ip_analyser

Upload Apache access logs and see request counts by IP address, browser or bot, page path, and date. ip-analyser provides private reports directly in Drupal.

ip-analyser helps site administrators understand traffic recorded in Apache access logs. Upload a log file to see which IP addresses, browsers or bots, and page paths appear most often, along with request counts by date.

An access log is a text file your web server creates to record incoming requests. This module turns those records into readable tables inside Drupal, without sending them to an external analytics service.

Features

• View request counts by client IP address, full user agent, request path, and date.
• Analyze Apache combined access logs, including logs with Acquia trailing metadata.
• Support IPv4 and IPv6 addresses.
• Group requests by path without query strings.
• Upload uncompressed .log or .txt files up to 256 MiB, subject to hosting limits.
• Process one file at a time in the background, with bounded batches, automatic progress updates, and paginated results.
• Explore private IP drilldowns with related paths, user agents, response codes, HTTP methods, hourly activity, and response bytes.
• Return to My reports to view history, resume interrupted jobs, cancel processing, or delete reports and uploads.
• Configure per-user report and upload storage limits.
• Explain skipped lines with bounded diagnostic reasons and sample line numbers, without retaining raw rejected log contents.
• Keep reports accessible only to the user who uploaded the file and block direct downloads of raw logs.
• Configure report retention (24 hours by default); Drupal cron removes expired reports and uploads.

Use ip-analyser to investigate unusually high traffic, identify frequently requested paths, or review requests from particular IP addresses and user agents. It analyzes existing log files; it does not collect visitor activity or provide real-time monitoring.

Installation

Install the latest stable release from the root directory of your Composer-managed Drupal site:

composer require 'drupal/ip_analyser:^1.0'

After Composer downloads the module, follow the Post-Installation steps below to enable and configure it.

Post-Installation

1. Enable the module through Drupal’s Extend page or with drush en ip_analyser -y.
2. Ask your site administrator to configure Drupal’s private file storage outside the public web root.
3. Go to People → Permissions and grant “Upload and analyze Apache access logs” only to trusted authenticated roles.
4. Go to Reports → Apache access log analyzer, or visit /admin/reports/apache-access.
5. Upload a supported log file and select “Analyze log.” Processing continues in the background. Explore IPs, agents, paths, dates, response codes, methods, and hours, or return to My reports later.

Ensure Drupal cron runs regularly so expired uploads and reports are removed. Reports become unavailable after the configured retention period (24 hours by default); physical deletion happens when cron processes them.

For prompt background processing, schedule or continuously run drush queue:run ip_analyser --time-limit=5 --lease-time=30. Cron also processes a limited amount of queue work. Administrators can configure retention and quotas at /admin/config/system/apache-access.

When upgrading an existing installation, run drush updatedb -y and drush cr. Completed reports retain their existing counts; analyse the log again to obtain new IP details.

The module does not create a content type or require changes to text formats. Dates use the timezone recorded in each log entry. Client IP counts use the left-most address in the first logged X-Forwarded-For, forwarded_for, or xff field when that field is present. If it is missing, empty, or '-', the first log field is used. A malformed left-most address is skipped rather than replaced with a later proxy address.

Additional Requirements

• Drupal 10 or Drupal 11.
• PHP 8.1 or newer with the mbstring extension. Your Drupal core version may require a newer PHP version; Drupal 11 requires PHP 8.3 or newer.
• Drupal core’s File module.
• Configured private file storage and regular cron execution.
• Apache combined access logs in uncompressed .log or .txt format.
• Sufficient database and file storage for uploaded logs and aggregated results.

For uploads approaching 256 MiB, your hosting environment must allow the request size. Recommended PHP settings are upload_max_filesize=256M and post_max_size=272M or higher, with a compatible reverse proxy limit.

No external API, analytics account, or Acquia subscription is required.

Recommended modules/libraries

No additional contributed modules or libraries are needed. A configured logging backend, such as Drupal core’s Syslog module, can help administrators investigate processing failures.

Similar projects

ip-analyser focuses on manually uploaded web-server logs. It is useful when you already have Apache logs and want to inspect request counts within Drupal. It does not offer the visitor journeys, dashboards, or continuous tracking commonly provided by broader analytics tools.

Supporting this Module

Help improve the module by reporting reproducible bugs, suggesting improvements, testing releases, and contributing documentation or code through the project’s issue queue.

Community Documentation

The README.md included with the module explains installation, supported log formats, upload limits, permissions, and retention.

Limitations and privacy considerations

Compressed files, JSON logs, and Apache common logs without referrer and user-agent fields are not supported. Reports aggregate the entire uploaded file; filtering and CSV export are not currently available.

Access logs can contain sensitive information. Restrict upload permission to trusted users. Per-user upload storage and report limits are configurable. Site backup retention is managed separately from module report retention.