hits can indicate server capacity and connectivity problems or that a page is too large. See if there are date/time patterns, which also indicate capacity problems.

    Look for Quality, not just Quantity
    Track hits from ads and reciprocal links by tracing their clicks through to your payoff page. It doesn't pay to run ads that generate hits but seldom click-through to your payoff page. Also see the section on advertising analysis.

    Look for visitors repeatedly entering your site on pages other than your homepage
    This could indicate the other pages have important search engine keywords in their text that should be included in your homepage text, or that you should add their Meta tags to your homepage Meta tags.

    Look for patterns of search engine keywords that result in hits on your payoff page
    This helps target the search engines, understand your visitors' needs, and select the HTML text that best motivates your visitors.

    Look for referrers that generate a lot of traffic to your site
    Visit the site that generate a lot of traffic to your site and see why they linked to your site. This can help you to market your site more effectively.  No referrers from search engines indicate that you are either not listed or not listed effectively on search engines. You can check your site's popularity on the web with services that provide link popularity checking like  They provide this service for free and offer tips on how to improve your link popularity.

    Look for search robot activity
    Add a robots.txt to the root directory of your web site. Search robots can generate a lot of hits, especially to the robots.txt file. Exclude (filter out) accesses to the robots.txt file by search engine robots as this can influence or distort traffic significantly. If you get no requests for this file it means that you should submit your site to search engines. No hits to the robots.txt  file indicates that your are not listed on search engines that send out robots to catalog your site.

    Look where clients exit your web site
    This can be the last page they accessed or they can exit it by clicking on an interesting link on your page (also refer to the section how to create hits to external links in your log files in Advertising Analysis). 

    Look for web site problems
    Web site problems that completely break a web page are pretty easy to spot (like very few hits or error codes in your log file), but others may be more difficult to find. If your site gets a large number of unique visitors, but the total number of page views is small, the problem may be due to:

    Poor site navigation
    Uninteresting site content
    Browsers that cannot view your site’s pages properly

    Use the detail daily error report and the other error reports to monitor, find and reduce errors on your web pages. Start with the most errors of incorrect links and fix it.

    Do visitors find your site interesting?
    See if clients bookmark it.  Add a "favicon.ico" file to the root directory of your web site. Also add the "favicon.ico" file to every directory of your site.  When a visitor,  using Internet Explorer 5+,  bookmarks your site, a request is made for the file "favicon.ico"  You can then filter on the file "favicon.ico" to see the number of hits. By knowing the number of hits from the total browser hits and those just Internet Explorer 5+, you can get a good ballpark figure of the total number of bookmarks to your site. By generating a report on hits to the "favicon.ico" file over time, you can see if you are getting new visitors and if the number is improving.  (Repeat visitors have probably book-marked you page already and will not bookmark it again). By placing  a "favicon.ico" file in every directory, you can also see which directories are bookmarked.

    See if there are many single access pages in relation to the number of hits per page. The alarm bells should ring if the number of single accesses to default.htm (your home page) is about the same as the total number of accesses to this page.

    See the number of accesses to your home page (usually default.htm) in relation to accesses to all other pages. This is a good indication of how many visitors click past your home page.

    See if visitors recommend your site to their friends and associates. At  you can get a script that visitors can click on to recommend your site and also informs you when it has been recommended.

    See if they link to your site. You can find out by typing the following in the search window of most search engines:

    Link: where is you web page address.

    See the time visitors spend looking at your pages. 

    See how many return visitors you get.

    See the number of page views per visitor.

    Find out more about visitors
    If you have received e-mail from a visitor, you can look at the suffix of his e-mail address and then look-up the country from the ISO country code list. This list is available in the online help in SurfStats (Help-Contents-Appendix-List of country and ISO internet codes).

    You can also do a Domain Name System (DNS) lookup of a visitor's IP Address, also referred to as IP Address Resolution.  A DNS lookup queries DNS servers for the IP Address of a domain name. Note that some IP addresses cannot be resolved due to a variety of reasons like some ISP's allocating dynamic IP addresses to their clients, the host is not available, etc.  The resulting URL may contain the domain name and the country of origin of your visitor.

    You can also find out more about your visitors by clicking on the IP Address hyperlink in a report and browsing to your visitor’s web site.

    You can query IP Address databases through a whois lookup at the three Regional Internet Registries (RIRs) worldwide, which collectively provide IP registration services to all regions around the globe.  

    ARIN (At -  North America, South America, the Caribbean and sub-Saharan Africa.
    RIPE (At - Europe, Middle East, parts of Africa
    APNIC (At - Asia Pacific

    or at

    AllWhois at
    Network Solutions  at
    Department of Defense at
    GeekTools at
    UXN Spam Combat at

    Look for server attacks
    Server attacks are worm or virus attacks as well as unauthorized users trying to gain access to protected directories.

    A common server attack is a request to the “cmd.exe” file caused by the Nimda or the Code Red virus present on a Windows machine. If the machine is on a local network, you can find out which machine it is on and inform the network administrator. If this file was requested from the Internet, you can do a DNS lookup through the program or do a Whois lookup (using or ) to find out who this comes from. If you can find out where the request came from, you can inform the originator of  the virus on their server.

    These requests usually cause many 404 (File Not Found) errors in your log files. If you find successful accesses to the file cmd.exe on your Windows Server, your server is probably infected.

