Re: [analog-help] HELP!!
You probably need to use FILEINCLUDE. To learn more about using this command, the place to go is the documentation page online at http://www.analog.cx/docs/include.html;. Hope that helps, -- Duke Martin Poole wrote: I am a beginner when it comes to your 5.32 software. I am trying to run a request report on specific pages on my intranet. However, it only seems to list the most requested pages, which is not what I want, as they are not the pages I am trying to report on. What do I do? If you require anymore info, do not hesitate to contact me. Many thanks Martin Poole PRO Ltd Address: 26-28 Bedford Row, Holborn, London, WC1R 4HE Tel: 020 7845 4200 Fax: 020 7845 4249 Website: www.PROltd.com Recruiting, retaining and developing outstanding people. This email is confidential and is intended for the addressee(s) only. If you are not the named addressee you may not use it, copy it or disclose it to any other person. If you have received this message in error please contact [EMAIL PROTECTED] Any views or opinions presented are solely those of the originator and do not necessarily represent those of PRO Ltd or any of its affiliates. On the basis that you are the intended recipient, then receipt of this e-mail by you represents your confirmation that you agree, or continue to agree, to be bound by our standard Terms and Conditions applicable to the transaction to which this e-mail relates. If you require a copy (or a replacement copy) of the applicable standard Terms and Conditions please e-mail your request by return. begin:vcard fn:Duke Hillard n:Hillard;Duke org:University of Louisiana at Lafayette;University Computing Support Services adr:;;P.O. Box 42770;Lafayette;LA;70504-2770;USA email;internet:[EMAIL PROTECTED] title:University Webmaster tel;work:337.482.5763 url:http://www.louisiana.edu/ version:2.1 end:vcard
Re: [analog-help] Help on Organisation report
Steven Smith [EMAIL PROTECTED] wrote: I'm producing a Computer output file for use into Report magic. I'm wanting the Organisation report to show the full IP address for each row of unresolved addresses. Right now if I look in report.dat file I see only parts of the IP. (i.e. 12, 63.75, 67.92, or 67.96) How do I get the report to show full hostnames and IP address in the output? The organizations shows how many hits came from a different organization. Analog assumes that all hits that come from a particular IP range are from the organization that owns that IP range. So for example, The Class A address space 12.x.x.x has been assigned to ATT, so Analog totals all requests from any IP address that starts with 12 and assigns it to the 12 Organization. All IP addresses that begin with 63.75 are assigned to Office Max, so Analog groups all hits from that range into a single entry in the Organization report. If you want to see Hostnames or addresses, use the Host Report - the organization report is supposed to report on all hits from an Organization. Aengus + | TO UNSUBSCRIBE from this list: |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | Digest version: http://lists.isite.net/listgate/analog-help-digest/ | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general | List archives: http://www.analog.cx/docs/mailing.html#listarchives +
RE: [analog-help] HELP! Discontinuity in Stats
Hi I'm still having problems with this. Could it be something to with the DNS cache and the HOSTEXCLUDE statements we have. The reason I ask is, I had seen something about clearing the top of the DNS cache file once every so often but I don't think this gets done (though I doubt this is a reason for my problems, just a reason I decided to investigate along this line). I ran two analyses on the same log files using the same config file with the exception that in one, I used the same DNS cache as I have been using and in the other I used a new DNS cache (e.g. set it to a non-existent file so that it would create one). I got different results for successful hits! At the time of the test, I was able to do lookups on all the HOSTEXCLUDEs where I had used an FQDN and I was able to do reverse lookups where I had used an IP. However, there are three wildcarded HOSTEXLCUDES *.subdomain.domain which I couldn't check...? Any ideas? Thanks in advance... Will O'Brien -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Stephen Turner Sent: 08 March 2004 14:33 To: [EMAIL PROTECTED] Subject: Re: [analog-help] HELP! Discontinuity in Stats On Mon, 8 Mar 2004, Will O Brien wrote: Hi, I have analog 5.23 running in linux. I have a very curious problem. I have analog running as a cronjob in the early hours of the morning, it runs once each morning to produce daily figures and once a week to produce weekly figures. The problem is that every now and then, say once every three weeks, the figures don't tie up. The hit count given in the daily stats doesn't match the corresponding hit count given for that day in the weekly stats. If I rerun analog with equivalent config files when I get to work on the Monday, it produces correct results, and it appears that the problem is with the daily stats. Does anyone have any suggestions as to what may be causing this? Maybe the logfiles are being rotated while analog is trying to produce the reports? -- Stephen Turner, Cambridge, UK http://homepage.ntlworld.com/adelie/stephen/ The internet is a reflection of our society. If we do not like what we see, the problem is not to fix the mirror, we have to fix society. (Vint Cerf) +--- +- | TO UNSUBSCRIBE from this list: |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | Digest version: http://lists.isite.net/listgate/analog-help-digest/ | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general | List archives: http://www.analog.cx/docs/mailing.html#listarchives +--- +- + | TO UNSUBSCRIBE from this list: |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | Digest version: http://lists.isite.net/listgate/analog-help-digest/ | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general | List archives: http://www.analog.cx/docs/mailing.html#listarchives +
RE: [analog-help] HELP! Discontinuity in Stats
Turn on debugging. That will tell you which files it read and how many lines were in each. -- Stephen Turner, Cambridge, UKhttp://homepage.ntlworld.com/adelie/stephen/ The internet is a reflection of our society. If we do not like what we see, the problem is not to fix the mirror, we have to fix society. (Vint Cerf) + | TO UNSUBSCRIBE from this list: |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | Digest version: http://lists.isite.net/listgate/analog-help-digest/ | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general | List archives: http://www.analog.cx/docs/mailing.html#listarchives +
Re: [analog-help] HELP! Discontinuity in Stats
On Mon, 8 Mar 2004, Will O Brien wrote: Hi, I have analog 5.23 running in linux. I have a very curious problem. I have analog running as a cronjob in the early hours of the morning, it runs once each morning to produce daily figures and once a week to produce weekly figures. The problem is that every now and then, say once every three weeks, the figures don't tie up. The hit count given in the daily stats doesn't match the corresponding hit count given for that day in the weekly stats. If I rerun analog with equivalent config files when I get to work on the Monday, it produces correct results, and it appears that the problem is with the daily stats. Does anyone have any suggestions as to what may be causing this? Maybe the logfiles are being rotated while analog is trying to produce the reports? -- Stephen Turner, Cambridge, UKhttp://homepage.ntlworld.com/adelie/stephen/ The internet is a reflection of our society. If we do not like what we see, the problem is not to fix the mirror, we have to fix society. (Vint Cerf) + | TO UNSUBSCRIBE from this list: |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | Digest version: http://lists.isite.net/listgate/analog-help-digest/ | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general | List archives: http://www.analog.cx/docs/mailing.html#listarchives +
Re: [analog-help] Help with calculating total traffic from IIS FTP logs
Analog will not calculate both down- and up-load traffic. You can only configure it to do one or the other. A possible solution is to pre-process the log file with a script that reads both fields and combines them into one (or a new one). In general, log files are not the most effective way to measure bandwidth, because they don't include request and header volume. Something like MRTG can be configured to give a more accurate report (although getting it to split an interface for each virtual host is a challenge). -- Jeremy Wadsack Wadsack-Allen Digital Group Adrianna Pinska [EMAIL PROTECTED] (Tuesday, November 04, 2003 7:15 AM): Hello, I am trying to use Analog to calculate total traffic per user, from IIS 5.0 FTP logs. I'm using Analog v 5.91 beta on Windows 2000 professional. The header of the log file looks like this: #Fields: date time c-ip cs-username s-sitename s-computername s-ip s-port cs-method cs-uri-stem cs-uri-query sc-status sc-bytes cs-bytes time-taken cs-version cs-host cs(User-Agent) cs(Cookie) cs(Referer) Here are a few representative lines from the file: 2003-10-18 06:04:17 196.25.19.251 rhodesia MSFTPSVC1 IDEOSPHERE01 196.36.153.48 21 [514]USER rhodesia - 331 0 0 0 FTP - - - - 2003-10-18 08:51:29 196.3.242.158 Xanovia MSFTPSVC1 IDEOSPHERE01 196.36.153.48 21 [523]sent /Xanovia/Template.ascx - 226 1630 0 350 FTP - - - - What I want from Analog is just a user report. Now, when I run Analog on the file with no LOGFORMAT specified, everything is fine except that Analog ignores the sc-bytes and only takes the cs-bytes into account. I want to see the total traffic, so I want the sc-bytes and cs-bytes to be added. I began to experiment with specifying a LOGFORMAT. I discovered that Analog would reject a LOGFORMAT with two instances of %b. so I wanted to see if I could get Analog to read just the sc-bytes or just the cs-bytes, one at a time, planning to combine them in some form later. Here are the LOGFORMATs I tried: LOGFORMAT (%Y-%m-%d %h:%n:%j %s %u %j %j %j %j [%j]%j %r - %C %b %j %t FTP - - - -) (for just the sc-bytes) LOGFORMAT (%Y-%m-%d %h:%n:%j %s %u %j %j %j %j [%j]%j %r - %C %b %j %t FTP - - - -) (for just the cs-bytes). As far as I can see, both of these should work - but if I try either, Analog doesn't recognise the code (%C), and thinks there were no successful requests, and so I get no results. I have checked that what I think are spaces are spaces and not tabs, and I have tried replacing all the spaces in the LOGFORMAT with %w, with no luck I have spent hours looking for a solution to this problem on the web, but I've come up with nothing. Can anyone help? I have heard lots of people mention that they use Analog for FTP log analysis, so I assume there must be a way to get this to work. Thank you for your time, Adrianna Pinska Ideosphere + | TO UNSUBSCRIBE from this list: |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | Digest version: http://lists.isite.net/listgate/analog-help-digest/ | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general | List archives: http://www.analog.cx/docs/mailing.html#listarchives +
Re: [analog-help] Help with Browser Report/Browser Summary
Chris Blackstone [EMAIL PROTECTED] (Tuesday, October 14, 2003 11:10 AM): I'm using Analog 5.91 Beta 1 I want to config the Browser Reports so that Browser Report lists totals by Browser and OS (IE 6.0; Win XP, IE 6.0 Win 98, etc) Browser Summary lists totals by Browser (IE 6.0, IE 5.5, etc) I'm using a combination of BROWALIAS, BROWREPALIAS, and BROWSUMALIAS to attempt to accomplish If I use BROWALIAS I have the Browser Report how I like it, but the Browser Summary lists Browser version and OS version If I use a combo of BROWREPALIAS, and BROWSUMALIAS the stats in the Browser Report are not totaled up, so I have 20 instances of IE 6.0, Win XP for example Any help is greatly appreciated In order to do this you need to use BROWALIAS in such a way that it lists browsers matching an expected user agent string. So the right hand side should look like IE/6.0 (Win XP) or something. This will allow the Browser Summary to still work correctly. Then use BROWREPALIAS to convert to the format you want for display. -- Jeremy Wadsack Wadsack-Allen Digital Group + | TO UNSUBSCRIBE from this list: |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | Digest version: http://lists.isite.net/listgate/analog-help-digest/ | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general | List archives: http://www.analog.cx/docs/mailing.html#listarchives +
Re: [analog-help] Help with reporting on a particular file type
[EMAIL PROTECTED] [EMAIL PROTECTED] (Wednesday, September 24, 2003 11:41 AM): I need help on configuring the reports so I can track a particular file being downloaded. I looked at the anolog.cfg file and I have: TYPEALIAS .exe .exe [Executables] set. What else needs to be set? I know this file has been downloaded more than 20 times, so it should show up??? Well you can use REQINCLUDE to build a report that shown *only* that request. See http://analog.cx/docs/include.html. -- Jeremy Wadsack Wadsack-Allen Digital Group + | TO UNSUBSCRIBE from this list: |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | Digest version: http://lists.isite.net/listgate/analog-help-digest/ | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general | List archives: http://www.analog.cx/docs/mailing.html#listarchives +
Re: [analog-help] help with cfg please
Hi Raj, For the images to work properly add a line like this above LOCALCHARTDIR: IMAGEDIR C:\Program Files\analog 5.32\images\ Also you might want to change the HOSTNAME abcdefgh.. Instead of using wildcards point your LOGFILE C:\WINNT\system32\LogFiles\W3SVC4\*.log instead to specific file and try, then you can move on to wild cards. Ignore this if this isnt a problem. The form could be used to generate the report. Please read help at http://www.analog.cx/docs/form.html Hope this helps. Kalyan. - Original Message - From: raj chahal [EMAIL PROTECTED] Date: Tue, 19 Aug 2003 11:50:26 +0100 To: [EMAIL PROTECTED] Subject: [analog-help] help with cfg please hi there I've just installed, analog but cannot get it to function correctly, could someone help please. I'm looking at reading 1 month at a time and can alter the from to variables manually. Currently I am looking at five days only to simplyfy things. I've noticed a form in the analog 5.30 folder, can this be used? I also cannot get the charts to work. the log files are generated by IIS5. directory of log files : C:\WINNT\system32\LogFiles\W3SVC4 typical filename : ex030301.log snippet from cfg : # Configuration file for analog 5.30 # See http://www.analog.cx/ # # Here are a couple of configuration commands to get you started. Add any more # you like from the Readme. # # Lines starting with # are comments. # # There is a much more extensive configuration file in examples/big.cfg # # If you need a LOGFORMAT command (most people don't -- try it without first!), # it must go here, above the LOGFILE commands. # LOGFILE logfile.log LOGFILE C:\WINNT\system32\LogFiles\W3SVC4\*.log FROM 030301 TO 030305 OUTFILE c:\analog_stats\%Y.%M.html LOCALCHARTDIR c:\analog_stats\charts\%Y.%M. CHARTDIR charts/%Y.%M. HOSTNAME [my organisation] # # You probably don't need to change anything below this until you are # experienced. thanks for your assistance raj + | TO UNSUBSCRIBE from this list: |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | Digest version: http://lists.isite.net/listgate/analog-help-digest/ | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general | List archives: http://www.analog.cx/docs/mailing.html#listarchives + -- __ Sign-up for your own personalized E-mail at Mail.com http://www.mail.com/?sr=signup CareerBuilder.com has over 400,000 jobs. Be smarter about your job search http://corp.mail.com/careers + | TO UNSUBSCRIBE from this list: |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | Digest version: http://lists.isite.net/listgate/analog-help-digest/ | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general | List archives: http://www.analog.cx/docs/mailing.html#listarchives +
Re: [analog-help] help : Internal search query
If I understand what you are asking the command below seems right. However, the command below is for cumulative requests and not for individual requests. In other words, if I have 3 requests for one term, and each request is 150 bytes, then the combined requests total 450 bytes and those requests will be listed on a line in my report because they are all for one term. -- Duke Sachin Bennur(DigitalRayInc) wrote: Hello, I am creating an internal search query report where I want to exclude requests where the byte transferred are less than a certain bytes (say less than 200 bytes). I am using the configuration as, INTSEARCHQUERY ON INTSEARCHQUERYFLOOR 1r INTSEARCHENGINE /xyz/test.cgi name I tried using INTSEARCHQUERYFLOOR 200b This is not giving me the required result. What is the correct way ? Thanks in advance. Sachin. + | TO UNSUBSCRIBE from this list: |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | Digest version: http://lists.isite.net/listgate/analog-help-digest/ | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general | List archives: http://www.analog.cx/docs/mailing.html#listarchives + + | TO UNSUBSCRIBE from this list: |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | Digest version: http://lists.isite.net/listgate/analog-help-digest/ | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general | List archives: http://www.analog.cx/docs/mailing.html#listarchives +
Re: [analog-help] Help with not listed
Glenn Keffer ([EMAIL PROTECTED]; Thursday, March 20, 2003 5:30 PM): I have a large request report that details all the arguments passed to just one file. I was hoping just to get a [not listed: xx] kind of summary of the request arguments for all the one and two hit listings, instead of having to use a REQARGSFLOOR 1r The report generated with that option is just impossible to sort through and I still don't have a total. And I can not use the total listed for accesses to the page in general, as it is used extensively with no arguments passed to it. The only other option I can think of is to output to computer format and then import to a spreadsheet for totals. But that seems like twice the work. Is the [not listed: ] type of count not available for the request arguments (all the indented items) when the floor is raised? [not listed] is not available for sub items or arguments. Your OUTPUT COMPUTER to Spreadsheet is probably your best bet. -- Jeremy Wadsack Wadsack-Allen Digital Group + | TO UNSUBSCRIBE from this list: |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | Digest version: http://lists.isite.net/listgate/analog-help-digest/ | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general | List archives: http://www.analog.cx/docs/mailing.html#listarchives +
Re: [analog-help] Help
Rosemarie ([EMAIL PROTECTED]; Tuesday, February 04, 2003 10:15 AM): I am unable to get into analog.cfg to config the informtion for the sites I wish to moniter. It tells me on screen that there was a fauilt with the download but I have done it 3 times. Hope that you can get me started. All I can suggest is trying to download the file again. You could try another mirror location, (from the list on the download page) just in case the copy you are downloading is bad. I did e.mail Mr Handfield but received a most unhelpful reply. Who is Mr. Handfield? -- Jeremy Wadsack Wadsack-Allen Digital Group + | TO UNSUBSCRIBE from this list: |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | Digest version: http://lists.isite.net/listgate/analog-help-digest/ | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general | List archives: http://www.analog.cx/docs/mailing.html#listarchives +
RE: [analog-help] Help with the BARSTYLE command!
Well. this will teach me to thoroughly look at my analog.cfg file before complaining that something doesn't work. The default setting for BARSTYLE is already there, the 'c' needs to be changed to a 'h'... SORRY Regarding the automated script or batch file for un gz...ing the logs, easyspace tell me to enquire about a bourne shell or perl script, but as I am not a programmer, does any one have a Windows, script or batch file which will do the same job, i.e. Move or copy the attachment, unzip it and then run analog! Sorry about the unnecessary time wasting, reminds me of the fella who called 999 (911 in the US) to find out how to spell necessary on his CV Arthur McBryan Webmaster http://www.hcmr-photos.org.uk All emails are scanned with Norton AV 2003 -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Arthur McBryan Sent: 15 November 2002 20:33 To: Analog-Help@Lists. Isite. Net Subject: [analog-help] Help with the BARSTYLE command! I put in the command BARSTYLE h and still see the plain old red barstyle in my report. Is there something else I should be doing please? Also, has any one got a script or batch file that will run in Windows 98 to detach the log sent in my mail every morning please. Many thanks Arthur McBryan Webmaster http://www.hcmr-photos.org.uk All emails are scanned with Norton AV 2003 + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help@lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 + + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help@lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 +
Re: [analog-help] Help running Analog for the first time, Linux
On Thu, 31 Oct 2002, Jeremy Wadsack wrote: Rick Root ([EMAIL PROTECTED]; Thursday, October 31, 2002 10:19 AM): I just installed the latest version of Analog on my RedHat Linux 7.2 server. I can't for the life of me figure out how to use it. I've edited the analog.cfg but when I run it from the command line, it seems to be completely ignoring anything that's in there. Almost as if it's not reading the config file. Are there command line options or something that I'm missing? I've looked in the FAQ and in the documentation.. maybe I'm just not seeing it, and if so I apologize, but I definately need some help. Here is my analog.cfg UNCOMPRESS *.gz,*.Z /usr/bin/zcat LOGFILE access200209.log.gz OUTFILE ../www/reports/report200209.html HOSTNAME Wake Internet IMAGEDIR /analog/images/ It is in the current directory where I am trying to run analog. I've also made changes to the analog.cfg that is in the directory where I installed analog (/usr/local/analog).. Neither of them seem to have any effect. Analog usually reads the analog.cfg file located in the directory where analog resides. This can be changed in the anlghead.h file before you compile it. If you are not sure use analog -settings to have it tell you what files it is reading. At a guess, the RedHat version might put the config file in /etc instead of in the analog dir. But as Jeremy says, you can find out with -settings. You can use a different config file with +gmy.cfg (and -G if you want to ignore the default config file). -- Stephen Turner, Cambridge, UKhttp://homepage.ntlworld.com/adelie/stephen/ Reserve your 2 hour delivery time, which means you'll see the same special offers as you would instore - Sainsbury's internet shopping instructions + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help;lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 +
Re: [analog-help] Help a newbie again !!
Sibi John ([EMAIL PROTECTED]; Friday, November 01, 2002 9:05 AM): 1.) Is there any way to get logs for a particular day on the fly . say by choosing a particular day on the report itself.?? i.e not going to analog.cfg to change dates ?? You can use -F/-T from the command line. These are equivalent to FROM and TO in a config file. Also for the faliure report or say for the report request. is there any way in which i could customize the failure report so that i could get the username / ip address / access time . along with file name , number of requests.. which i already get in the report ? As Aengus just said: If a file has been requested 1,000 times do you want 1,000 IP addresses listed against it? http://www.analog.cx/docs/faq.html#faq128 You can always generate a full report for a single file by using FILEINCLUDE filename. The Host Report in this case will just list the Hosts that requested that file. But you can only report on a single file at a time. 2.) On a different note, i am not sure if this is possible but has anybody setup analog to provide graphs to availability and uptime for a server. The web server log files do not really provide this information. You could look at all the requests and, using some heuristic, figure out when there have been no requests for a long period of time (for some definition of long). But that's just an estimate. And web/browser caches and such could affect this. If you really want availability and uptime, use a server monitoring solution like the one included in PureSecure, http://www.demarc.com/. -- Jeremy Wadsack Wadsack-Allen Digital Group + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help;lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 +
RE: [analog-help] Help a newbie again !!
I totally understand your point. But the main reason i want to do this is say if i needed to see if there were any hacker intrusion attempts on my site today, I would like see who was making what kind of requests at what time, and not just on a particular file, any requests to my website.. is something like that possible in analog. Sibi John. Systems Adminstrator. Deerfield Capital Management. ~ -Original Message- From: Jeremy Wadsack [mailto:jwadsack;wadsack-allen.com] Sent: Friday, November 01, 2002 12:27 PM To: [EMAIL PROTECTED] Subject: Re: [analog-help] Help a newbie again !! Sibi John ([EMAIL PROTECTED]; Friday, November 01, 2002 9:05 AM): 1.) Is there any way to get logs for a particular day on the fly . say by choosing a particular day on the report itself.?? i.e not going to analog.cfg to change dates ?? You can use -F/-T from the command line. These are equivalent to FROM and TO in a config file. Also for the faliure report or say for the report request. is there any way in which i could customize the failure report so that i could get the username / ip address / access time . along with file name , number of requests.. which i already get in the report ? As Aengus just said: If a file has been requested 1,000 times do you want 1,000 IP addresses listed against it? http://www.analog.cx/docs/faq.html#faq128 You can always generate a full report for a single file by using FILEINCLUDE filename. The Host Report in this case will just list the Hosts that requested that file. But you can only report on a single file at a time. 2.) On a different note, i am not sure if this is possible but has anybody setup analog to provide graphs to availability and uptime for a server. The web server log files do not really provide this information. You could look at all the requests and, using some heuristic, figure out when there have been no requests for a long period of time (for some definition of long). But that's just an estimate. And web/browser caches and such could affect this. If you really want availability and uptime, use a server monitoring solution like the one included in PureSecure, http://www.demarc.com/. -- Jeremy Wadsack Wadsack-Allen Digital Group + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help;lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 + + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help;lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 +
Re: [analog-help] Help a newbie again !!
Again, let me point you to PureSecure, http://www.demarc.com/. It does intrusion detection, system monitoring, etc. Analog is also useful for that, but not so much as a monitoring tool. If you do find something suspicious, you can use Analog to drill through the logs, isolating hosts (HOSTINCLUDE), periods (FROM/TO) and files (FILEINCLUDE) until you get the reports you need. This is a multi-step process. Of course you can get basic details from Analog: a large amount of traffic in a short time in the Hourly, Quarter-Hourly or Five-Minute reports; a host that is more active than others; repeated failed attempts to access secured areas of your site; etc. -- Jeremy Wadsack Wadsack-Allen Digital Group Sibi John ([EMAIL PROTECTED]; Friday, November 01, 2002 11:51 AM): I totally understand your point. But the main reason i want to do this is say if i needed to see if there were any hacker intrusion attempts on my site today, I would like see who was making what kind of requests at what time, and not just on a particular file, any requests to my website.. is something like that possible in analog. Sibi John. Systems Adminstrator. Deerfield Capital Management. ~ -Original Message- From: Jeremy Wadsack [mailto:jwadsack;wadsack-allen.com] Sent: Friday, November 01, 2002 12:27 PM To: [EMAIL PROTECTED] Subject: Re: [analog-help] Help a newbie again !! Sibi John ([EMAIL PROTECTED]; Friday, November 01, 2002 9:05 AM): 1.) Is there any way to get logs for a particular day on the fly . say by choosing a particular day on the report itself.?? i.e not going to analog.cfg to change dates ?? You can use -F/-T from the command line. These are equivalent to FROM and TO in a config file. Also for the faliure report or say for the report request. is there any way in which i could customize the failure report so that i could get the username / ip address / access time . along with file name , number of requests.. which i already get in the report ? As Aengus just said: If a file has been requested 1,000 times do you want 1,000 IP addresses listed against it? http://www.analog.cx/docs/faq.html#faq128 You can always generate a full report for a single file by using FILEINCLUDE filename. The Host Report in this case will just list the Hosts that requested that file. But you can only report on a single file at a time. 2.) On a different note, i am not sure if this is possible but has anybody setup analog to provide graphs to availability and uptime for a server. The web server log files do not really provide this information. You could look at all the requests and, using some heuristic, figure out when there have been no requests for a long period of time (for some definition of long). But that's just an estimate. And web/browser caches and such could affect this. If you really want availability and uptime, use a server monitoring solution like the one included in PureSecure, http://www.demarc.com/. + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help;lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 +
Re: [analog-help] Help running Analog for the first time, Linux
Rick Root ([EMAIL PROTECTED]; Thursday, October 31, 2002 10:19 AM): I just installed the latest version of Analog on my RedHat Linux 7.2 server. I can't for the life of me figure out how to use it. I've edited the analog.cfg but when I run it from the command line, it seems to be completely ignoring anything that's in there. Almost as if it's not reading the config file. Are there command line options or something that I'm missing? I've looked in the FAQ and in the documentation.. maybe I'm just not seeing it, and if so I apologize, but I definately need some help. Here is my analog.cfg UNCOMPRESS *.gz,*.Z /usr/bin/zcat LOGFILE access200209.log.gz OUTFILE ../www/reports/report200209.html HOSTNAME Wake Internet IMAGEDIR /analog/images/ It is in the current directory where I am trying to run analog. I've also made changes to the analog.cfg that is in the directory where I installed analog (/usr/local/analog).. Neither of them seem to have any effect. Analog usually reads the analog.cfg file located in the directory where analog resides. This can be changed in the anlghead.h file before you compile it. If you are not sure use analog -settings to have it tell you what files it is reading. When you run it it should right a report.html file that has an updated report. At least you can see if the modified date changes when you run. -- Jeremy Wadsack Wadsack-Allen Digital Group + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help;lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 +
Re: [analog-help] Help!
