5 STATS. Query for retrieving various data and statistics

5 STATS. Query for retrieving various data and statistics
A command that gives you access to large amounts of information is STATS. How is the load on the ports divided? who is banned and why? how many is away? and many other things.
Syntax:
/STATS [ []]

Stats on remote servers are partly disabled, for that “sense of achievement” in bandwidth saving. Undernet has also sadly disabled most of these locally, to stop attackers from seeing the network structure and other weak spots. Because of this, the information present about the stats replies here may be inaccurate for newer versions of ircu


I refer to “lines”. These are literally lines in a configuration file on the server.
The data are all kept in the same format for programming reasons, so some fields will be blank for some lines.
c, h, i, k, l, m, o, u and y queries are common for all networks, the others are ircu implementations. Case sensitive only when stated.
In addition, ircu.2.10.10 started implementing F-lines, socalled feature-lines to keep track of all the configuration and compile-time options and choices ircu allow. These lines are also responsible for the oper-only commands /set /reset and /get. Non-operators arn't allowed to view F-lines but I mention them here to avoid confusion.

5.1 Who's allowed in and how.
5.1.1 k K-line
Returns a list of banned usernames and hostnames. (Kill-lines) Helps you determine why someone can't get in.

K::::-1
the optional reason can be entered plainly using quotes or, when preceded by a !, be the path to a textfile that contain the reason.
(versions prior to 10.05 could only allow reference to a filename, without !)
As of ircu2.10.11, the field can filter on your infotext (realname) when preceded by $R
The -1 is a field who should be a port by the standard syntax, set to -1 since it dosn't make sense in this context.

Examples:
K * user 0 -1
K *.ppp.some.mr Go_away ~tagger 0 -1
anyone matching "user@*" is banned. (guaranteed fake ID) anyone matching ~tagger@ppp.some.mr is also banned.

K *.compuserve.com !klines/us * 0 -1
Anyone from compuserve is k-lined, server looking up a file and replying with its contents, say “Please use a us-server".

K * K-lined because of clones ~victor
anyone matching ~victor@* is k-lined, just displaying the text "K-lined because of clones"

K $R*sub7* you are infected with a trojan * 0 -1
Will k-line anyone with infotext (see 2.14) mathing *sub7*

If you happen to find a lowercase "k"-line, it works as other K-lines, except it contains an IP-address that will K-line the user even if his IP happen to resolve to a DNS address. This is part of the protection against "virtual host" misuse, as described in "userhost/userip" (2.9)
k 192.168.* !klines/martians * 0 -1


Stats K has remote capabilities:
Syntax: /stats k fullservername mask
You have to pass along a mask, and you cannot force all lines “the wildcard way”. From ircu2.10.01 you can replace fullservername with a nick. (meaning the nicks server)

Notes:
the ~ is added by the server when it wasn't able to verify your address. (Which it does by IDENTD)
Ircu also performs checks on your username outside the k-lines. Mixed case can trigger it
the 0 and -1 at the end are just unused fields.
In addition to all this, there’s some fuzzy features. A server might add G-lines to its K-line list automatically and allowing opers from other servers to set its k-lines. It shouldn’t make much difference though. There's also an attempt at "timed K-lines" for balancing the load from near and abroad as the peak-hours shift across the globe.



5.1.2 g G-line
shows G-lines.
They work as K-lines except that they ban for the whole undernet (Global-lines) and they expire automatically after a given period of time.

Example:
G **@fish.baccalao.com 970523933 [Super] large trout slapping [3]
G *timmy@grasshoppers.org 970574400 Banned due to clones.

The format is simple: Address, number, reason. The number is based on a startingpoint. the "epoch". It's a LONG number that tells the number of secs since 01:00 1. jan 1970 GMT time. if you try /debug in mIRC you will find it used in whois-replies. (signed on.. e.t.c) and also in pinging. For the whois, your program automatically converts the number to your timezone and translates it into readable format.
When the date/time specified by number is reached, the G-Line is lifted. A G-line usually lasts for a few hours or a week, but could easily be set to last forever. (Well, over 30 years atleast.) Also see (6.5)

Note that the number used will not be the same as the number used for date/time in e.g Excel, because Microsoft chose another startingpoint. (There were no Microsoft in 1970 :-)

Lacking a command to add k-lines on the fly, a form of g-lines not propagating to other servers, socalled local global-lines (sic!) were made available. Then in principle you could do away with the k-lines.