    Clean up your log files before processing
    You could speed up processing of your log files if you remove unwanted entries (e.g. requests for images files, 404 errors, junk entries, etc.) from your log files first. You can do this with the free SurfStats FileFilter available at:

    Previous Top Next

    Question: Referrer Information
    I do not get any referrer or search engine information in reports. What is wrong?


    Extended or Referrer information is most probably not logged. To get all the reports available in SurfStatsLive and SurfStats Log Analyzer, you need to have referrer information in your log files. Contact your web host or server administrator to set extended looging on.

    The following is a very basic description on how to set up extended logging to get referrer information in log files on Apache and Internet Information Server (IIS) servers:


    Please refer to for documentation on the Apache web server.

    We suggest that you use the Combined Log File Format and also log referrer information. You can configure Apache to generate combined log files by editing the "httpd.conf" file in the \Apache\conf\ directory and change entries as follows:

    Specify the log file format with the LogFormat directive, example: LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\""

    Specify that you want a combined log file stored and the location, for example:  CustomLog logs/combined.log combined


    We suggest you use the W3C Extended Log File Format as it is the only IIS5/6 format that logs Browser/Platform and Referrer on IIS (Internet Information Server). SurfStats also supports the other available IIS types. To set it up on IIS5, (IIS6 and IIS4 should be very similar):

    Click on Start - Programs - Administrative Tools - Internet Service Manager - select your server and web site- right click on it and select Properties - Choose Active log format (W3C Extended Log File Format) - Click on Properties - Extended Properties and set the required fields.

    At least the following fields should be logged:

    Client IP address (c-ip)
    User Name (cs-username)
    Server IP address (s-ip)
    Server Port (s-port)
    Method (cs-method)
    URl Stem (cs-uri-stem)
    Url Query (cs-uri-query)
    Protocol Status (sc-status)

    Bytes sent (sc-bytes)*
    Bytes received (cs-bytes)*
    User Agent (cs(User-Agent))* - for browser information
    Cookie (cs(Cookie))* - for cookie information
    Referer (cs(Referer))* - for referrer information

    We recommend logging of all extended properties. Stop and start the web server after editing the properties. Create an entry in the log file by accessing your web site with a browser and check if it is correctly logged in the log file.

    * By default is NOT logged by IIS.

    Please note that IIS reserves and locks a 64 KB block in the current log file, which it is logging to. The current 64 KB block in use cannot be added to the database. Some clients reported an error “Database empty” and expected this information to be added the database.

    Also note that the default setting for ASP buffering is ON in IIS5/6. This causes the sc-bytes field to be logged as 0. You should switch ASP buffering OFF to log this field. If you do not do this, you will not be able to track bandwidth in reports on ASP files.

    Previous Top Next

    Question: Demo Title
    My group name is getting messed up.  It shows as SurfStats Demo. What is wrong? 

    To remove this or change the heading, view the reports. Click on the Options tab at the bottom left and then on Options. Then change the Domain name and click on submit.

    Previous Top Next

    Question: New in SurfStats Log Analyzer
    What is new in SurfStats Log Analyzer?



    Previous Top Next

    Question: New in SurfStatsLive
    What is new in SurfStatsLive Web Site Reportin Server?



    Previous Top Next

    Question: Print All Reports
    How can I print all reports without having to generate each report and print?

    [--- UPDATED: 9/23/2005 1:35:11 AM BY AGENT: Admin Profile ---]

    Select Complete - All Report after you have parsed the log files and when you are in Report mode (the Reports tab will be available in the left bar at the bottom).

    This will create all the reports to a specific directory and can be used to print all the reports of SurfStats.

    Then do the folowing:

      a. Open the default report in Internet Explorer
      b. Select the PRINT button
      c. Select Print all linked documents and
      d. Click on OK

    Note that not all browsers support the printing of linked documents.

    Previous Top Next

    Question: Create more 20 entries on reports
    How can I see more  than 20 entries in a report?


    Note that you cannot have more than 20 records displayed on graphs.

    You can set the number of entries or records (table and sub-table entries) to report on. There are two places to set this:

    1. Edit Site - Contents or
    2. Using the Control Panel - Report Options,

    Previous Top Next

    Question: Record lock was unsuccessful
    Log Analyzer Enterprise Edition (trial)

    Unable to unlock profile to run a report. Right clicked on profile and selected "Unlock..." Nothing happens.

    Make sure that you are using the latest version 8 available from
    If you are using V8, stop the scheduler and try again to unlock it. Note that when you start generating the report, the site profile will be locked while it is generating the report.

    Previous Top Next

    Question: SurfStatsLive Overviews not showing
    We are trialling your log stat analyser and we have had it working for two and a half weeks of the thirty day trial. But now the overview is no longer working, it flashes up the figures and then as you will see turns blank.

    Can you tell us whether this is problem with our setup or a feature of the trial.


    This was fixed in the latest version available from

    Previous Top Next

    Question: Removing Robots Traffic from SurfStats
    I have a client that is not interested in having robots in his stats program. I know I can use a robots.txt file to prevent robots from indexing the site, but we want the robots to index the site, just not be displayed on the stats report. When he looks at vistors, he wants to know that that is the number of people that visited the site, not people and robots. Is there any way to eliminate robots with Surf Stats from the reports?


    Filtering out robots is quite complex. SurfStats classifies anything that looks for robots.txt as a robot. This works in most cases but is not always effective as subsequent visits from robots may not request this file. Reports in the "Traffic" category display visits from humans and robots. Reports in the "Visitors" category displays visits from human visitors only. Reports in the "Spiders" category displays visits from spiders only. In some of these reports you can reclassify visitors by clicking and editing the "Type" field displayed in the report's tables.

    Note that you must have a robots.txt file (even if it is empty) before SurfStats will make the distinction between robots and visitors.

    Previous Top Next

    Question: Default page in reports
    I’m seeing a lot of /default.asp entries even on websites that don’t even have this page. 

    You can set the default page (say default.htm) per site profile that the program will use if the visitor typed in the url without a file name, e.g.
    This means that the program will accept that the hit was to
    You should not use different default page names (e.g.default.asp, default.html, etc.) in other directories of mysite as the program accepts only one name.

    Previous Top Next

    Question: Page Title Lookup Loop

    The page lookup utility has got stuck in repeated loops.
    I entered my site URL as

    What is wrong? 


    Specify the URL as

    The program takes the URL and adds the path from the log file to the URL. If the path was specified as, the path will be added to give and will continue on doing this.

    Also make sure that the Title Tag is in the header at the top of the web page and that you are using the latest version available from

    Previous Top Next

    Question: Upgrading SurfStatsLive
    How do I upgrade to the latest version of SurfStatsLive?


    See the "Upgrading to a new version" section in SurfStatsLive installation guide at

    This document is also in the readme file in the latest version available from

    Previous Top Next

    Question: PPC (pay per click) campaigns - Google and Overture

    Can I track PPC campaigns with SurfStats Log Analyzer and SurfStatsLive?

    Solution: You can track PPC campaigns from search engines like Google and Overture. Please refer to for more details.
    Previous Top Next

    Question: Specifying reporting period on a schedule
    I create a month to date report every morning. The period I specify spans 1 month. The last day of the report should be is set to yesterday. The report runs fine everyday until the 1st of the month. The report range that gets generated is 1 Apr 2005 00:00 - 31 Mar 2005 23:59. The report range should actually be 1 Mar 2005 00:00 - 31 Mar 2005 23:59. A fix or any help you can provide would be greatly appreciated.

    Solution: Maybe try setting the last day of the report should be "the last day of last month" instead of "yesterday" if you are generating reports on the 1st of the month.

    [--- UPDATED: 4/2/2005 4:42:56 AM ---]

    Previous Top Next

    Question: Scenario Analysis
    I've downloaded a trial version of the enterprise edition. Now I want to set up an scenario analysis. But I don't know how. In the helpfile isn't an hint how to do that.
    Can you help me? It is an important feature in my requirements and if it not possible to use that I can't buy the tool.


    The easiest would be to have a look at the instructional video about this topic at The last two videos there. If you set it up it is advisable to first generate reports so that the page data is filled in then set it up from conversion tracking as shown in the videos, then regenerate reports.

    If you have additional queries please do not hesitate to contact us.

    [--- UPDATED: 4/7/2005 5:16:55 AM ---]

    Previous Top Next

    Question: Administering SurfStatsLive from the command line
    How can I administer profile groups and profiles from the command line?


    SurfStatsLive V3.0 and prior included the SurfCmd utility. A better solution (for V3.0), which makes use of a Windows Scripting Host (WSH) file, is available at Unzip the contents of the zip file to any folder on the server running SurfStatsLive and read the readme file included in the zip.

    Versions of SurfStatsLive after V3.0 will include the WSH file in the installation. 

    Previous Top Next

    Question: Service does not start if I change Merging Service user account
    If I change the user account under which the SurfStatsLive Merging Service runs in the SurfStatsLive Global Setup application the Merging Service does not start up again.

    Solution: Most likely the account specified (even if it is a member of the Administrators group) does not have the right to log on as a service. The only current solution is to set the account from Control Panel - Administrative Tools - SurfStatsLive Merging Service.... - Log On tab. If you do it this way the account will be assigned the right to log on as a service.
    Previous Top Next

    Question: Empty reports with SurfStats Log Analyzer and SurfStatsLive on Win 2003 SP1 and Win XP SP2
    On some computers (not all) SurfStats Log Analyzer and SurfStatsLive produce blank reports on Win 2003 SP1 and Win XP SP2.

    [--- UPDATED: 11/24/2007 2:50:22 AM BY AGENT: Admin Profile ---]

    Short Answer...

    Please try the following:

    1. Go to Settings - Control Panel - System - Advanced tab - click Settings button (under Performance) - Data Execution Prevention tab.

    2. Select the 2nd option (Turn on DEP for all programs...) and in the exception list add

    a) DLLHOST.EXE (located in c:\windows\system32) for SurfStatsLive


    b) SurfStats.exe (located in c:\Program Files\SurfStats<Version>) for SurfStats Website Traffic Analyzer.

    Please Note: If you are running SurfStats Website Traffic Analyzer V8.4 or later add surffox8400.exe to the DEP exception list. If you are running V3.4 or later of SurfStatsLive please add surffoxlive3400.exe to the DEP exception list. For previous version follow the instructions above.

    Long Answer...

    The following is from Microsoft's site

    CAUSE: As of Win 2003 SP1 and Win XP SP2, Microsoft has enabled Data Execution Prevention (DEP) - a feature that is included in newer processor series from AMD and Intel. Data execution prevention (DEP) is a set of hardware and software technologies that perform additional checks on memory to help protect against malicious code exploits. Intel refers to their version of DEP as XD or "execution disabling bit". AMD refers to their version of DEP as the "NX-bit" or "No Execute bit".

    SOLUTION: Disable DEP on Win 2003 SP1 and Win XP SP2 as follows:

    [ If you have an Intel processor you may need to disable the "XD" or Execution Disabling Bit in your computer's CMOS/BIOS (BIOS can be changed when computer starts up) . Since each computer's CMOS is different, reference the computer's manual or contact the manufacturer of the computer in question for assistance with this step. ]  

    1. Verify the Administrator account is running for Windows XP. For Windows 2003 log in with the Administrator account. 
    2. Go to Start->Control Panel and choose the System applet.
      [XP Home users may need to choose the "Classic View" link to be able to see the System applet.]
    3. Click on the Advanced tab.
    4. Select the Settings button under Startup and Recovery.
    5. Locate the line that specify what the default operating system is, which is similar to the following:
      "Microsoft Windows XP Professional" /NoExecute=OptIn .........  or
      "Windows Server 2003, Web" /NoExecute=OptIn.......
      (depending on whether you use Win XP or Win 2003).
    6. Locate and change the boot.ini, by clicking on the Edit button, and then change /NoExecute=OptIn to /NoExecute=AlwaysOff. 
    7. Save the file and reboot. 

    An alternate way to solve the DEP problem on Win XP/Win 2003 is to go to Settings - Control Panel - System - Advanced tab - click Settings button (under Performance) - Data Execution Prevention tab. Select the 2nd option (Turn on DEP for all programs...) and in the exception list add DLLHOST.EXE (located in c:\windows\system32) if you are running SurfStatsLive or SurfStats.exe (located in c:\Program Files\SurfStats<Version>) if you are running SurfStats Log Analyzer. 

    Per-program DEP configuration

    For the purposes of program compatibility, you can selectively disable DEP for individual 32-bit programs when DEP is set to the OptOut policy level. To do this, use the Data Execution Prevention tab in System Properties to selectively disable DEP for a program. For IT professionals, a new program compatibility fix that is named DisableNX is included with Windows XP SP2. The DisableNX compatibility fix disables Data Execution Prevention for the program that the fix is applied to.

    The DisableNX compatibility fix can be applied to a program by using the Application Compatibility Toolkit. For more information about Windows application compatibility, see Windows Application Compatibility on the following Microsoft Web site: (

    Also see for a program to test if you have DEP enabled on your system.

    Previous Top Next

    Question: Visitor Origin Database
    I'm evaluating the Live Enterprise Edition and i would be glad in receive a trial Activaction Code.

    Plus a techinical question:
    How i setup the Visitor Origin Database? I can't find it for download...



    [--- UPDATED: 6/2/2005 3:36:42 AM BY AGENT: Admin Profile ---]

    The SurfStats IP Visitor Database can be downloaded from

    Note that this zipped file is about 40 MB in size. We suggest that you use a download manager like Getright that can do resumed downloads to get it.
    Unzip the downloaded file, read the readme file for installation instructions and run setup.exe to install. Then activate the database with the activation code.

    Request a trial activation code by sending the Machine ID to us. To find the Machine ID and to request an activation code for your computer, please do the following:


    1. Please ensure you have the latest trial version installed. It is available from our site at 

    2. Log in as a Server Administration and click Obtain Activation Codes from the Options tab. Connect to the Internet, fill in the details on the form and click to submit.
    You can also email us this 8 character Machine ID to Please also send us the build number, e.g., if you want the activation code of an older version.

    Previous Top Next

    Question: SurfStatsLive appears to hang when user logs in
    When attempting to log in (as a Server Administrator, Profile Administrator or SurfStatsLive user) on a SurfStatsLive Server running on Windows 2003 SP1 the browser seems to hang.


    Please try the following:

    1. Shut down the SurfStatsLive COM+ package from Control Panel - Admin Tools - Component Services - expand Console Root, Component Services, Computers, My Computer, COM+ Applications - right-click the SurfStatsLiveVersion3000 package and then select "Shut Down".

    2. Stop the SurfStatsLive services in Control Panel - Admin Tools - Services.

    3. Go to Settings - Control Panel - System - Advanced tab - click Settings button (under Performance) - Data Execution Prevention tab. Select the 2nd option (Turn on DEP for all programs...) and in the exception list add DLLHOST.EXE (located in c:\windows\system32). 

    It may be necessary to reboot after this.

    Previous Top Next

    Question: RecordIndex out of range error.
    I uninstalled Surfstats using Add/Remove programs from the Control Panel, deleted the Surfstats directory, rebooted the machine, reinstalled the program and the problem persists. The error occured on the first start up of Surfstats, in its default state, and it persists.

    [--- UPDATED: 6/22/2005 10:53:20 AM ---]

    I have re-installed and ther problem persists. Upon starting the program, I get this error.


    [--- UPDATED: 6/29/2005 2:35:56 AM BY AGENT: Admin Profile ---]

    I see you are running Windows 2003. Maybe the problem is caused by the same issue as described at

    After the startup of SurfStats and the error do things work normally?

    [--- UPDATED: 6/22/2005 1:14:03 PM ---]

    You must uninstall the program with the Add/Remove programs from the Windows
    Control Panel and then delete the directory:
    \Program Files\SurfStats8000

    Reboot and then install the latest version available from

    Some customers have reported this error when there are no profiles defined on the Traffic tab, however everything else worked normally when this happened (they reported). If you run SurfStats as an Enterprise Edition, depending on the profile type (Traffic, Proxy or Streaming Media) you select the profile may end up on a different tab.

    Previous Top Next

    Question: surfstats could not determine the format of your log files
    I get this error when I try to make a report "Surfstats could not determine the format of your log files"

    This is the log format I have. It is a .zip files - - (28/Apr/2005:00:01:03 -0400) "GET / HTTP/1.1" 200 14740 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"

    What should I change?

    I unzipped the file you sent me and used the default settings to create reports.
    Make sure that you either use unzipped files or that you specify the zipped file as:

    and NOT as:

    (Windows XP and 2003 sees the zip file as a folder)

    [--- UPDATED: 10/12/2005 3:40:17 AM BY AGENT: Admin Profile ---]

    Zip a small log file that you get the problem with and email it to so we can try to find out what is wring.

    [--- UPDATED: 10/3/2005 12:40:28 PM BY AGENT: Admin Profile ---]

    Previous Top Next

    Question: Error with using .zip files in Windows 2003 and Windows XP

    Zip files are seen as folders and SurfStats erroneously adds *.* at the end of the zip file

    Solution: Fixed in Version 8.1
    Previous Top Next

    Question: Generating reports manually works but scheduling reports does not work
    When I run a manual report and select it to save to a network drive z:\ it works just fine.
    When I setup a seheduled task using the exact same paramters for output folder z:\ it does not work. It says in the scheduled task log that there was an error copying data to that folder.
    But it works when I generate the report manually? Why?

    Two reasons for this:
    1. When you run the task manually the SurfStats Log Analyzer application runs under the user context you are logged in as, which is probably Administrator. When you schedule the task it runs under the user context specified for the SurfStats Scheduler Service, which is the LocalSystem account by default (Set this in Control Panel - Administrative Tools - Services - SurfStats Scheduler - Log On tab). The LocalSystem account does not have rights to access resources on the network, so if z: is a mapped network drive it won't be able to access it. So first thing to do is to specify an account different from LocalSystem with sufficient rights for the service - on the "Log On" tab. This account must exist with the same password on both computers.
    2. The specification of a mapped drive might also create a problem. Mapped drives only become available when the user that created the mapped drive logs into the computer. The service runs even if no user is logged into the computer, so it won't be able to access a mapped drive if the user that created the mapped drive is not logged in. The best is to use a UNC name (for instance \\othercomputer\logfiles\W3SVC15\ex*.log) when specifying the log files for the profile. So you need to create a share on the other computer (for instance logfiles) or use an administrative share (C$ for instance).
    The same is applicable for SurfStatsLive, except the service name is called the SurfStatsLive Merging Service in Control Panel - Administrative Tools - Services.

    Previous Top Next

    Question: Login page hangs
    Sometimes when logging into SurfStatsLive with a browser the login screen does nothing after the username and password is entered.

    Solution: Please try the following: Run Component Services (Control Panel - Admin Tools - Component Services) and navigate all the way to the SurfStatsliveVersion3000 package, right-click, select Properties, on the Pooling & Recycling tab  increase the Pool Size to 15 and OK, right-click the package again and select "Shut Down" and try again. It will start it up by itself as needed.
    Previous Top Next

    Question: bandwidth not shown in reports
    thankyou very much, i see those settings now.

    [--- UPDATED: 2/25/2006 4:32:43 AM BY USER ---]

    None of the bandwidth stats are showing and this is one of the main reasons i am considering purchasing your software as i need ot monitor the uplink bandwidth.


    [--- UPDATED: 2/25/2006 1:42:03 PM BY AGENT: Admin Profile ---]

    The sc-bytes and cs-bytes fields are probably not logged in your log files. The following is from the help in SurfStats WebSite Traffic Analyzer:

    We suggest using the W3C Extended Log File Format as it is the only IIS5/6 format that logs Browser/Platform and Referrer info on IIS (Internet Information Server). SurfStats also supports the other available IIS types. To set up logging in IIS do the following:
    Click on Start - Programs - Administrative Tools - Internet Service Manager - select your server and web site- right click on it and select Properties - Choose Active log format (W3C Extended Log File Format) - Click on Properties - Extended Properties and select the fields to log.

    ·    Date
    ·    Time
    ·    Client IP address (c-ip)
    ·    User Name (cs-username)
    ·    Server IP address (s-ip)
    ·    Server Port (s-port)
    ·    Method (cs-method)
    ·    URl Stem (cs-uri-stem)
    ·    Url Query (cs-uri-query)
    ·    Protocol Status (sc-status)
    ·    Bytes sent (sc-bytes)*
    ·    Bytes received (cs-bytes)*
    ·    User Agent (cs(User-Agent))* - for browser information
    ·    Cookie (cs(Cookie))* - for cookie information
    ·    Referer (cs(Referer))* - for referrer information

    Please note that IIS reserves and locks a 64 KB block in the current log file it is logging to. The current 64 KB block in use cannot be added to the reporting database. Some clients reported an error “Database empty” and expected this information to be added to the database.