-- Jeremy Wadsack Wadsack-Allen Digital Group Gayle Coston ([EMAIL PROTECTED]; Tuesday, October 22, 2002 7:35 AM): -- Background : We are using Ezproxy to authenticate users for remote access of databases. Ezproxy is set up to pass through the on campus computers because of IP addresses. Off campus users get an authentication screen before they are passed onto the databases. What we want to do is count the number of users being sent to the different databases. (i.e. # going to LexisNexis, # going to InfoTrac Health, ) We run the Ezproxy software on a Windows 2000 computer. The Analog software is on the same computer. The campus is a conglomerate of Window computers, running W98, WNT and W2000. There are also some Macs on campus. -- In trying to set up Analog to produce the desired results I read all the different help files and changed the config file to (what I thought would) produce the desired results (i.e. the Results Report.) But each time I click on the analog icon to run the report, a dos screen pops up real fast and then disappears. Then I would go look at the results file. The first several times all I got was the results from the sample file. I went back and looked at the config file, and realized I had spelt file wrong in one place. I corrected that and reran the program. At least now I do not get the sample data, what I get is the beginning of the Report and no results whatsoever. 1) Do I have the config file set up correctly to give me counts of who is going to what database? 2) Do I need to set up the config file differently. I read the documentation files and I think I have it set up to produce the results I wanted, but I might be wrong. 3) Can this software even do what I am asking for? I am including at the end of the email a copy of our config file. If anyone can help me config it to produce the desired results I will be forever greatful. Margo Margo Pierson Systems/Government Documents Librarian Magale Library Southern Arkansas University 100 E. University Magnolia, AR 71754 870-235-4177 870-235-5018 (fax) # Configuration file for analog 5.24 # See http://www.analog.cx/ # # Here are a couple of configuration commands to get you started. Add any more # you like from the Readme. # # Lines starting with # are comments. # # There is a much more extensive configuration file in examples/big.cfg # # If you need a LOGFORMAT command (most people don't -- try it without first!), # it must go here, above the LOGFILE commands. # Where you tell the program to find the data # LOGFILE logfile.log LOGFILE August.log # LOGFILE C:\old\logs\access_log.* # This is where you tell the program where to put the output file OUTFILE August.html OUTPUT HTML LANGUAGE ENGLISH # Puts this at the top of the report HOSTNAME Magale Library #To view the files by number of requests (i.e. Request Report) # REQINCLUDE pages REQUEST ON REQCHART OFF REQCOLS R REQEXCLUDE * REQEXCLUDE *.zip REQEXCLUDE *.gz REQEXCLUDE *.Z REQEXCLUDE *.pdf REQINCLUDE *.html REQINCLUDE *.htm # REQLINKINCLUDE pages REFLINKINCLUDE * REQLINKEXCLUDE *.zip REQLINKEXCLUDE *.pdf REDIRREFLINKINCLUDE * FAILREFLINKINCLUDE * # UNCOMPRESS *.gz,*.Z gzip -cd # SUBBROW */* # SUBTYPE *.gz,*.Z # OSCHARTEXPAND Windows # Add whichever of these types of pages you have on your server, or others. # PAGEINCLUDE *.shtml # PAGEINCLUDE *.asp # PAGEINCLUDE *.jsp # PAGEINCLUDE *.cfm # PAGEINCLUDE *.pl # PAGEINCLUDE *.php # More SEARCHENGINE commands can be found at # http://www.analog.cx/helpers/#conffiles SEARCHENGINE http://*altavista.*/* q SEARCHENGINE http://*yahoo.*/* p SEARCHENGINE http://*google.*/* q SEARCHENGINE http://*lycos.*/* query # SEARCHENGINE http://*aol.*/* query SEARCHENGINE http://*excite.*/* search # SEARCHENGINE http://*go2net.*/* general # SEARCHENGINE http://*metacrawler.*/* general SEARCHENGINE http://*msn.*/* MT # SEARCHENGINE http://*hotbot.com/* MT # SEARCHENGINE http://*netscape.*/* search # SEARCHENGINE http://*looksmart.*/* key SEARCHENGINE http://*infoseek.*/* qt # SEARCHENGINE http://*webcrawler.*/* search,searchText # SEARCHENGINE http://*goto.*/* Keywords # SEARCHENGINE http://*snap.*/* keyword SEARCHENGINE http://*dogpile.*/* q # SEARCHENGINE http://*askjeeves.*/* ask # SEARCHENGINE http://*ask.*/* ask # SEARCHENGINE http://*aj.*/* ask # SEARCHENGINE http://*directhit.*/* qry # SEARCHENGINE http://*alltheweb.*/* query SEARCHENGINE http://*northernlight.*/* qr # SEARCHENGINE http://*nlsearch.*/* qr # SEARCHENGINE http://*dmoz.*/* search # SEARCHENGINE http://*newhoo.*/* search # SEARCHENGINE http://*netfind.*/* query,search,s # SEARCHENGINE http://*/netfind* query # SEARCHENGINE http://*/pursuit query # ROBOTINCLUDE REGEXPI:robot # ROBOTINCLUDE REGEXPI:spider #
Re: [analog-help] Help!
(Sorry about the previous empty response -- sticky fingers!) You should start by just producing a report from your log files. Then you can work at fine-tuning it to get the results you want. On Windows, it can be very helpful to add the ERRFILE command so you can see what error and warning messages Analog is producing. This will help you tune the file to get results. See http://analog.cx/docs/debug.html#ERRFILE If you are running Analog on Proxy logs you may have to write a custom LOGFORMAT line for it to parse the logs. See http://analog.cs/docs/logfmt.html. You haven't define what distinguishes the connections to the databases. Those are probably some kind of request detail. Once you have all the setup working, the Request Report will show you how many requests were made to each requested file. You can use the FILEINCLUDE command to filter the report to only include the requests you want to monitor. See http://analog.cs/docs/include.html. If you want to know the number of unique hosts that requested each file, then you'll have to run a separate report for each file using just that FILEEXCLUDE statement and then collect the results yourself (or with a Perl script or something). See http://analog.cx/docs/faq.html#faq128. If you want to know how many distinct users (rather than distinct hosts) visited, you can't accurately count that without a state system (which HTTP does not provide). See http://analog.cx/docs/webworks.html. -- Jeremy Wadsack Wadsack-Allen Digital Group Gayle Coston ([EMAIL PROTECTED]; Tuesday, October 22, 2002 7:35 AM): -- Background : We are using Ezproxy to authenticate users for remote access of databases. Ezproxy is set up to pass through the on campus computers because of IP addresses. Off campus users get an authentication screen before they are passed onto the databases. What we want to do is count the number of users being sent to the different databases. (i.e. # going to LexisNexis, # going to InfoTrac Health, ) We run the Ezproxy software on a Windows 2000 computer. The Analog software is on the same computer. The campus is a conglomerate of Window computers, running W98, WNT and W2000. There are also some Macs on campus. -- In trying to set up Analog to produce the desired results I read all the different help files and changed the config file to (what I thought would) produce the desired results (i.e. the Results Report.) But each time I click on the analog icon to run the report, a dos screen pops up real fast and then disappears. Then I would go look at the results file. The first several times all I got was the results from the sample file. I went back and looked at the config file, and realized I had spelt file wrong in one place. I corrected that and reran the program. At least now I do not get the sample data, what I get is the beginning of the Report and no results whatsoever. 1) Do I have the config file set up correctly to give me counts of who is going to what database? 2) Do I need to set up the config file differently. I read the documentation files and I think I have it set up to produce the results I wanted, but I might be wrong. 3) Can this software even do what I am asking for? I am including at the end of the email a copy of our config file. If anyone can help me config it to produce the desired results I will be forever greatful. Margo Margo Pierson Systems/Government Documents Librarian Magale Library Southern Arkansas University 100 E. University Magnolia, AR 71754 870-235-4177 870-235-5018 (fax) # Configuration file for analog 5.24 # See http://www.analog.cx/ # # Here are a couple of configuration commands to get you started. Add any more # you like from the Readme. # # Lines starting with # are comments. # # There is a much more extensive configuration file in examples/big.cfg # # If you need a LOGFORMAT command (most people don't -- try it without first!), # it must go here, above the LOGFILE commands. # Where you tell the program to find the data # LOGFILE logfile.log LOGFILE August.log # LOGFILE C:\old\logs\access_log.* # This is where you tell the program where to put the output file OUTFILE August.html OUTPUT HTML LANGUAGE ENGLISH # Puts this at the top of the report HOSTNAME Magale Library #To view the files by number of requests (i.e. Request Report) # REQINCLUDE pages REQUEST ON REQCHART OFF REQCOLS R REQEXCLUDE * REQEXCLUDE *.zip REQEXCLUDE *.gz REQEXCLUDE *.Z REQEXCLUDE *.pdf REQINCLUDE *.html REQINCLUDE *.htm # REQLINKINCLUDE pages REFLINKINCLUDE * REQLINKEXCLUDE *.zip REQLINKEXCLUDE *.pdf REDIRREFLINKINCLUDE * FAILREFLINKINCLUDE * # UNCOMPRESS *.gz,*.Z gzip -cd # SUBBROW */* # SUBTYPE *.gz,*.Z # OSCHARTEXPAND Windows # Add whichever of these types of pages you have on your server, or others. #
RE: [analog-help] Help!
Have you tried # LOGFILE access_log LOGFILE C:\Documents and Settings\dmg.HHR\Desktop\Analog\analog 5.2 \logs as # comments out the line? From: David M. Grub [EMAIL PROTECTED] Reply-To: [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: RE: [analog-help] Help! Date: Thu, 10 Oct 2002 16:41:11 -0400 Duke, I wasn't sure which line you were suggesting I change. I assume you meant the first line? This is exactly the way I have it configured at this moment and it is creating the Report.html with nothing in it. LOGFILE access_log # LOGFILE C:\Documents and Settings\dmg.HHR\Desktop\Analog\analog 5.24\logs OUTFILE Report.html HOSTNAME [my organisation] Might it have something to do with the file not having an extenstion? I know there is something in the file because it is over 7 MB in size. I have messing around with this all day and think I have the basic understanding of how to configure things. I just can't get it to spit anything out in the report it generates. I'm leaving for the day, so I will respond to any other questions or comments tomorrow. Thanks. -Original Message- From: [EMAIL PROTECTED] [mailto:owner-analog-help;lists.isite.net]On Behalf Of Duke Hillard Sent: Thursday, October 10, 2002 4:06 PM To: [EMAIL PROTECTED] Subject: Re: [analog-help] Help! Have you tried LOGFILE C:\Documents and Settings\dmg.HHR\Desktop\Analog\analog 5.24\logs\access_log -- Duke David M. Grub wrote: I am new to using Analog and need some help. I downloaded and installed Analog 5.24 for Windows. I use a Windows2000 PC on a network with a Windows 2000 server. I also downloaded Report Magic, but haven't messed with that yet. I used an FTP program to import our web log file (named access_log) from /logs/web/ on our ISP's server. It is simply a file named access_log showing no extension. I have the file sitting in a folder named logs I created within the Analog folder which is located on my desktop. The path of the file would be C:\Documents and Settings\dmg.HHR\Desktop\Analog\analog 5.24\logs\access_log. I use the analog.cfg file as is with the following exceptions... LOGFILE access_log # LOGFILE C:\Documents and Settings\dmg.HHR\Desktop\Analog\analog 5.24\logs When I execute the program, it creates the Report.html file, but there is really no information in it. I will paste the contents of the report below this line. What am I doing wrong? Web Server Statistics for [my organisation]Program started at Thu-10-Oct-2002 15:27. --- - General Summary (Go To: Top: General Summary) This report contains overall statistics. Successful requests: 0 --- - This analysis was produced by analog 5.24. Running time: Less than 1 second. (Go To: Top: General Summary) David M. Grub Assistant Administrator Handler Henning and Rosenberg 1300 Linglestown Road Harrisburg, PA 17110 (717) 238-2000 [EMAIL PROTECTED] mailto:davidg;hhrlaw.com This message contains information which may be confidential and privileged. Unless you are the addressee (or authorized to receive for the addressee), you may not use, copy or disclose to anyone the message or any information contained in the message. If you have received the message in error, please advise the sender by replying to [EMAIL PROTECTED] mailto:davidg;hhrlaw.com and deleting the message. Thank you very much. + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help;lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 + + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help;lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 + + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help;lists.isite.net/ |http
Re: [analog-help] Help!
Have you tried LOGFILE C:\Documents and Settings\dmg.HHR\Desktop\Analog\analog 5.24\logs\access_log -- Duke David M. Grub wrote: I am new to using Analog and need some help. I downloaded and installed Analog 5.24 for Windows. I use a Windows2000 PC on a network with a Windows 2000 server. I also downloaded Report Magic, but haven't messed with that yet. I used an FTP program to import our web log file (named access_log) from /logs/web/ on our ISP's server. It is simply a file named access_log showing no extension. I have the file sitting in a folder named logs I created within the Analog folder which is located on my desktop. The path of the file would be C:\Documents and Settings\dmg.HHR\Desktop\Analog\analog 5.24\logs\access_log. I use the analog.cfg file as is with the following exceptions... LOGFILE access_log # LOGFILE C:\Documents and Settings\dmg.HHR\Desktop\Analog\analog 5.24\logs When I execute the program, it creates the Report.html file, but there is really no information in it. I will paste the contents of the report below this line. What am I doing wrong? Web Server Statistics for [my organisation]Program started at Thu-10-Oct-2002 15:27. General Summary (Go To: Top: General Summary) This report contains overall statistics. Successful requests: 0 This analysis was produced by analog 5.24. Running time: Less than 1 second. (Go To: Top: General Summary) David M. Grub Assistant Administrator Handler Henning and Rosenberg 1300 Linglestown Road Harrisburg, PA 17110 (717) 238-2000 [EMAIL PROTECTED] mailto:[EMAIL PROTECTED] This message contains information which may be confidential and privileged. Unless you are the addressee (or authorized to receive for the addressee), you may not use, copy or disclose to anyone the message or any information contained in the message. If you have received the message in error, please advise the sender by replying to [EMAIL PROTECTED] mailto:[EMAIL PROTECTED] and deleting the message. Thank you very much. + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help@lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 + + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help@lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 +
RE: [analog-help] Help!
Duke, I wasn't sure which line you were suggesting I change. I assume you meant the first line? This is exactly the way I have it configured at this moment and it is creating the Report.html with nothing in it. LOGFILE access_log # LOGFILE C:\Documents and Settings\dmg.HHR\Desktop\Analog\analog 5.24\logs OUTFILE Report.html HOSTNAME [my organisation] Might it have something to do with the file not having an extenstion? I know there is something in the file because it is over 7 MB in size. I have messing around with this all day and think I have the basic understanding of how to configure things. I just can't get it to spit anything out in the report it generates. I'm leaving for the day, so I will respond to any other questions or comments tomorrow. Thanks. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Duke Hillard Sent: Thursday, October 10, 2002 4:06 PM To: [EMAIL PROTECTED] Subject: Re: [analog-help] Help! Have you tried LOGFILE C:\Documents and Settings\dmg.HHR\Desktop\Analog\analog 5.24\logs\access_log -- Duke David M. Grub wrote: I am new to using Analog and need some help. I downloaded and installed Analog 5.24 for Windows. I use a Windows2000 PC on a network with a Windows 2000 server. I also downloaded Report Magic, but haven't messed with that yet. I used an FTP program to import our web log file (named access_log) from /logs/web/ on our ISP's server. It is simply a file named access_log showing no extension. I have the file sitting in a folder named logs I created within the Analog folder which is located on my desktop. The path of the file would be C:\Documents and Settings\dmg.HHR\Desktop\Analog\analog 5.24\logs\access_log. I use the analog.cfg file as is with the following exceptions... LOGFILE access_log # LOGFILE C:\Documents and Settings\dmg.HHR\Desktop\Analog\analog 5.24\logs When I execute the program, it creates the Report.html file, but there is really no information in it. I will paste the contents of the report below this line. What am I doing wrong? Web Server Statistics for [my organisation]Program started at Thu-10-Oct-2002 15:27. --- - General Summary (Go To: Top: General Summary) This report contains overall statistics. Successful requests: 0 --- - This analysis was produced by analog 5.24. Running time: Less than 1 second. (Go To: Top: General Summary) David M. Grub Assistant Administrator Handler Henning and Rosenberg 1300 Linglestown Road Harrisburg, PA 17110 (717) 238-2000 [EMAIL PROTECTED] mailto:[EMAIL PROTECTED] This message contains information which may be confidential and privileged. Unless you are the addressee (or authorized to receive for the addressee), you may not use, copy or disclose to anyone the message or any information contained in the message. If you have received the message in error, please advise the sender by replying to [EMAIL PROTECTED] mailto:[EMAIL PROTECTED] and deleting the message. Thank you very much. + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help@lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 + + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help@lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 + + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help@lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 +
RE: [analog-help] Help!
On Thu, 10 Oct 2002, David M. Grub wrote: Duke, I wasn't sure which line you were suggesting I change. I assume you meant the first line? This is exactly the way I have it configured at this moment and it is creating the Report.html with nothing in it. Run analog from the DOS command prompt. Then you will be able to see any errors or warnings. Or alternatively, put the ERRFILE command at the top of your configuration file to redirect errors and warnings to a file. -- Stephen Turner, Cambridge, UKhttp://homepage.ntlworld.com/adelie/stephen/ This is Henman's 8th Wimbledon, and he's only lost 7 matches. BBC, 2/Jul/01 + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help@lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 +
Re: [analog-help] Help: How can I show all lines in general report
On Tue, 10 Sep 2002, MARCOS RODRIGUEZ ALVAREZ wrote: Hi, I need the output file to show all lines in general report, that is For example if Succeful Requests is 0 , the output has to show me x SR 0 If ther isn't successful requests the general report don't show that line, and I need it!! But I can't do that, Why?? The Computer Readable Output shows exactly the same lines as the HTML output would show. Of course, you can edit the analog source, or add the missing lines yourself. But I don't see why you need it anyway -- maybe your post-processing program should be more flexible? -- Stephen Turner, Cambridge, UKhttp://homepage.ntlworld.com/adelie/stephen/ This is Henman's 8th Wimbledon, and he's only lost 7 matches. BBC, 2/Jul/01 + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help@lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 +
Re: [analog-help] Help with dates
Mark, You can specify as many or as few logfiles as you require. You can name files individually and/or use regular expressions. The documentation has a page whose sole topic is choosing a logfile at http://www.analog.cx/docs/logfile.html;. -- Duke Brindley, Mark wrote: I'm using the FROM -00-00-07 and TO 00-00-00 tags to analyse data for the previous week from our proxy logs. This works okay but the problem is I have about 2000 log files in there (all our proxy servers globally for the last year). I don't want to trawl through all these to get the last 7 days worth of data as it takes forever.. Anyone know of an easy way to set the LOGFILE line to only examine the physical log files for the previous week using Perl? + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help@lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 +
Re: [analog-help] Help on request report!
Hello everyone, Thanks Jeremy and Aengus for the help on my query on request report. Thanks for the info on REQFLOOR command. I have two queries. 1. Can I extract %u against various urls visited using analog?? I am in the porcess of creating a PERL program to extract relevant info from the log file . But it is so huge and there are so many multitude of lines with just one visit to apage. Can anyone give me a clue as to how this can be sorted out?? 2 I need more customisation of the request report. What I am aiming for is all of the following entries to be combined all of these requests to be totalled as just one line in line with 'infotrac' in the request report. http://web4.infotrac.galegroup.com:80/itw/infomark/46/787/24375147w4/purl=rc1_biim_0_a85363545dyn=10!xrn_1_0_a85363545 http://web7.infotrac.galegroup.com:80/itw/infomark/271/965/21688166w7/purl=rc1_cdb_0_a67185369dyn=13!xrn_12_0_a67185369 http://web6.infotrac.galegroup.com:80/itw/infomark/29/721/23214322w6/42!lnk_a11246797+271+painting_transportation http://web4.infotrac.galegroup.com:80/itw/infomark/648/350/24378217w4/purl=rc1_cdb_0_a85059668dyn=14!xrn_151_0_a85059668 http://ezproxy.lib.swin.edu.au:80/login?url=http://infotrac.galegroup.com/itweb/swinburne1 http://ezproxy.lib.swin.edu.au:80/login?url=http://infotrac.apla.galegroup.com/itw/infomark/542/533/15291049w4/purl=rc1_EIM_0_A18320023dyn=3!xrn_3_0_A18320023?sw_aep=swinburne1 Do I understand correctly from the document that I can do this with one command REQALIAS http://*/*.infotrac.*/* http://infotrac.com I tried doing this but I am not sure it is working. Do I have to use a FILEALIAS as well before I do this. Also the use of * does this have the usual wild card implication or do I have to put a * for each of the subsections of the above lines. Any clue on the above will be much appreciated. Uma --- Jeremy Wadsack [EMAIL PROTECTED] wrote: Aengus ([EMAIL PROTECTED]; Friday, June 21, 2002 2:07 AM): Jeremy Wadsack [EMAIL PROTECTED] wrote: uma mahadevan ([EMAIL PROTECTED]; Thursday, June 20, 2002 4:58 PM): Many thanks for your mail on my query. Let me make the point on request report clear, As you know, by default, the analog generates request report displaying those files with more than 20 requests to them. Please refer to the first sentence as a title to the request report. My aim is to change this number 20 to something else by customising the request report. Is this possible?? Easily, you need to change the REQFLOOR value. See http://www.analog.cx/docs/othreps.html#othCOLS for details on the *COLS commands. Or the *FLOOR commands at http://www.analog.cx/docs/othreps.html#FLOOR Oops! Yeah, that's what I meant. Thanks, -- Jeremy Wadsack Wadsack-Allen Digital Group + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to | http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at | http://www.mail-archive.com/analog-help@lists.isite.net/ | http://lists.isite.net/listgate/analog-help/archives/ | http://www.tallylist.com/archives/index.cfm/mlist.7 + __ Do You Yahoo!? Yahoo! - Official partner of 2002 FIFA World Cup http://fifaworldcup.yahoo.com + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help@lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 +
Re: [analog-help] Help on request report!
Jeremy Wadsack [EMAIL PROTECTED] wrote: uma mahadevan ([EMAIL PROTECTED]; Thursday, June 20, 2002 4:58 PM): Many thanks for your mail on my query. Let me make the point on request report clear, As you know, by default, the analog generates request report displaying those files with more than 20 requests to them. Please refer to the first sentence as a title to the request report. My aim is to change this number 20 to something else by customising the request report. Is this possible?? Easily, you need to change the REQFLOOR value. See http://www.analog.cx/docs/othreps.html#othCOLS for details on the *COLS commands. Or the *FLOOR commands at http://www.analog.cx/docs/othreps.html#FLOOR Aengus + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help@lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 +
Re: [analog-help] Help on request report!