How do one translate the LONG number to a normal date/time format? I got this handy alias for mIRC from Rainman:
First make this an alias: /unixtime /echo $active $$1 = $asctime($$1) and then you type say, /unixtime 970574400 and get the output: 970574400 = Tue Oct 03 14:00:00 2000 You may type //echo $asctime(970574400) if you don't know how to make aliases.



5.1.3 i I-line
A list of the hosts that is allowed to connect to the server as a client.


I:::::

Example:
I nomatch * *@*tea-house.com 0 4
I *@*.se * *@*.se 0 20
I *@*.fi * *@*.fi 0 20
I *@*shoeshop.com 5 *@*shoeshop.com 0 20
I *@* * Unresolved 0 1
I *@* * *@* 0 1

On the last two lines, you can see that the server will in general allow anyone. Even if the server can't get your DNS address (Unresolved) But In the K-line list, your host or domain might be k-lined because you should use a closer server. (European clients will experience this a lot on us-servers and vice versa.)

Take notice of the 2. field from left . In versions earlier than ircu2.10.05, “ONE” here meant that only one connection were allowed in from the same IP-address, when sorted under this I-line. From 10.05 they can put a * to mean unspecified, or a digit, 1 to 9, to limit the number of clients connecting. In the example above, shoeshop.com are allowed to have 5 connections from the same IP-address, where the connections are counted globally. (Its total number connections to the IRC-network) The old “ONE” only looked for clients connected to this very server.
To ease it for lazy server-admins, ;-) one can compile ircu to still accept “ONE” in the I-lines. If so is done, a “O” shows up in the /version reply. (4.2.7)
At the same time, the field is the field to put in the password for operator connections. That won't be displayed ofcourse :-)

The field is usually empty, hence the 0. But it's not port 0. If in use, it probably restricts the connection to use only the specified port.

Example:
Your favourite server has got the following line and you are under the *.de domain: “I *@*.de 2 *@*.de 0 20”
If you already had two connections to Undernet, possibly on other servers, this exact server would not let you in. Another server with a different setup, might still let you in.

Q: What if I match more than one I-line?
A: If the administrator has put the lines in the right order, you should be matched to the I-line with the most specific mask. (“*.yourprovider.com” is more specific than “*.com”)

Q: Don't I and K lines "collide" sometimes?
A: As a thumbrule, the leftmost, or most specific identification can override the other.

This depends on the admin setting up the lines correctly

Example:
A European server might K-line the whole *.edu domain, but put *.someuniversity.edu in I-line. Someuniversity will then get in, so the "someuniversity." inclusion is overriding the .edu exclusion.
A *!*someperson@someuniversity.edu K-line will in turn override the universities' general I-line.
Also the common "*!~user!*@*" K-line will override the common *!*@* I-line, that allows anyone in general in.
If a server has the same mask in both an I and a K line, the K override the I.

I-lines can be fetched remotely. Same syntax as for k-lines (5.1.1)



5.1.4 o O-line
This one returns a list of hosts from which normal clients may become operators.


Example:
o *@*.sol.no * discotom 0 10
o *@*.sn.no * discotom 0 10
O *@*.online.no * McSyrup 0 10
O *@*.sol.no * McSyrup 0 10

Big O in the list means a global op, small o means a local op. Local ops can't act outside the server, and on Undernet they can't use Uworld. Ops can also see invisible people, but the "local ops" can only see those invisible on their own server. Your local "local ops" (locops for short) is shown in the "/who 0 o" command, along with the global operators.
The ops listed in the example are put in connectionclass 10. (5.1.5) the * is for the hidden password, 0 is just empty.

see 4.2.7 for more about the Op-status.

