Sawmill

» see sawmill.net as it lived, on the wayback machine

~ the goodbye ~

Sawmill was a log file analyzer, which in 1998 meant something broader than it means now. Flowerfire, a small company in Santa Cruz, California, wrote a program in C that you pointed at a pile of raw server logs and that gave you back a hierarchical report: visitors, pages, referrers, error rates, whatever the log happened to record. It ran on every major platform because it had to, since the machines generating the logs were a zoo.

The number it advertised was around 850 supported log formats, and that figure is the whole product. Web servers were only the start of it, and the list ran through firewalls, proxy servers, mail servers, network devices, syslog daemons and databases. If a box on your network wrote a line of text when something happened, Flowerfire's position was that Sawmill could probably parse it, and if it could not, the format description language would let you teach it.

You may have run it without ever seeing the name. Cisco shipped a rebadged version as Sawmill for IronPort inside its Web Security Appliance management stack. SonicWALL sold another as Aventail Advanced Reporting. Vicomsoft put a third out as InterGate Intelligence. A parser that handles 850 formats is worth most to the vendor who needs exactly one of them, and Flowerfire spent a good part of its life as that supplier.

~ the chronicle ~

~ eight hundred and fifty formats ~

The reason to keep a tool like this around was that the log belonged to you. It sat on your disk, it recorded every request including the ones from machines that never ran JavaScript, and nothing in the loop phoned anybody. Sawmill added a page-tagging server and a JavaScript tag later so it could catch client-side clicks as well, which was a concession to where the industry had gone rather than a change of heart.

The industry had gone to hosted tagging, and the economics were brutal. Google bought Urchin in 2005 and gave away the result, and from that point a per-profile license for a server-side analyzer had to justify itself against zero. What kept Sawmill alive another sixteen years was the set of customers who could not use the free thing: people with firewall and mail logs that no tagging script will ever see, and people in buildings where sending traffic data to a third party was not a decision anyone was allowed to make.

~ what the front page says ~

The last version announcement on sawmill.net is dated 14 February 2019 and covers release 8.8.0, with multiprocessor database filtering and key-based SFTP authentication. Version 8.8.1 followed and became the last. On 17 May 2021 a new item went up above it, two sentences long, saying that Sawmill had gone out of business and that the support address would still be monitored.

The notice has not moved since. The Internet Archive captured the page in January 2021 with 8.8.0 at the top and no notice, in June 2021 with the notice in place, and then every year after that with nothing changed, most recently in May 2026. The header above it still says DOWNLOAD SAWMILL 8.8.1 and still offers thirty days free. Whoever pays for the hosting has left the storefront lit and gone home, and the root of the domain does not answer at all any more, so the only door into the place is the one the archive remembers.

~ the tier I was never in ~

I have read a lot of logs. What I never did was buy a license to read them, and that is the honest distance here. If you were a student in Turkey with a site on shared hosting, the control panel came with AWStats or Webalizer already installed, and the question of whether something better existed never got asked, because the thing in front of you was free and produced a bar chart. Sawmill sold to the layer above that, the one with a support contract and a reason to care about 850 formats rather than one.

That layer is also where it died. Logs stopped being a thing an organization held and became a thing an organization streamed somewhere, and the analyzer you install on your own machine turned into an odd request. The notice Flowerfire left on 17 May 2021 promised that the support address would go on being read, and that promise is the last thing the company is on record as saying.

@}-->--

              )
             (_)
            .-'-.
            |   |
            |   |
            |   |
            |   |
          __|   |__   .-.
       .-'  |   |  `-:   :
      :     `---'     :-'
       `-._       _.-'
           '""""""

« previous  ·  random  ·  next »