Aengus ([EMAIL PROTECTED]; Friday, June 21, 2002 2:07 AM): Jeremy Wadsack [EMAIL PROTECTED] wrote: uma mahadevan ([EMAIL PROTECTED]; Thursday, June 20, 2002 4:58 PM): Many thanks for your mail on my query. Let me make the point on request report clear, As you know, by default, the analog generates request report displaying those files with more than 20 requests to them. Please refer to the first sentence as a title to the request report. My aim is to change this number 20 to something else by customising the request report. Is this possible?? Easily, you need to change the REQFLOOR value. See http://www.analog.cx/docs/othreps.html#othCOLS for details on the *COLS commands. Or the *FLOOR commands at http://www.analog.cx/docs/othreps.html#FLOOR Oops! Yeah, that's what I meant. Thanks, -- Jeremy Wadsack Wadsack-Allen Digital Group + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help@lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 +
Re: [analog-help] Help on request report!
uma mahadevan ([EMAIL PROTECTED]; Thursday, June 20, 2002 4:58 PM): Jeremy, Many thanks for your mail on my query. Let me make the point on request report clear, As you know, by default, the analog generates request report displaying those files with more than 20 requests to them. Please refer to the first sentence as a title to the request report. My aim is to change this number 20 to something else by customising the request report. Is this possible?? Easily, you need to change the REQFLOOR value. See http://www.analog.cx/docs/othreps.html#othCOLS for details on the *COLS commands. -- Jeremy Wadsack Wadsack-Allen Digital Group + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help@lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 +
Re: [analog-help] help with multiple reports
On Wed, 29 May 2002, Beth Juhl wrote: Hello: We are just setting up Analog and so far everything is running quite smoothly. Considering that I am not much of a techie, that is quite a testimonial! I am trying to find a simple way to configure Analog to give use weekly reports of on-campus and off-campus activity, using HOSTEXCLUDE and HOSTINCLUDE. I have searched the list archives but have not found what I think we may need to do: is there a way to run two *separate* Analog reports each week, one including our campus IP ranges and one excluding them? Or am I making this harder than it needs to be? Thank you in advance for your help and for such a wonderful resource. It can only produce one report per run. So you just need to run analog twice, using two different configuration files. -- Stephen Turner, Cambridge, UKhttp://homepage.ntlworld.com/adelie/stephen/ This is Henman's 8th Wimbledon, and he's only lost 7 matches. BBC, 2/Jul/01 + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help@lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 +
Re: [analog-help] help
Gianni Accogli ([EMAIL PROTECTED]):
Hi,
i use analog 5.21-1 and i have this problem when i start it:
analog: Warning L: Large number of corrupt lines in logfile
/home/sites/site77/web/weblogs/access.log: turn debugging on or try different
LOGFORMAT in my httpd.conf is this:
LogFormat %h %l %u %t \%r\ %s %b \%{Referer}i\ %{User-Agent}i\ combined
There is a problem with this format. In fact Apache shouldn't even
process this line. There's no trailing quote to match the opening one.
Usually 'combined' format is defined like this:
LogFormat %h %l %u %t \%r\ %s %b \%{Referer}i\ \%{User-Agent}i\ combined
If you have actually used that format (and, for some reason, Apache
accepted if) you may have trouble processing your logs, as the User
Agent field will not be quoted. You may be able to match it with an
APACHELOGFORMAT command in Analog or you may want to process those log
files with a tool like Perl or sed to clean them up.
LogFormat %h %l %u %t \%r\ %s %b common
LogFormat %{Referer}i - %U referer
LogFormat %{User-agent}i agent
Which of these is in use? (Look for the CustomLog command.)
and in my analog.cfg i have this:
LOGFORMAT COMBINED
LOGFORMAT COMMON
LOGFORMAT BROWSER
Analog should auto-detect any of these anyway.
LOGFORMAT REFERER
REFERRER is spelled with two R's in the middle.
LOGFORMAT ([%d/%M/%Y:%h:%n:%j] %B)
This only provides browser information and doesn't match any of the
LogFormat lines you show above,
how can i resolve my problem?
First try it without any *LOGFORMAT commands. Analog will autodetect
common and combined format and many others.
If that doesn't work, use APACHELOGFORMAT command with the format from
above that is in use.
Full details on the *LOGFORMAT commands can be found here:
http://www.analog.cx/docs/logfmt.html.
--
Jeremy Wadsack
Wadsack-Allen Digital Group
+
| This is the analog-help mailing list. To unsubscribe from this
| mailing list, go to
|http://lists.isite.net/listgate/analog-help/unsubscribe.html
|
| List archives are available at
|http://www.mail-archive.com/analog-help@lists.isite.net/
|http://lists.isite.net/listgate/analog-help/archives/
|http://www.tallylist.com/archives/index.cfm/mlist.7
+
Re: [analog-help] Help Understanding Bug Found
[EMAIL PROTECTED] ([EMAIL PROTECTED]): I am trying to decode what was meant by this: It is easy for an attacker to insert arbitrary strings into any web server logfile. If these strings are then analysed by analog, they can appear in the report. By this means an attacker can introduce arbitrary Javascript code, for example, into an analog report produced by someone else and read by a third person. Analog already attempted to encode unsafe characters to avoid this type of attack, but the conversion was incomplete. Can someone give me an example of how this is or can be a real problem. It is basically an extension if this exploit: http://www.cert.org/advisories/CA-2000-02.html I am not a JAVA developer but have an extensive C/UNIX background. Java has no bearing on this. JavaScript is a different language entirely and can be embedded in HTML pages to be run on the client. http://developer.netscape.com/js/ -- Jeremy Wadsack Wadsack-Allen Digital Group + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help@lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 +
Re: [analog-help] Help Understanding Bug Found
Jeremy, Thanks for the link and the info. It is much clearer now. Michael Internet Mail Message Received from host: pop1.isite.net [64.209.164.9] From: Jeremy Wadsack [EMAIL PROTECTED] on 03/25/2002 05:41 PM GMT Jeremy Wadsack To: [EMAIL PROTECTED] [EMAIL PROTECTED] Cc:(bcc: Mike Jenkins-MW/PGI) Subject: Re: [analog-help] Help Understanding Bug Found 03/25/2002 12:41 PM Please respond to [EMAIL PROTECTED] [EMAIL PROTECTED] ([EMAIL PROTECTED]): I am trying to decode what was meant by this: It is easy for an attacker to insert arbitrary strings into any web server logfile. If these strings are then analysed by analog, they can appear in the report. By this means an attacker can introduce arbitrary Javascript code, for example, into an analog report produced by someone else and read by a third person. Analog already attempted to encode unsafe characters to avoid this type of attack, but the conversion was incomplete. Can someone give me an example of how this is or can be a real problem. It is basically an extension if this exploit: http://www.cert.org/advisories/CA-2000-02.html I am not a JAVA developer but have an extensive C/UNIX background. Java has no bearing on this. JavaScript is a different language entirely and can be embedded in HTML pages to be run on the client. http://developer.netscape.com/js/ -- Jeremy Wadsack Wadsack-Allen Digital Group + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help@lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 + + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help@lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 +
Re: [analog-help] Help with logs
Kevin Everts [EMAIL PROTECTED] wrote: I am using Analog 5.1 to analyze me IIS intranet. I'm using the W3C log format, and it is logging visits in Greenwich time. Technically, it's supposed to be UTC, because there can be a difference of a few milliseconds between GMT and UTC :-) (Though I think I read somewhere that there was supposed to be a Bill in the British Parliament to define GMT as UTC). Apparently, I can't tell it log in my local time zone. Is there a way for me to have Analog take the time in the logs and change it to my local time? You want the LOGTIMEOFFSET directive: http://www.analog.cx/docs/output.html#TIMEOFFSET Aengus + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help@lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 +
Re: [analog-help] Help with logs
On Thu, 14 Feb 2002 14:41:46 - Aengus [EMAIL PROTECTED] wrote: Kevin Everts [EMAIL PROTECTED] wrote: I am using Analog 5.1 to analyze me IIS intranet. I'm using the W3C log format, and it is logging visits in Greenwich time. Technically, it's supposed to be UTC, because there can be a difference of a few milliseconds between GMT and UTC :-) (Though I think I read somewhere that there was supposed to be a Bill in the British Parliament to define GMT as UTC). Could that be a millennium bug for the new millennium? And that gets me thinking - couldn't we use the gmt offset at the end of the timestamp on most logfile lines, to chart out what timezones people connect from? Ale Apparently, I can't tell it log in my local time zone. Is there a way for me to have Analog take the time in the logs and change it to my local time? You want the LOGTIMEOFFSET directive: http://www.analog.cx/docs/output.html#TIMEOFFSET Aengus + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help@lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 + -- Alejandro Fernandez Electronic Group Interactive --+34-65-232-8086-- + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help@lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 +
Re: [analog-help] help needed for new user
Peter ([EMAIL PROTECTED]): i have tried a couple of trial runs but without success. To cut a long story short, i am recieving my log files from the server via e-mail from a third party. How do create a log file for analog to read from the e mails?.At the moment i am copy/pasting the content of the email (the log files), putting them into my documents in a file called Stats and trying to get analog to read and report from there. What am i doing wrong. Any help appreciated. Well, you're probably breaking up data that should be in one line into several lines. If the files are sent as email attachments, simply save them to disk. If they are the only content in the email, ask your provider to send them as attachments so that the lines aren't broken. Once you have the data properly formatted, Analog will often automatically detect the format. If not, follow the directions in the documentation (http://www.analog.cx/docs/logfmt.html) to build your own LOGFORMAT string. -- Jeremy Wadsack Wadsack-Allen Digital Group + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help@lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 +
Re: [analog-help] help with extracting browser data
On Mon, 28 Jan 2002, Robert Brenstein wrote: Can someone suggest a working logformat to identify the browser correctly? Following are examples of typical log entries in a log file (monthly log circa 200 mb). I am showing only the end part of each line, the part that is problematic: 200 3456 ScoutAbout - 200 657151 Mozilla/3.01 (compatible;) - 200 9010 Mozilla/4.7 [de] (WinNT; I) 200 8502 Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0) Fetch API Request - 200 13722 Mozilla/4.7 [de] (WinNT; I) http://www/ 200 11635 Mozilla/4.0 (compatible; MSIE 6.0; Windows 98) http://www/zeigen.html?seite=212 200 0 Mozilla/4.0+(compatible;+MSIE+5.5;+Windows+98) http://www.dfn.de/links/schule.html 200 27139 Mozilla/4.0 (compatible; MSIE 5.0; Windows 98; DigExt) 200 13435 FAST-WebCrawler/3.3 ([EMAIL PROTECTED]; 200 29811 FAST-WebCrawler/3.3 ([EMAIL PROTECTED]; http://fast.no/support.php?c=faqs/crawler) - You can't, because there is no way for analog to know where the browser ends and the referrer begins. You will have to tell your web server to log in a more sensible format (delimit the browser with quotes, for example); and if you need to analyse these logs, you will have to write a preprocessor to put them in a better format. -- Stephen Turner, Cambridge, UKhttp://homepage.ntlworld.com/adelie/stephen/ This is Henman's 8th Wimbledon, and he's only lost 7 matches. BBC, 2/Jul/01 + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help@lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 +
Re: [analog-help] help with individual user names
On Thu, 17 Jan 2002, Max Young wrote: I've just started using Analog. I followed instructions it worked fine. However, what I really want is a list of user names the times they spend on the web site. Is it possible to do this if so how? I'm running Analog on my PC running Windows 2000. No. See webworks.html in the docs. -- Stephen Turner, Cambridge, UKhttp://homepage.ntlworld.com/adelie/stephen/ This is Henman's 8th Wimbledon, and he's only lost 7 matches. BBC, 2/Jul/01 + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help@lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 +
Re: [analog-help] Help with analog
Ted W. Gerold Jr. [EMAIL PROTECTED] wrote: When I try your suggestion I get this: cam1# ./analog /logs/aced/access.log.992238988.gz ./analog: analog version 5.1/Unix ./analog: Warning D: LOGFORMAT in configuration file analog.cfg with no subsequent LOGFILE A LOGFORMAT directive only applies to LOGFILE directives that occur after it in the cfg file. (For help on all errors and warnings, see docs/errors.html) ./analog: Warning F: Can't auto-detect format of logfile /logs/aced/access.log.992238988.gz: ignoring it You need to tell Analog to use your LOGFORMAT string as it's DEFAULTLOGFORMAT http://www.analog.cx/docs/logfmt.html#DEFAULTLOGFORMAT Aengus + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help@lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 +
Re: [analog-help] Help with analog
