How Do I Use IP Address Filters with NCSA (Apache) Logs?


It is very common to use IP address filters with Profiles, for the purposes of including only IP addresses from a particular IP address, excluding the IP addresses of internal monitoring systems, and so forth. This is easily done with Urchin. However, it is important to use the proper 'Filter Field' specification when setting up an IP address filter.


When using creating a new filter or editing a filter, be sure to select the 'Remote Host' filter field in the Filter Settings screen. This is the actual NCSA field that stores the IP address of the visitor in the webserver log. Do not use the 'IP Address' filter field, as this applies only to the IP address field in W3C (IIS) webserver logs.

Other Considerations

Remember that Urchin filter patterns are POSIX regular expressions. Therefore, be sure to escape the '.' characters in your IP address specification to ensure that Urchin does not interpret them as metacharacters for the regular expression. For example, to filter on the IP address '', you would specify the filter pattern as '172\.16\.1\.1'. As another example, to filter on the IP address range '', the filter field would be specified as '192\.168\.'.

Multiple filter patterns must be separated by a pipe character: