What's new in HttpLogBrowser 2.0
New features
- You can now analyze Apache access logs. The supported formats are the common log format and the combined log format.
- The program can now also determine in which country client IP addresses are located. If the option is selected you will see a new column Country in the log rows view.
- More, the program can resolve client IP addresses to their host name. Two fields are then added. ClientHostName (full host name) and ClientHostDomain (with only the domain of the internet access provider).
- If you need more information on a field you can now display a detailed field statistics window with the complete list of all values for the field and with time activity information (first/last activity time and activity duration) for each value.
- In the detailed field statistics window you will also be able to display field evolution statistics in terms of number of different values or average/sum for numeric fields (e.g. in the previous screenshot the number of different Client IP addresses per month).
- Improved analysis of numeric fields: In the new version you will also see the ranges of numeric values in the statistics data and will be able to easily display all web requests in a specific range or with a value greater than a specific value (e.g. requests taking more than 10000 ms). The histogram is also more interactive and allows you to display the percentage of requests with a field value less than the value at the cursor position.
- With this new version you are also allowed to specify a tracking field (e.g. client IP address or a specific extracted cookie) and copy specific fields value of the first request of a visitor to all successive requests (e.g. in the following screenshot the fields RefererSite and UrlPath are copied under the new names Source.RefereSite and Source.UrlPath on all request from the same visitor).
In the result you will also see a column Source.EvenTime with the time of the landing request of this visitor, a field Source.SinceDays with the number of days since the landing request and Source.RequestNumber with the number of requests done by the visitor.
With such a feature you will be able to quickly know from where a visitor doing a specific request (e.g. downloading a file) came from, when and where he landed and how much activity he did since the landing. - New cryptographic fields in IIS on Windows 2012 R2 and Windows 2016 can be translated to help detecting weak TLS usage in IIS. These cryptographic fields need to be enabled in IIS as explained in the following article:
New IIS functionality to help identify weak TLS usage
The version 2 also comes with a new professional edition that also propose additional new features.
Improvements
- Latest filtered views are kept in cache so if you go back in the filter history the data of an already viewed filter is displayed faster.
- Ability to directly filter exclusively on a field value instead of adding the value filter to the existing filter.
- New more comprehensive field names. Example the W3C field cs-uri-stem is now UrlPath and the field s-bytes is now BytesReceived. In the case you prefer W3C field names you can still switch back to the original names.
- Filter expressions are no longer generated with brackets arround the field name
- Improved Time Statistics chart by allowing to change the time unit. In the previous version the time unit was determined automatically and you could not be changed.
- Ability to filter fields to hide unused fields. With all the extracted fields there can be very many fields for a web request and you may take some time to find the field you are interested in in the field statistics. To avoid this, you can specify in the field filter portions of field names. This will display only fields having one of the specified strings in their name.
- New field Request Status including a textual description of the HTTP status and sub-status and the meaning of the Win32 error code. This is very useful if you are not familiar with all the HTTP status codes.
- The position of the vertical and horizontal splitters in the main window is kept