    [--- UPDATED: 2/25/2006 1:56:36 AM BY AGENT: Admin Profile ---]

    Also note that the default setting for ASP buffering is ON in IIS5/6. This causes the sc-bytes field to be logged as 0 as the web page is served from the web server's cache. You should switch ASP buffering OFF to log this field. If you do not do this, you will not be able to track bandwidth in reports on ASP files.
    We recommend the logging of all the fields on the Extended Properties tab. Stop and start the web server after editing the properties to log. Create an entry in the log file by accessing your web site with a browser and check if the entry is correctly logged in the log file.
    Of particular importance is the Protocol Status field. Sometimes logging of this field is turned off with the result that SurfStats produces no reports. This field contains the status code (for instance 200 for success, 404 for page not found etc.) for the HTTP request and is crucial in log file analysis.
    * By default is NOT logged by IIS.
    At least the following fields should be logged:
    Previous Top Next

    Question: Empty or blank reports when using FTP (AutoFTP retrieval method on profile)
    When defining a profile as of type AutoFTP blank reports are coming up after report generation or a 5-reason Windows dialog is displayed.

    1. Some firewall software is blocking the FTP connection (like Windows firewall - installed by default, Sygate etc.). Try disabling the firewall software or configure it correctly to allow all the applications in the SurfStats installation folder to access the FTP server on the Internet. The Windows Firewall software cannot be configured in the original versions - you'll need to use Windows Update to get the latest updates and reconfigure by using the applet from Windows Control Panel.  
    2. The FTP username and password isn't correct anymore. Try changing the password for this account on the server and in SurfStats and then try again. 
    3. If using a IIS FTP server - the FTP listing method on the server has been changed from Unix style to MS-DOS style (a property setting for the FTP server in IIS on the server computer).
    4. You are trying to download the log files from a FTP server which SurfStats cannot interpret.
    Also please have a look if some meaningful info is displayed if you click the FTP status button in the bottom right while SurfStats is downloading the files from the FTP server.
    [--- UPDATED: 3/15/2006 2:31:03 AM ---]

    Previous Top Next

    Question: Moving a SurfStatsLive installation and/or data
    Can I move just the data path of a SurfStatsLive installation?


    Unfortunately not, but you can move the complete installation (app+data) from one drive to another. The "Set data path" option on the Options tab in Server Administration is used where multiple installations share the same reporting database. This option cannot be used for changing the location of the database.

    Move an installation as follows:

    1. Determine the exact version of SurfStatsLive you have running by logging into SurfStatsLive with a browser as a Server Administration and selecting the Options tab and then have a look at one of the Registration links. Download the exact SurfStatsLive zip installation file (for later use) from the SurfStats web site. Contact us for the location.

    2. On the server go to Control Panel - Administrative Tools - Services and stop (if running) the SSLive Monitor, SurfStatsLive Merging Service and SurfStatsLive Page Title Lookup Services.

    3. Go to Control Panel - Administrative Tools - Component Services and expand to the two Surf... COM+ packages, right-click them individually and select shut down to stop them.

    4. Disallow access to SurfStatsLive via a browser.

    5. With Windows Explorer copy (not move) the SurfStatsLive installation folder (default c:\Program Files\SSLive<version>) to a different folder (for instance c:\SSLive<version>). This copy will be used later.

    6. With Control Panel - Add/Remove Programs remove SurfStatsLive.

    7. With Windows Explorer remove the SurfStatsLive installation folder (default c:\Program Files\SSLive<version>).

    8. Run the Registry Editor (Start - Run - regedit<Enter>) and delete the key HKEY_LOCAL_MACHINE\SOFTWARE\SurfStatsLive.

    9. Run the setup.exe in the SurfStatsLive installation zip (file from step 1) and complete the installation on the new drive (for instance in d:\Program Files\SSLive<version>). Also complete the steps in the SurfStatsLive Global Setup application that runs automatically towards the end of the setup.

    10. Repeat steps 2 and 3 to stop the services and COM+ packages on the new installation.

    11. With Windows Explorer copy the contents of the backup copy you made in step 5 to replace the files in the new installation folder. For instance you would copy the contents of c:\SSLive<version> to d:\Program Filles\SSLive<version>.

    12. On the server go to Control Panel - Administrative Tools - Services and start the SSLive Monitor and SurfStatsLive Merging Service and SurfStatsLive Page Title Lookup Services. Starting the Page Title Lookup Service is optional.

    13. Test and see if it works.

    Previous Top Next

    Question: Page Title Lookups in SurfStatsLive 3100
    Page Title Lookups in SurfStatsLive V3.1.0.0 does not work.


    The solution below is ONLY applicable to SurfStatsLive V3.1.0.0. It should be run on the server computer.

    1. Log into SurfStatsLive as a Server Administrator and stop the Page Title Lookup Service from the Options tab.

    2. Download the file from and save in the folder where SurfStatsLive is installed.

    3. With Windows Explorer go to the SurfStatsLive install folder, double-click file and extract the 3 files to the SurfStatsLive install folder.