5.1.5 y Y-line
y shows Y (Class) lines from server's configuration file
These classes are used to decide how many are allowed to connect from different places on the internet. A european server for example, might allow, say a maximum of 100 us-users, and would therefore put all *.com *.edu *.net and *.org users in a class with a maximum of 100. Another use, is putting the operators in a dedicated class, so that they'r sure to get in, even if the server should be full.


The syntax is:
Y::::::

Example
Y 0 120 600 1 2000000 1
Y 70 200 120 10 4700000 3
Y 20 180 0 300 400000 60
Y 10 180 0 100 400000 4
Y 5 180 0 50 400000 25
Y 4 180 0 400 400000 368
Y 3 180 0 200 200000 153
Y 2 180 0 200 400000 200
Y 1 180 0 400 400000 42

In this example, class 1 can take up to 400 users, with a max sendque of 400000. But has only 42 users. The ping-frequency is allowed to be as high as 180. ping-frequency is how long you can be silent before a ping is sent. If all classes were filled up, this server would have 2370 clients. I choose to call the possible clients in a class "seats". We might guess that class 70 and 0, both with few seats, special ping-frequency and high sendq size, is dedicated to server-server connections.
In O-lines (5.1.4) we read that for this server, class 10 is where the operators are placed.

Where the classes are saved:
Who goes in which class is defined in the I:lines. here's an example from a norwegian Undernet-server:

I *@*.org * *@*.org 0 3
I *@*.net * *@*.net 0 3
I *@*.edu * *@*.edu 0 3
I *@*.com * *@*.com 0 3
I *@*.se * *@*.se 0 20
I *@*.fi * *@*.fi 0 20
I *@*.dk * *@*.dk 0 20
[...]

All americans are grouped in class 3, while people from the neighbouring countries goes in class 20. According to the y:lines above, the neighbour-countries has 300 "seats" dedicated to them, and us-citizens 200.
Further down we find:
I NOMATCH * *@*.telepost.no 0 4
I NOMATCH * *@*.online.no 0 4
I NOMATCH * *@*.telenor.no 0 4
I NOMATCH * *@*.sol.no 0 2
This means 600 "seats" are reserved for these hosts. (see y-lines) (NOMATCH forces the address to be resolved. The server dosn't want to be fooled) Coincidentally, these are domains belonging to the ISP running the server! ;-)

To Determine your class: use /trace yournickname.
Example: "User 3 Napoleon[modem15.lePPP.eifelnet.fr] 30" means nickname Napoleon belongs to class 70, beeing idle 30 secs.



5.2 Server-server connections
5.2.1 c
Returns a list of servers which the server may connect to or allow connections from.

Example prior to ircu2.10.10:
N *@130.240.16.107 * Lulea-R.SE.Eu.Undernet.org 0 80
C *@130.240.16.107 * Lulea-R.SE.Eu.Undernet.org 4400 80

Example, current ircu:
C * * London.UK.Eu.Undernet.org 0 80
C * * Amsterdam-R.NL.EU.Undernet.org 0 80
C * * Oslo1.NO.EU.Undernet.org 0 70
C * * Gothenburg.Se.Eu.Undernet.org 4400 80

Earlier servers had two lines “C” to connect TO, and “N” to accept connection FROM.
These are merged into one today. The IP of the server is also masked, along with the password ofcourse, for security reasons.
The two last numbers are unixport and class to connect to. You’ll find the same port in /stats y (5.1.5)
if the port is ommitted (0 as here) the server will not try to connect to that server.
That means that the server in this example can accept connections from london, amsterdam, oslo1 and gothenburg,
but will only try to connect to Gothenburg itself. This is part of defining the tree-structure.



5.2.2 U (uppercase)
showing U:lines. Listing of servers allowed to act as “services”. Uworld is running x on Undernet
Example:
U Uworld.undernet.org Uworld,X,NickSvr,NickSaver,NickServ,LPT1,LPT2,AUX * 0 -1
U Uworld2.undernet.org UWorld2,W,ChanSvr,ChanSaver,ChanServ,COM1,COM2,COM3,COM4 * 0 -1
U Uworld.EU.undernet.org EuWorld,E,protocol,StatServ,NoteServ,Undernet * 0 -1
As of ircu2.10.05 U-lines accept “nick jupes”. In effect, noone but uworld can use the above nicks.
This includes W and X, but most of the nicks are “juped” to stop various nasty exploitations by users taking the nicks.