    4. Run 1.bat by double-clicking it.

    5. Reboot.

    6. Run 2.bat

    7. Log into SurfStatsLive as a Server Administrator and Start the SurfStatsLive Page Title Lookup Service from the Options tab.

    8. If page title lookups do not appear in reports you may need to reset the profiles.

    Previous Top Next

    Question: Problemming accessing SurfStatsLive installaion on Windows 2003
    After installing SurfStatsLive on a fresh installation of Windows 2003 the SurfStatsLive site cannot be accessed. It appears that the SurfStatsLive Global Setup application has created the web server correctly.


    Please ensure you have ASP and Server-side Includes enabled in "Web Service Extensions" in IIS Manager.

    Check if the Surfstatslive virtual server ip address is correct. Use IIS and check if you can browse the site.

    If you can access the web server, but get empty reports please refer to the KB issue regarding DEP. 

    Previous Top Next

    Question: COM+ username not accepted during installation

    When I run SurfStatsLive setup.exe over Remote Desktop Connection it asks for a username and password for the surfstats com+ Identity. I then specify a windows user account which is Administrator and the correct password and then it eventually asks for it again then it fails with the error: Error 1928: Error registering Com+ Application. Then the application fails.


    At the point where it asks for the username try going to Control Panel - Admin Tools - Component Services and expand all the way to the 2 SurfStatsLive packages. For each of the 2 packages right-click and select Properties and then the Identities tab, specify the username and password and OK, then continue the installation.

    Previous Top Next

    Question: MergeServer not updating database

    Doing another reinstall got it working. Thanks!

    [--- UPDATED: 12/12/2006 2:15:17 PM BY USER ---]

    I recently upgraded from 3.1 to 3.3 and the profiles are not updating. Looking at the Scan Status, I see "MergeServer is Running .. Database will be updated." It has been several hours and nothing has updated yet.

    MergeServer3300.exe is running using the Local System account.

    Any ideas?

    David Riggs
    Texas A&M University


    [--- UPDATED: 12/13/2006 12:53:08 AM BY AGENT: Admin Profile ---]

    Download the new program from

    sure the service is not running and Uninstall the installed program.
    Then delete the SurfStatsLive3300 directory before installing this
    file. Also make sure that you do not install an older setup.exe (it
    might happen if it is in the disk cache)

    [--- UPDATED: 12/12/2006 1:57:39 PM BY AGENT: Admin Profile ---]

    Previous Top Next

    Question: Vista Compatability
    Will Surfstats Log Analyzer work in a computer using the Vista operating system?


    SurfStats can run on a computer running Vista. Just make sure that you run it with Administrator rights. Right click on the SurfStats icon and change the properties or click on the Run as Administrator.

    [--- UPDATED: 3/19/2007 3:07:53 AM BY AGENT: Admin Profile ---]

    Previous Top Next

    Question: Installing SurfStats or SurfStatsLive on Windows Vista
    How do I install SurfStats or SurfStatsLive on Windows Vista?


    Installing SurfStats Website Traffic Analyzer on Vista.
    1. Unzip the contents of the downloaded zip file to a folder.

    2. From Windows Explorer right-click and select to run as Administrator.

    3. Complete the installation.

    4. Run SurfStats and generate reports to screen for one of the sample profiles.


    Installing SurfStatsLive on Vista.

    1. Open the Windows Control Panel.

    2. Open Programs and Features.

    3. Click "Turn Windows Features On or Off" 

    4. Expand "Internet Information Services"

    5. Expand "Web Management Tools"

    6. Expand "IIS 6 Management Compatibility" and enable all features under this option.

    7. Under "Internet Information Services" expand "World Wide Web Services"

    8. Expand "Application Development Features"

    9. Enable at least "ASP" and "Server-Side Includes".  

    10. Click OK

    11. Unzip the contents of the downloaded SurfStatsLive install zip file to a folder.

    12. From Windows Explorer right-click and select to run as Administrator and continue through the steps.

    13. Towards the end of the installation the SurfStatsLive Global Setup application will start up and report a permission problem about listing the virtual web servers. Click OK. The virtual web server will be configured later.

    14. On the Authentication tab configure the authentication options.

    15. On the Identities tab specify a user for the COM+ package and a password. This must be a Windows user that belongs to the Administrator group.

    16. Fill in the necessary details on the Information tab and click Done and OK on the problem about the virtual web server. 

    17. Go to Start - Programs and select SurfStatsLive V3.4 (or whatever version) and then click the SurfStatsLive Global Setup program icon.

    18. Click the Web Server tab and configure the virtual web server that SurfStatsLive will be accessed on and click Done.

    19. From SurfStatsLive Program Groups (as for step 17) select SurfStatsLive. A browser window should open. View reports for one of the demo profiles to check if things are working.

    We are working on a solution for the IIS permission problem encountered in step 13.

    Previous Top Next

    Question: Apache Log File Rotation
    Can SurfStats Website Traffic Analyzer and SurfStatsLive detect Apache log file rotation and how do I set up the profile?

    Log rotation on Apache servers backs up the current Apache log file and clears it out.. SurfStats can detect this. To set up the profile:
    1. For Log File Date Format (on the "Log Format" tab) specifcy the actual format of dates present in the file. Still use "Auto-detect" for the file format.
    2. Specify only the name of the folder and access-log as the filename on the Input folder, for instance / (so here the folder name is / SurfStats picks up that log rotation is taking place when it sees access-log, access_log or access in the filename.

    Previous Top Next

    Question: SurfStatsLive Visitor info button error - Windows 2003 64-bit
    When you click the blue visitor info button on the Visitor reports in SurfStatsLive you either get a HTTP 500 error or scipt runtime error 800a01ad.

    This seems like some security network issue on Windows 2003 64-bit. A workaround is to add SScrRun.dll as a component to the SurfStatsLive COM+ package (which is what the setup.exe will do in future releases). But for now:
    1. Start - Run - cmd<Enter>
    2. cd "c:\Program Files\SSLive3400"<Enter>   ...assuming installed in this folder.
    3. regsvr32 SScrRun.dll /u<Enter>
    4. Go to Control Panel - Admin Tools - Component Services and expand to the SurfStatsLiveVersion3400 package and under that click Components, right-click and select New - Component.
    5. Click Next and select "Install New Component(s)". Select c:\Program Files (x64)\SSLive3400\SScrRun.dll and add it to complete the wizard screen.

    Previous Top Next

    Question: Most Downloaded Files
    Thanks for the great support.
    It is appreciated.


    [--- UPDATED: 10/13/2008 6:16:05 PM BY USER ---]

    How do you set what files are included in the Most Downloaded Files report.
    It does not seem to include .pdf files ?


    [--- UPDATED: 10/14/2008 2:17:56 AM BY AGENT: Admin Profile ---]

    Remove pdf as document type and add pdf as file type under Options - File Types. Then run the report again

    [--- UPDATED: 10/13/2008 3:23:39 PM BY AGENT: Admin Profile ---]

    Previous Top Next

    Question: COM Surrogate Encountered a Problem and must close

    We have the latest SurfStatsLive installed on Windows2003 Advanced WebServer and approx every 3 or more days SSLive stops responding. When we restart the server and login to the desktop, a Microsoft error boxes opens and states, " COM Surrogate Encountered a Problem and must close" with the only options to either send the error to Microsoft or Not to send and close. This error boxes displays 3 times from one to the other afte closing each with the same error.

    The APP error logs thru Event Viewer surrounding the timeframe indicated in the abovementioned desktop errors are:

    Faulting application dllhost.exe, version 5.2.3790.3959, faulting module ntdll.dll, version 5.2.3790.4455, fault address 0x0002a774.

    Faulting application dllhost.exe, version 5.2.3790.3959, faulting module ntdll.dll, version 5.2.3790.4455, fault address 0x0002cac2.

    Faulting application dllhost.exe, version 5.2.3790.3959, faulting module ntdll.dll, version 5.2.3790.4455, fault address 0x0002cac2.

    The server that SSLIVE is installed has the latest & greatest MS Windows updates per Microsoft. The only other services active on this server is IIS WEB & FTP. When the software works, it works GREAT!

    There are no other errors recorded to the best of my knowledge. These errors began shortly after installing SSLIVE.


    1. Set the SurfstatsLive COM+ to keep it running:

    Go to Administrative Tools - Component Services and open it till you see the Com+ Applications
    Right click on SurfstatsLive3400 and click on Properties.
    Go to the Advanced tab and tick the Leave running when idle under Server Process Shutdown.
    Click ok.

    2. Add dllhost.exe (in the Windows\System\ directory) to the Dep list. To do so:

    Right click on Computer, and choose Properties
    Click on Advanced System Settings, and then under Advanced, click Settings
    Select the "Data Execution Protection" tab, and then click "Turn on DEP for all programs and services except those I select".
    Click on the Add button, and then browse to C:\Windows\System32\dllhost.exe
    Click Open, and then OK - You should see Com Surrogate added to the DEP list.

    3. There might not be enough processing power to do the log file parsing and reporting. We suggest that you remove some of the older data or more to a dedicated stats server if you have many and/or large site profile databases.

    Previous Top Next

    Question: HTTP 500 error on install
    I managed to figure it out, I had to change the default ASP language to VBScript in IIS

    [--- UPDATED: 9/29/2009 2:30:16 PM BY USER ---]

    I still get the same issue

    [--- UPDATED: 9/29/2009 10:56:45 AM BY USER ---]

    I've installed Surfstats, i've even used an administrator account to make sure it wasn't a permission error, but I get an HTTP 500 error.

    I am able to type in pages like /calendar.html and they come up so the website itself is working, but something with the application doesn't seem to want to start.


    [--- UPDATED: 9/30/2009 4:27:13 AM BY AGENT: Admin Profile ---]

    [--- UPDATED: 9/30/2009 4:26:03 AM BY AGENT: Admin Profile ---]

    This may be because ASP pages are disabled in IIS.


    1. Open IIS Manager, expand the master server node (that is, the Servername node), and then select the Web service extensions node.
    2. In the right pane of the IIS Manager, right-click the Active Server Pages extension.
    3. Click to select the Allow check box.
    [--- UPDATED: 9/28/2009 3:43:11 PM BY AGENT: Admin Profile ---]

    Previous Top 

     Home | Contact Us | Privacy Policy | Disclaimer
      ©1998 - 2015 SurfStats Software. All rights reserved.