5.3 Statistics-related commands
5.3.1 m (lowercase)
Gives you a list of commands supported by the server, number of times they've been used, and the bytes consumed by the command.
For commands that havn’t been used, type /raw help

Example:
PRIVMSG 4752355 184344091
NICK 848063 49075863
QUIT 580331 17961034
[...]


Example:
Sending a PRIVMSG between servers. Toma2 speaking in #SoupConspiracy. Everything before PRIVMSG is prefix
:Toma2!MisterL@ppp54.conspir.gov PRIVMSG #SoupConspiracy :The Soup has arrived
For more information about Privmsg, read the IRC RFC, (currently RFC1459) or try out the /debug command in mIRC.

It’s hard to guess the average message-lenght. PRIVMSG, as you can see, consists of much more than the actual msg, but combined with the number of users and the t, p and l-query, we might guess out how much people talk and if a servers' users tend to talk to each other mostly, or is chatting around "out there", because a long prefix is only added while sending outside the server.

You may also use /quote help (4.2.4) to list available commands
5.3.2 l
Shows a table with server-server connections and some people in the act of logging in.

Sample:
Connection SendQ SendM SendKBytes RcveM RcveKBytes Open since
baltimore-r.md.us.undernet.org 121 166840 6592 1043968 49922 000004536
0 1 0 2 0 000000002
0 2 0 3 0 000000025
NickJagger 0 1 0 2 0 000000009

The 2nd line is a server-server connection, the 3 last are people logging in. (USER and PONG havn’t been carried out yet)
ircu previous to 2.10.08 would also show statistics for the ports on your server:
[...]
SanDiego.CA.US.Undernet.org[*.6666] 0 7809826 743927 998848 45499 001529427
SanDiego.CA.US.Undernet.org[*.6667] 0 287381731 24655221 30384980 1297028 001529427
[...]
The 2. line would be the sum for all ports. You can get much of the same info from /stats p (5.3.3)
On even older ircu, port 6667 wasn’t shown, but you could easily find its values when you subtracted the other ports from the sum.

Explanation:
Send M/Q
Sent/Qued messages
Send/Rcve M
Sent/Received messages
Send/Rcve KBytes
Kilobytes sent/received
Open since
Number of seconds it has been open. The other numbers are counted from this moment.

5.3.3 p
Show you the ports this server accepts connections on, and how many is on each. A must when choosing ports :-)

Sample:
[...]
P 6670 8 C active
P 6669 41 C active
P 6668 148 C active
P 6667 354 C active
P 6666 25 C active
P 6665 30 C active
P 6664 23 C active
P 6663 30 C active
P 6662 23 C active
P 6661 9 C active
P 6660 227 C active
P 31337 0 C active
P 7777 144 C active
P 7000 113 C active
P 4000 0 S active
P 1025 0 C active
P 10321 0 C active

C = open for users.
S = open for server-server connections only.

This servers MOTD said ports 6660 to 6670 were open for users. In addition, mIRC lists port 6668, 7000 and 7777 as valid ports for this server. 6667 is the standard IRC port. Sure lagging against the server isn’t a big problem usually, but it’s something appealing about the luxury of having a port all by yourself. :-)

From ircu2.10.10 there’s an option for hiding a port from this listing, so don’t be suprised if the admin keeps the good ports to himself. Ports can also be reserved to ops by setting password on them. (Port 31337 in this example rings a bell?)

stats p can be done remotely:
/stats p servername [mask] will return the 3 first matching ports, or 3 first if no mask.


5.3.4 t (lowercase)
Various statistics about the server.

Example:
accepts 1622557 refused 1590021
unknown commands 17031 prefixes 84
wrong direction 54 empty 660
Client Server
connected 28292 4
bytes sent 2425789.450K 423214.786K
bytes recv 189255.273K 506019.371K


5.3.5 z
shows memory usage and count data structures. What it means to us: More statistics! :-D And many of these are global statistics too. Here you can count how many is set away, number of bans, number of users in whowas-buffer e.t.c. The format is “number(bytes used)”

Example:
Client Local 284(260144) Remote 14619(2865324)
Users 14858(1664320) Invites 7(140)
User channels 31169(623380) Aways 1042(46145)
Attached confs 285(5700)
Conflines 598(40307)
Classes 9(252)
Channels 9661(2451957) Bans 9990(428434)
Channel membrs 31169(623380) invite 7(140)
Whowas users 810(90720) away 11(489)
Whowas array 1000(80000)
Hash: client 26669(106676) chan 16001(64004)
Dbuf blocks 426(867336)
RES table 4096
Structs 81920 IP storage 24624 Name storage 55151
Total: ww 171209 ch 3503911 cl 5465153 co 40307 db 867336
End of /STATS report

Output from /lusers at the same time:
There are 7932 users and 6926 invisible on 42 servers
30 operator(s) online
9661 channels formed
I have 274 clients and 1 servers

Explanation for the statistics:
If you summarize local and remote clients, you get 42 more than the number of users. This is due to the server-server connections beeing counted as clients, but not as users. Conflines and attached confs are configuration lines. the nine classes-lines are the ones retrived with the y-query.

away-messages:
The example above says 1042 people is marked as away, but note that this is slightly misleading, as away-messages isn't exchanged during a rejoin after a netsplit. (Not up to and counting ver 2.10.10 atleast). So sometimes, to find a persons away-message, you need to direct the whois-query to his server, 2.6.

User channels and Channel members:
This is about datastructures, or relations between channel and user.

An example:
You have two users, Nat and Tim. Nat is on channel #a and #b, Tim beeing only on #b. This gives us three user-channel "relations":
"Nat on #a", "Nat on #b" and "Tim on #b". You could also say that the number is the sum of occurences of "user X on channel Y".
These relations are contained in two separate lists, the "User channels" beeing a list of channels the user is on and "Channel members" constituting a list of users the chan has.
Simplified, the lists might be like this:
User channels list: Channel Members list:
NAT #a (Nats' relations) #a NAT (The relations of channel a)
NAT #b #b TIM (The relations of channel b)
TIM #b (Tims') #b NAT

sum: 3 sum: 3
The sum should usually be the same for both.
The lists are used to "channel" data between the users, hence the name channels.
NAT says something in #b, "User channels" verifies she can speak there, the server looks in the "Channel Members" list, sees that TIM is also on #b and channel what NAT said over to TIM.
(I suppose that data like "#b is a secret channel, has this and that topic" is kept in a separate list, and not copied for every member of it, and ditto for the modes of a nick.)

Fun with statistics:
We have 14858 users, 9661 channels and 31169 occurences in each list
This tell us that each user is on average on 2.1 channels at the same time (31169/14858 = 2.1) and that each channel has on average 3.2 users. (31169/9661 = 3.2)

(Yes, the numbers can be different. Imagine an extreme case of a net with thousand channels and 2 users, where one of them has joined all channels, the other is on none. You get “on average there is 1 person on each channel” and “on average a person is on 500 channels”)

5.3.6 w
Access statistics from main served domain.

Example:
-Oslo-R.NO.EU.Undernet.org- Minute Hour Day Yest. YYest. Userload for:
-Oslo-R.NO.EU.Undernet.org- 6.00 6.0 7 0 0 sol.no clients
-Oslo-R.NO.EU.Undernet.org- 565.91 610.3 675 0 0 total clients
-Oslo-R.NO.EU.Undernet.org- 500.36 534.8 640 0 0 total connections

This server is run by the sol company, so they like to keep some statistics about their own users.

5.3.7 M (uppercase)
Various memory-leak statistics.
5.3.8 r and x
Two queries available when the server is in DEBUGMODE. r shows resource usage reports, x shows usage of lists
Not to be confused with R-lines which ircu does not support.

5.3.9 u (lowercase)
Telling you how long the server has been up (since last reboot)

Example:
Server Up 1 days, 7:09:21
Highest connection count: 1087 (1085 clients)

Categories