When I try your suggestion I get this: cam1# ./analog /logs/aced/access.log.992238988.gz ./analog: analog version 5.1/Unix ./analog: Warning D: LOGFORMAT in configuration file analog.cfg with no subsequent LOGFILE (For help on all errors and warnings, see docs/errors.html) ./analog: Warning F: Can't auto-detect format of logfile /logs/aced/access.log.992238988.gz: ignoring it gzip: stdout: Broken pipe ./analog: Warning R: Turning off empty time reports ./analog: Warning R: Turning off empty Request Report ./analog: Warning R: Turning off empty File Type Report ./analog: Warning R: Turning off empty Directory Report ./analog: Warning R: Turning off empty Domain Report ./analog: Warning R: Turning off empty Organisation Report ./analog: Warning R: Turning off empty Search Word Report ./analog: Warning R: Turning off empty Operating System Report ./analog: Warning R: Turning off empty File Size Report ./analog: Warning R: Turning off empty Status Code Report On Sat, 29 Dec 2001, Aengus wrote: From: Ted W. Gerold Jr. [EMAIL PROTECTED] Heres what I want to do: I want to be able to run analog on a file via command line. When I try I get this: cam1# ./analog +cLOGFILE /logs/aced/access.log.150340.gz You can just specify the logfile without without any specifier - the default argument for Analog is a logfilename: ./analog /logs/aced/access.log.150340.gz ./analog: analog version 5.1/Unix ./analog: Warning C: Unknown sort method in command line option +cLOGFILE /logs/aced/access.log.150340.gz +c (lower case) is for enabling the status code report. +C is for specifying config parameters. In my config I have: LOGFILE /logs/aced/bleah because I dont want to use this file, I want to specify my own file. Just delete it from the cfg file if you don't want it there, don't just leave it there with bad data. Also when analog runs on this specified file I would like it to incoperate the new data with the existing data, NOT overwrite. Analog generates reports based on the data it reads. If you want to generate cumulative reports, you will have to keep all the logs and read them from the beginning each time, or you can use cache files to summarise the previous information, and incorporate it into a new report: http://www.analog.cx/docs/cache.html Also after its complete and I look at the report under 'Domain Report' I get this: unresolved numerical addresses Anyway to fix that? Resove the IP addresses. http://www.analog.cx/docs/dns.html Typically, as many as 40% of IP addresses are unresolvable, depending on the audience for a particular web server (intranet servers may well have 100% resolution). There are some helper applications that can improve matters - one in particular, jdresolve, will generate a fake hostname based on who the IP block the address is in is allocated to. (Unfortunately, the home page for jdresolve seems to have been temporarily unavailable since October 11th - you can use google to find another source). http://www.analog.cx/helpers/#dns Aengus + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help@lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 + -- -Ted [EMAIL PROTECTED] + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help@lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 +
Re: [analog-help] Help with analog
From: Ted W. Gerold Jr. [EMAIL PROTECTED] Heres what I want to do: I want to be able to run analog on a file via command line. When I try I get this: cam1# ./analog +cLOGFILE /logs/aced/access.log.150340.gz You can just specify the logfile without without any specifier - the default argument for Analog is a logfilename: ./analog /logs/aced/access.log.150340.gz ./analog: analog version 5.1/Unix ./analog: Warning C: Unknown sort method in command line option +cLOGFILE /logs/aced/access.log.150340.gz +c (lower case) is for enabling the status code report. +C is for specifying config parameters. In my config I have: LOGFILE /logs/aced/bleah because I dont want to use this file, I want to specify my own file. Just delete it from the cfg file if you don't want it there, don't just leave it there with bad data. Also when analog runs on this specified file I would like it to incoperate the new data with the existing data, NOT overwrite. Analog generates reports based on the data it reads. If you want to generate cumulative reports, you will have to keep all the logs and read them from the beginning each time, or you can use cache files to summarise the previous information, and incorporate it into a new report: http://www.analog.cx/docs/cache.html Also after its complete and I look at the report under 'Domain Report' I get this: unresolved numerical addresses Anyway to fix that? Resove the IP addresses. http://www.analog.cx/docs/dns.html Typically, as many as 40% of IP addresses are unresolvable, depending on the audience for a particular web server (intranet servers may well have 100% resolution). There are some helper applications that can improve matters - one in particular, jdresolve, will generate a fake hostname based on who the IP block the address is in is allocated to. (Unfortunately, the home page for jdresolve seems to have been temporarily unavailable since October 11th - you can use google to find another source). http://www.analog.cx/helpers/#dns Aengus + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help@lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 +
Re: [analog-help] Help with analog
In [EMAIL PROTECTED], Ted W. Gerold Jr. [EMAIL PROTECTED] writes: Heya, I am new to this list and for that matter new to Analog. cam1# ./analog +cLOGFILE /logs/aced/access.log.150340.gz ./analog: Warning F: Failed to open logfile /logs/aced/bleah: ignoring it In my config I have: LOGFILE /logs/aced/bleah because I dont want to use this file, I want to specify my own file. Simply omit the LOGFILE directive from the configuratoin file and just specify a log file on the command line. Also after its complete and I look at the report under 'Domain Report' I get this: unresolved numerical addresses Anyway to fix that? If you have DNS enabled and your computer uses a reasonably reliable nameserver, no. Some hosts will never reverse-resolve because their nameservers are not properly configured to respond with reverse resolution queries. See the documentation for details on DNS commands. -- Klaus Johannes Rusch [EMAIL PROTECTED] http://www.atmedia.net/KlausRusch/ + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help@lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 +
Re: [analog-help] Help with analog
Hello, The 'C' in +C must be upper case. - Jim --- Ted W. Gerold Jr. [EMAIL PROTECTED] wrote: Heya, I am new to this list and for that matter new to Analog. Heres what I want to do: I want to be able to run analog on a file via command line. When I try I get this: cam1# ./analog +cLOGFILE /logs/aced/access.log.150340.gz ./analog: analog version 5.1/Unix ./analog: Warning C: Unknown sort method in command line option +cLOGFILE /logs/aced/access.log.150340.gz (For help on all errors and warnings, see docs/errors.html) ./analog: Warning F: Failed to open logfile /logs/aced/bleah: ignoring it ./analog: Warning R: Turning off empty time reports ./analog: Warning R: Turning off empty Request Report ./analog: Warning R: Turning off empty File Type Report ./analog: Warning R: Turning off empty Directory Report ./analog: Warning R: Turning off empty Domain Report ./analog: Warning R: Turning off empty Organisation Report ./analog: Warning R: Turning off empty Search Word Report ./analog: Warning R: Turning off empty Operating System Report ./analog: Warning R: Turning off empty File Size Report ./analog: Warning R: Turning off empty Status Code Report In my config I have: LOGFILE /logs/aced/bleah because I dont want to use this file, I want to specify my own file. Also when analog runs on this specified file I would like it to incoperate the new data with the existing data, NOT overwrite. Also after its complete and I look at the report under 'Domain Report' I get this: unresolved numerical addresses Anyway to fix that? Thank you so much! -- -Ted + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to | http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at | http://www.mail-archive.com/analog-help@lists.isite.net/ | http://lists.isite.net/listgate/analog-help/archives/ | http://www.tallylist.com/archives/index.cfm/mlist.7 + __ Do You Yahoo!? Send your FREE holiday greetings online! http://greetings.yahoo.com + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help@lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 +
RE: [analog-help] Help with filtering users based on cookies
hi, It works! I tried what you said and now its working perfectly. Thanks a bunch for your help. Merry Xmas toallthe analogusers from Instawatch team. Harshavardhan Kanitkar Web Developer Instawatch.com
Re: [analog-help] Help with filtering users based on cookies
Harshu Kanitkar ([EMAIL PROTECTED]): I have a site in which we have a login and password and when the user logs in I set a cookie. It looks something like this ASPSESSIONIDQLGO=BHELIIBBKDLGCLANLOGHBFCO;+uid=20 I want to filter my users according to uid. How can I configure my reports so that they show only this info and not of all the users? I tried to find the answer everywhere but couldn't. Please help. You'll need to setup a custom LOGFORMAT line to read the file, but convince Analog that the cookie field is the user field (%u). See http://www.analog.cx/docs/logfmt.html. Then use the USERINCLUDE line to select which 'users' you want to filter the report by. See http://www.analog.cx/docs/include.html. -- Jeremy Wadsack Wadsack-Allen Digital Group + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help@lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 +
Re: [analog-help] Help with filtering users based on cookies
Well, before you add the USERINCLUDE, run it with the LOGFORMAT command to make sure you're getting a proper User Report. Then you can look at the User Report to get a better ideas of what to include. I suspect you'll need something like this: USERINCLUDE *uid=20* There are problems in your LOGFORMAT. First of all, each item appears to be separated by two spaces, while the log file only has one (this could be because you sent Word HTML files to the list and it can't translate to text very well). Next, Analog says: Warning C: Bad argument in configuration command: ignoring it: Because you have two %b's. You only need one and it should go on sc-bytes. Third, you will need to include this to tell Analog to ignore the comments: LOGFORMAT #%j Fourth, there's an extra %j between the %S and %r. Fifth, you're missing a %j between %T and %A Try this logformat: DEFAULTLOGFORMAT #%j DEFAULTLOGFORMAT (%Y-%m-%d %h:%n:%j %S %j %j %j %j %j %j %r %q %c %b %j %T %j %j %j %A %u %f) -- Jeremy Wadsack Wadsack-Allen Digital Group Harshu Kanitkar ([EMAIL PROTECTED]): Hello, Thanks for your help. According to the info you gave me, i came up with this: LOGFORMAT (%Y-%m-%d %h:%n:%j %S %j %j %j %j %j %j %j %r %q %c %b %b %T %j %j %A %u %f) USERINCLUDE uid=20 My logfiles look somewhat like this #Fields: date time c-ip cs-username s-sitename s-computername s-ip s-port cs-method cs-uri-stem cs-uri-query sc-status sc-win32-status sc-bytes cs-bytes time-taken cs-version cs-host cs(User-Agent) cs(Cookie) cs(Referer) 2001-12-19 22:21:57 199.79.203.243 - W3SVC17 APHRODITE 216.142.33.229 80 GET /stats/demonstration/index.htm - 200 0 858 445 406 HTTP/1.1 www.assetfactory.com Mozilla/4.0+(compatible;+MSIE+5.5;+Windows+NT+5.0) ASPSESSIONIDGMNC=POEDIIBBCBHDJBIJPMPM;+ASPSESSIONIDQLGO=BHELIIBBKDLGCLANLOGHBFCO;+mycookie=1286;+close=0;+uid=20 - I tried to use the above format but it shows empty records. Please help. Thanks, -Original Message- From: Jeremy Wadsack [mailto:[EMAIL PROTECTED]] Sent: Thursday, December 20, 2001 10:05 AM To: [EMAIL PROTECTED] Subject: Re: [analog-help] Help with filtering users based on cookies Harshu Kanitkar ([EMAIL PROTECTED]): I have a site in which we have a login and password and when the user logs in I set a cookie. It looks something like this ASPSESSIONIDQLGO=BHELIIBBKDLGCLANLOGHBFCO;+uid=20 I want to filter my users according to uid. How can I configure my reports so that they show only this info and not of all the users? I tried to find the answer everywhere but couldn't. Please help. You'll need to setup a custom LOGFORMAT line to read the file, but convince Analog that the cookie field is the user field (%u). See http://www.analog.cx/docs/logfmt.html. Then use the USERINCLUDE line to select which 'users' you want to filter the report by. See http://www.analog.cx/docs/include.html. + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help@lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 +
Re: [analog-help] help
James Herrmann [EMAIL PROTECTED] wrote This type of reporting is not supported. The accuracy of pin pointing visitors at the city level is highly suspect. According to an unnamed commercial product I've used, 45% of my traffic comes from Virginia, USA (AOL, of course). Obviously this is a flawed system that Analog wisely omits. Do you know how IP addresses are organized in China? It's not at all unlikely that Chinese IP addresses are organized geographically. --- orinbai [EMAIL PROTECTED] wrote: I want to get a report like : 50811: 0.28%: City A 38964: 0.22%: City B 36740: 0.19%: City C 33964: 0.16%: City D in domain report.Can i? I come from China,there is so many ip address in China.I cant write every category in cfg file.Is there any way else to solve it? You really haven't defined what you mean by City. If you can't write every category in the cfg file, is there some other way to guess the information? Can you post some examples of the types of addresses that are involved? Aengus + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help@lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 +
Re: [analog-help] help
Hello, This type of reporting is not supported. The accuracy of pin pointing visitors at the city level is highly suspect. According to an unnamed commercial product I've used, 45% of my traffic comes from Virginia, USA (AOL, of course). Obviously this is a flawed system that Analog wisely omits. - Jim --- orinbai [EMAIL PROTECTED] wrote: Hello everyone, I want to get a report like : 50811: 0.28%: City A 38964: 0.22%: City B 36740: 0.19%: City C 33964: 0.16%: City D in domain report.Can i? I come from China,there is so many ip address in China.I cant write every category in cfg file.Is there any way else to solve it? Sorry for my poor English. Thanks __ === ÐÂÀËÃâ·Ñµç×ÓÓÊÏä (http://mail.sina.com.cn) ÐÂÀË·ÖÀàÐÅÏ¢£ºÇáËɶ©ÔÄ£¬Á¿Éí¶¨ÖÆ£¡ÖÜÖÜÓÐÀñ£¬´ó½±µÈÄ㣡 (http://classad.sina.com.cn/) ÆßÖÖÊÖ»úͼƬ¡¢Ç§Ê×ÁåÉùÏÂÔØ¡¡ÐÂÀ˶ÌÐÅÎÞÏÞ¾«²Ê! (http://sms.sina.com.cn/) + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to | http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at | http://www.mail-archive.com/analog-help@lists.isite.net/ | http://lists.isite.net/listgate/analog-help/archives/ | http://www.tallylist.com/archives/index.cfm/mlist.7 + __ Do You Yahoo!? Yahoo! GeoCities - quick and easy web site hosting, just $8.95/month. http://geocities.yahoo.com/ps/info1 + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help@lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 +
Re: [analog-help] Help: Web Server Statistics
- Original Message - From: Vigdor Schreibman [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Monday, November 19, 2001 4:40 PM Subject: Re: [analog-help] Help: Web Server Statistics - Original Message - From: Jeremy Wadsack [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Monday, November 19, 2001 3:25 PM Subject: Re: [analog-help] Help: Web Server Statistics Vigdor Schreibman ([EMAIL PROTECTED]): Since you are obviously unfamiliar with the DOS command line and it's services (like the edit program) I suggest another route. In Windows Explorer, find the folder where your installed Analog. Find the file in that folder called analog.cfg. If you double click this file Windows will probably give you a list of programs asking you which you want to use to run it. Choose Notepad. When notepad opens, add the command ERRFILE errors.txt to the file. Save your changes. Run Analog by double clicking the analog.exe icon. When it's done (the window will close), open the errors.txt file that it created in the same folder and look at the messages. Now that you have something to go on, take a look at the Analog documentation (in the docs folder where Analog is installed) for tips on what to do with the problems that it has. You might also want to read the file called startpc.html which lays this all out in details. I have produced the errors.txt file suggested. This includes many warnings time without date and corrupt lines in logfile requiring change in the LOGFORMAT. No this requires a change to the log files themselves. Analog needs to have the date on each line of the log file. This is covered in the FAQ (http://www.analog.cx/docs/faq.html#faq105). You can use one of the Helper Applications to covert your existing logs, but for the future you should change your webserver settings to include the date on each line of the log files. Thanks for this helpful information Jeremy. These problem remain, however. I changed the IIS webserver setting to include date and time, ran the analog.exe file again, and opened the new errors.txt file. The list of errors has not changed in substance, time without date and corrupt lines in logfile remain. The errors file is attached. [EMAIL PROTECTED] Success!! The settings for date and time did not work the first time around because my system would not confirm them without configuration of the IIS server extensions. This required conversion of my file system to NTFS. I then made a backup of my files and carried out the conversion, after which, I was able to configure server extensions. I was then able to obtain a good report from analog. Thanks again for your kind assistance. [EMAIL PROTECTED] Looking through the help files with regard to this error message the following is change is recommended: Microsoft log, North American dates, LOGFORMAT MICROSOFT-NA 192.64.25.41, -, 12/25/98, 17:45:35, W3SVC1, HOST1, 192.16.225.10, 2178, 303, 1243, 200, 0, GET, /~sret1/, -, If you are getting 'time without date' messages, then you are using W3C Extended format, not Microsoft format log files (those have the date on each line). For W3C Extended format log files you DO NOT need a LOGFORMAT command. The files are self-describing and Analog can always parse them. -- Jeremy Wadsack Wadsack-Allen Digital Group + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help@lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 + + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help@lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 +
Re: [analog-help] Help: Web Server Statistics
On Mon, 19 Nov 2001, Vigdor Schreibman wrote: Hello, I have just installed Analog 5.1. My computer is a Dell Dimension 8100, Pentium 4 CPU, 1.3 Ghz, 256 MB of RAM, Windows Professional XP Operating System, . Web Server Statistics shows: Successful requests: 0 Logfile lines without status code: 555 Corrupt logfile lines: 88,952 How do I resolve these problems? 1) See if analog produced any helpful messages when it ran. You can do this by running analog from the command line. Alternatively use the ERRFILE command to redirect the errors to a file. 2) If that doesn't help, use DEBUG C to say where every line was corrupt. That will produce a LOT of output in this case. You might prefer to try it with a smaller logfile. -- Stephen Turner, Cambridge, UKhttp://homepage.ntlworld.com/adelie/stephen/ This is Henman's 8th Wimbledon, and he's only lost 7 matches. BBC, 2/Jul/01 + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help@lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 +
Re: [analog-help] Help: Web Server Statistics
- Original Message - From: Stephen Turner [EMAIL PROTECTED] To: analog-help [EMAIL PROTECTED] Sent: Monday, November 19, 2001 10:53 AM Subject: Re: [analog-help] Help: Web Server Statistics On Mon, 19 Nov 2001, Vigdor Schreibman wrote: Hello, I have just installed Analog 5.1. My computer is a Dell Dimension 8100, Pentium 4 CPU, 1.3 Ghz, 256 MB of RAM, Windows Professional XP Operating System, . Web Server Statistics shows: Successful requests: 0 Logfile lines without status code: 555 Corrupt logfile lines: 88,952 How do I resolve these problems? 1) See if analog produced any helpful messages when it ran. You can do this by running analog from the command line. Alternatively use the ERRFILE command to redirect the errors to a file. I am using the DOS command prompt, but this does not recognize either analog or 'ERRFILE What is the specific command that should be used? [EMAIL PROTECTED] + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help@lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 +
Re: [analog-help] Help: Web Server Statistics
On Mon, 19 Nov 2001, Vigdor Schreibman wrote: 1) See if analog produced any helpful messages when it ran. You can do this by running analog from the command line. Alternatively use the ERRFILE command to redirect the errors to a file. I am using the DOS command prompt, but this does not recognize either analog or 'ERRFILE What is the specific command that should be used? analog will work if you cd to the right directory first. Or use the full pathname like C:\program files\analog 5.1\analog or whatever. ERRFILE is an analog command, not a DOS command. It goes in your analog.cfg file. -- Stephen Turner, Cambridge, UKhttp://homepage.ntlworld.com/adelie/stephen/ This is Henman's 8th Wimbledon, and he's only lost 7 matches. BBC, 2/Jul/01 + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help@lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 +
Re: [analog-help] Help: Web Server Statistics
Victor: What format are your log files in and what type of server is the site on? I have seen similar problems in IIS because by default IIS does not log the date(who knows why). Just a guess - but I have seen it before. If that is the problem, you need to set the server to log the date. Chuck Schick Warp 8, Inc. www.warp8.com 303-421-5140 - Original Message - From: Vigdor Schreibman [EMAIL PROTECTED] To: analog-help [EMAIL PROTECTED] Sent: Monday, November 19, 2001 8:41 AM Subject: [analog-help] Help: Web Server Statistics Hello, I have just installed Analog 5.1. My computer is a Dell Dimension 8100, Pentium 4 CPU, 1.3 Ghz, 256 MB of RAM, Windows Professional XP Operating System, . Web Server Statistics shows: Successful requests: 0 Logfile lines without status code: 555 Corrupt logfile lines: 88,952 How do I resolve these problems? You advice will be appreciated. [EMAIL PROTECTED] + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help@lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 +
Re: [analog-help] Help: Web Server Statistics
- Original Message - From: Chuck Schick [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Monday, November 19, 2001 12:13 PM Subject: Re: [analog-help] Help: Web Server Statistics Victor: What format are your log files in and what type of server is the site on? I have seen similar problems in IIS because by default IIS does not log the date(who knows why). Just a guess - but I have seen it before. If that is the problem, you need to set the server to log the date. Thanks for your response Chuck. I am using IIS. The Counter log file (or folder), Web site activities log has this entry: Start log at 8:41 PM 9/3/2001 [EMAIL PROTECTED] Chuck Schick Warp 8, Inc. www.warp8.com 303-421-5140 - Original Message - From: Vigdor Schreibman [EMAIL PROTECTED] To: analog-help [EMAIL PROTECTED] Sent: Monday, November 19, 2001 8:41 AM Subject: [analog-help] Help: Web Server Statistics Hello, I have just installed Analog 5.1. My computer is a Dell Dimension 8100, Pentium 4 CPU, 1.3 Ghz, 256 MB of RAM, Windows Professional XP Operating System, . Web Server Statistics shows: Successful requests: 0 Logfile lines without status code: 555 Corrupt logfile lines: 88,952 How do I resolve these problems? You advice will be appreciated. [EMAIL PROTECTED] + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help@lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 + + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help@lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 +
Re: [analog-help] Help: Web Server Statistics
On Mon, 19 Nov 2001, Vigdor Schreibman wrote: Thanks for your response Chuck. I am using IIS. The Counter log file (or folder), Web site activities log has this entry: Start log at 8:41 PM 9/3/2001 [EMAIL PROTECTED] You need the date on every line. This is explained in detail in the FAQ (with pointers to other parts of the documentation). -- Stephen Turner, Cambridge, UKhttp://homepage.ntlworld.com/adelie/stephen/ This is Henman's 8th Wimbledon, and he's only lost 7 matches. BBC, 2/Jul/01 + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help@lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 +
Re: [analog-help] Help: Web Server Statistics
- Original Message - From: Jeremy Wadsack [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Monday, November 19, 2001 12:55 PM Subject: Re: [analog-help] Help: Web Server Statistics Since you are obviously unfamiliar with the DOS command line and it's services (like the edit program) I suggest another route. In Windows Explorer, find the folder where your installed Analog. Find the file in that folder called analog.cfg. If you double click this file Windows will probably give you a list of programs asking you which you want to use to run it. Choose Notepad. When notepad opens, add the command ERRFILE errors.txt to the file. Save your changes. Run Analog by double clicking the analog.exe icon. When it's done (the window will close), open the errors.txt file that it created in the same folder and look at the messages. Now that you have something to go on, take a look at the Analog documentation (in the docs folder where Analog is installed) for tips on what to do with the problems that it has. You might also want to read the file called startpc.html which lays this all out in details. I have produced the errors.txt file suggested. This includes many warnings time without date and corrupt lines in logfile requiring change in the LOGFORMAT. Looking through the help files with regard to this error message the following is change is recommended: Microsoft log, North American dates, LOGFORMAT MICROSOFT-NA 192.64.25.41, -, 12/25/98, 17:45:35, W3SVC1, HOST1, 192.16.225.10, 2178, 303, 1243, 200, 0, GET, /~sret1/, -, 192.64.25.41, -, 12/25/2001, 17:45:35, W3SVC1, HOST1, 192.16.225.10, 2178, 303, 1243, 200, 0, GET, /~sret1/, -, LOGFORMAT (%S, %u, %m/%d/%Z, %h:%n:%j, W3SVC%j, %j, %v, %T, %j, %b, %c, %j, %j, %r, %q,) LOGFORMAT (%*S, %*u, %m/%d/%Z, %h:%n:%j, %j) Please relate what should be done with this information re: LOGFORMAT. Its not pretty. Its not funny. Its just plain incomprehensibe ;-). [EMAIL PROTECTED] -- Jeremy Wadsack Wadsack-Allen Digital Group + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help@lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 + + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help@lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 +
Re: [analog-help] Help: Web Server Statistics
Vigdor Schreibman ([EMAIL PROTECTED]): Since you are obviously unfamiliar with the DOS command line and it's services (like the edit program) I suggest another route. In Windows Explorer, find the folder where your installed Analog. Find the file in that folder called analog.cfg. If you double click this file Windows will probably give you a list of programs asking you which you want to use to run it. Choose Notepad. When notepad opens, add the command ERRFILE errors.txt to the file. Save your changes. Run Analog by double clicking the analog.exe icon. When it's done (the window will close), open the errors.txt file that it created in the same folder and look at the messages. Now that you have something to go on, take a look at the Analog documentation (in the docs folder where Analog is installed) for tips on what to do with the problems that it has. You might also want to read the file called startpc.html which lays this all out in details. I have produced the errors.txt file suggested. This includes many warnings time without date and corrupt lines in logfile requiring change in the LOGFORMAT. No this requires a change to the log files themselves. Analog needs to have the date on each line of the log file. This is covered in the FAQ (http://www.analog.cx/docs/faq.html#faq105). You can use one of the Helper Applications to covert your existing logs, but for the future you should change your webserver settings to include the date on each line of the log files. Looking through the help files with regard to this error message the following is change is recommended: Microsoft log, North American dates, LOGFORMAT MICROSOFT-NA 192.64.25.41, -, 12/25/98, 17:45:35, W3SVC1, HOST1, 192.16.225.10, 2178, 303, 1243, 200, 0, GET, /~sret1/, -, If you are getting 'time without date' messages, then you are using W3C Extended format, not Microsoft format log files (those have the date on each line). For W3C Extended format log files you DO NOT need a LOGFORMAT command. The files are self-describing and Analog can always parse them. -- Jeremy Wadsack Wadsack-Allen Digital Group + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help@lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 +
Re: [analog-help] Help with Apache LogFormat
From: Søren Neigaard [EMAIL PROTECTED] Ok - I understand. But how do I enable logging of the clients Operating System in Apache? The Client Operating System is based on the UserAgent sent by the browser. If you are logging the UserAgent, then the OS report will work, if you're not logging UserAgents, then it won't. Aengus + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help@lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 +
Re: [analog-help] Help with configuring Analog 5.03--Report doesn't work
From: Charles Walker [EMAIL PROTECTED] When I run the program, DOS opens briefly Analog is a command line application. Open the DOS prompt and run it from there so that you can see any messages it generates. However, when I open the Report.html file in my browser Successful Requests equals (), and no other info from the rather long logfile is displayed. Because the logfile format is different than the examples in the documentation, I tried reconfiguring it...to no avail. Here's one record from my logfile along with the LOGFORMAT code I wrote: Did you read this line in the documentation? Most people don't need to do this because analog can detect the format automatically -- try it first and see! Unless you get an error message indicating that Analog can't recognize the format of the log, you don't need to specify a LOGFORMAT. 24.226.0.226 - - [16/Sep/2001:17:44:24 -0400] GET /sydenham HTTP/1.0 301 241 - Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; AtHome0107) This line works perfectly in analog, but the result code of 301 is a redirection, so it's not considered a success (see http://www.analog.cx/docs/whole.html#faq181 for an explanation). Given that your logfile has the unusual name of weblog.cgi, you might want to try adding REDIRECTION ON to your configuration. Aengus + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help@lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 +
Re: [analog-help] Help with Apache LogFormat
first off you need to find the httpd.conf file in apache then go down the
section for logging it will look something like the following
#
# ErrorLog: The location of the error log file.
# If you do not specify an ErrorLog directive within a VirtualHost
# container, error messages relating to that virtual host will be
# logged here. If you *do* define an error logfile for a VirtualHost
# container, that host's errors will be logged there and not here.
#
ErrorLog /usr/local/apache/logs/error_log
#
# LogLevel: Control the number of messages logged to the error_log.
# Possible values include: debug, info, notice, warn, error, crit,
# alert, emerg.
#
LogLevel crit
#
# The following directives define some format nicknames for use with
# a CustomLog directive (see below).
#
LogFormat %h %l %u %t \%r\ %s %b \%{Referer}i\ \%{User-Agent}i\
combine
d
LogFormat %h %l %u %t \%r\ %s %b common
LogFormat %{Referer}i - %U referer
LogFormat %{User-agent}i agent
#
# The location and format of the access logfile (Common Logfile Format).
# If you do not define any access logfiles within a VirtualHost
# container, they will be logged here. Contrariwise, if you *do*
# define per-VirtualHost access logfiles, transactions will be
# logged therein and *not* in this file.
#
#CustomLog /usr/local/apache/logs/access_log common
#
# If you would like to have agent and referer logfiles, uncomment the
# following directives.
#
#CustomLog /usr/local/apache/logs/referer_log referer
#CustomLog /usr/local/apache/logs/agent_log agent
#
# If you prefer a single logfile with access, agent, and referer information
# (Combined Logfile Format) you can use the following directive.
#
CustomLog /usr/local/apache/logs/access_log combined
you will want to either use combined or create one and call it commonandos
or something of that nature
then you will need to recycle apache (obviously
if you use combined you will not need to change LOGFORMAT in analog or even
have it in there it should pick it up automatically
lance
Original Message -
From: Søren Neigaard [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Tuesday, October 02, 2001 5:57 PM
Subject: [analog-help] Help with Apache LogFormat
I would like to add browser and OS stat to my Apache log file. Here is
what I have, would that do for browser, and can I just write as it is
here, in my analog.cfg file?
LogFormat %h %l %u %t \%r\ %s %b %T \%{Referer}i\ \%{User-Agent}i\
custom
How do I enable OS logging in Apache?
--
Med venlig hilsen/Best regards,
Søren Neigaard mailto:[EMAIL PROTECTED]
--
Memory is like an orgasm. It's a lot better if you don't have to fake it.
+
| This is the analog-help mailing list. To unsubscribe from this
| mailing list, go to
|http://lists.isite.net/listgate/analog-help/unsubscribe.html
|
| List archives are available at
|http://www.mail-archive.com/analog-help@lists.isite.net/
|http://lists.isite.net/listgate/analog-help/archives/
|http://www.tallylist.com/archives/index.cfm/mlist.7
+
+
| This is the analog-help mailing list. To unsubscribe from this
| mailing list, go to
|http://lists.isite.net/listgate/analog-help/unsubscribe.html
|
| List archives are available at
|http://www.mail-archive.com/analog-help@lists.isite.net/
|http://lists.isite.net/listgate/analog-help/archives/
|http://www.tallylist.com/archives/index.cfm/mlist.7
+
Re: [analog-help] Help with configuring Analog 5.03--Report doesn't work
Hi Lance, I was about to give up tonight. I couldn't duplicate on my machine the results you sent me until I moved the entire Analog 5.03 application to my C: drive (it was on D:) and changed the forward slashes in the LOGFILE into back slashes. I also removed all spaces in the folder names of the relevant subdirectories on my hard drive. Then it the program worked. I have a UNIX server, and I guess it's really fussy about paths! Thanks so much for all your help. Charlie --ORIGINAL FILE BELOW-- Hi... I've just installed Analog 5.03 on my system; I specified the LOGFILE, HOSTNAME and HOSTURL. When I run the program and then open the Report.html file in my browser, all it displays is the HOSTNAME (as a hyperlink to the URL). Successful Requests equals (), and no other info from the rather long logfile is displayed. The LOGFILE is located thus: LOGFILE D:\WebAttack\mylogfiles\webLog.cgi Because the logfile format is different than the examples in the documentation, I tried reconfiguring it...to no avail. Here's one record from my logfile along with the LOGFORMAT code I wrote: 24.226.0.226 - - [16/Sep/2001:17:44:24 -0400] GET /sydenham HTTP/1.0 301 241 - Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; AtHome0107) LOGFORMAT (%s - - [%d/%M/%Y:%h:%n:%j %j] %j %r %j %c %b %f %B) Could the problem be caused because I'm using Windows ME? Or? Charlie Walker + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help@lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 +
Re: [analog-help] Help with configuring Analog 5.03--Report doesn't work
not a prob lance - Original Message - From: Charles Walker [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Wednesday, October 03, 2001 12:36 AM Subject: Re: [analog-help] Help with configuring Analog 5.03--Report doesn't work Hi Lance, I was about to give up tonight. I couldn't duplicate on my machine the results you sent me until I moved the entire Analog 5.03 application to my C: drive (it was on D:) and changed the forward slashes in the LOGFILE into back slashes. I also removed all spaces in the folder names of the relevant subdirectories on my hard drive. Then it the program worked. I have a UNIX server, and I guess it's really fussy about paths! Thanks so much for all your help. Charlie --ORIGINAL FILE BELOW-- Hi... I've just installed Analog 5.03 on my system; I specified the LOGFILE, HOSTNAME and HOSTURL. When I run the program and then open the Report.html file in my browser, all it displays is the HOSTNAME (as a hyperlink to the URL). Successful Requests equals (), and no other info from the rather long logfile is displayed. The LOGFILE is located thus: LOGFILE D:\WebAttack\mylogfiles\webLog.cgi Because the logfile format is different than the examples in the documentation, I tried reconfiguring it...to no avail. Here's one record from my logfile along with the LOGFORMAT code I wrote: 24.226.0.226 - - [16/Sep/2001:17:44:24 -0400] GET /sydenham HTTP/1.0 301 241 - Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; AtHome0107) LOGFORMAT (%s - - [%d/%M/%Y:%h:%n:%j %j] %j %r %j %c %b %f %B) Could the problem be caused because I'm using Windows ME? Or? Charlie Walker + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help@lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 + + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help@lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 +
Re: [analog-help] Help with configuring Analog 5.03--Report doesn't work
- Original Message - From: Charles Walker [EMAIL PROTECTED] To: analog help list [EMAIL PROTECTED] Sent: Tuesday, October 02, 2001 12:08 AM Subject: [analog-help] Help with configuring Analog 5.03--Report doesn't work Hi... I've just installed Analog 5.03 on my system; I specified the LOGFILE, HOSTNAME and HOSTURL. When I run the program, DOS opens briefly and seems to access the logfile which I have downloaded and specified in my analog.cfg file. However, when I open the Report.html file in my browser, all it displays is the HOSTNAME (as a hyperlink to the URL). Successful Requests equals (), and no other info from the rather long logfile is displayed. The LOGFILE is located thus: LOGFILE D:\WebAttack\mylogfiles\webLog.cgi Because the logfile format is different than the examples in the documentation, I tried reconfiguring it...to no avail. Here's one record from my logfile along with the LOGFORMAT code I wrote: 24.226.0.226 - - [16/Sep/2001:17:44:24 -0400] GET /sydenham HTTP/1.0 301 241 - Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; AtHome0107) This logfile is common well combined even analog should pick it up automatically but if it doesn't i would reaplace the two -'s below tih %j %j bu my log file looks as this bgm-66-24-154-154.stny.rr.com - - [01/Oct/2001:23:15:43 -0500] GET /images/cartoons/archives/01oct/xuf003501.gif HTTP/1.1 304 - http://www.lancerochelle.com/index.php; Mozilla/4.0 (compatible; MSIE 6.0; Windows 98) and i don't use logformat LOGFORMAT (%s - - [%d/%M/%Y:%h:%n:%j %j] %j %r %j %c %b %f %B) Could the problem be caused because I'm using Windows ME? Or? Charlie Walker Lance Rochelle [EMAIL PROTECTED] http://lancerochelle.com (607) 775-2681 --- Being a Systems Administrator is like hitting yourself in the bead with a brick. After a while you don't feel the pain. + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help@lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 + + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help@lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 +
RE: [analog-help] help
Yep, use can use the FROM and TO commands in the config file. See http://www.analog.cx/docs/include.html#fromto The page also says how to do it from the command line. Good Luck, Matt -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Faiza Shaikh Sent: 14 August 2001 10:43 To: [EMAIL PROTECTED] Subject: [analog-help] help I downloaded the Analog 4.13 executable in January and it's all been running fine. I have been able to generate successful cumulative results on a weekly basis since then. However over the past two months I have found that the results are cumulative from May and not January. I have checked the Analog software properties and this correctly shows the creation date as January. Is there anyway to force Analog to generate a report bewteen to input dates? Please help. + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help@lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 + _ Do You Yahoo!? Get your free @yahoo.com address at http://mail.yahoo.com + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help@lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 +
Re: [analog-help] help
On Tue, 14 Aug 2001, Faiza Shaikh wrote: I downloaded the Analog 4.13 executable in January and it's all been running fine. I have been able to generate successful cumulative results on a weekly basis since then. However over the past two months I have found that the results are cumulative from May and not January. I have checked the Analog software properties and this correctly shows the creation date as January. Is there anyway to force Analog to generate a report bewteen to input dates? Please help. Maybe your old logfiles have been moved, or even deleted, so that you're only analysing more recent ones? -- Stephen Turner http://www.statslab.cam.ac.uk/~sret1/ Statistical Laboratory, Wilberforce Road, Cambridge, CB3 0WB, England This is Henman's 8th Wimbledon, and he's only lost 7 matches. BBC, 2/Jul/01 + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help@lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 +
Re: [analog-help] help
- Original Message - From: Faiza Shaikh [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, August 14, 2001 10:43 AM Subject: [analog-help] help I downloaded the Analog 4.13 executable in January and it's all been running fine. I have been able to generate successful cumulative results on a weekly basis since then. However over the past two months I have found that the results are cumulative from May and not January. I have checked the Analog software properties and this correctly shows the creation date as January. Is there anyway to force Analog to generate a report bewteen to input dates? Please help. Put the following in your config file. Change the dates to suit. Stir well and serve. # Exclude everything except August YYMMDD format FROM 010801 TO 010831 /\ Adrian Edmonds \ /ASCII RIBBON CAMPAIGN X AGAINST HTML MAIL, / \AND NEWS + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help@lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 +
Re: [analog-help] help with LOGFORMAT codes
See, that's the problem though. I checked the format code and it was set to COMMON. But I get this in my log: Jun 30 20:02:07 localhost httpd_static: 204.71.191.80 - - [30/Jun/2001:20:02:07 +] GET /download.html HTTP/1.0 200 33829 - LECodeChecker/3.0 libgetdoc/1.0 That makes no sense whatsoever. I have tried to use many different format commands but Analog typically gets stuck on localhost as a star appears under l in the error log. Here's what I have been trying to use: #LOGFORMAT %M%w%d%w%h:%n:%j%w%S%w%j:%w%c%w%r%wHTTP%j%w%b\n #LOGFORMAT %M%w%d%w%h:%n:%j%w%S%w%j:%w%c%w%r%wHTTP%j%w%b\n #LOGFORMAT (%M %d %h:%n:%j %j %j: %s %-w%-w[%d/%M/%Y:%h:%n:%j %j] %j %r %j %c %bw%%fw%%B\n) # # #LOGFORMAT (%j %j %j:%j:%j %j %j: %s %j - - [%d/%M/%Y:%h:%n:%j %j] %j %r %j %c %b %f %B) #LOGFORMAT (%j %j %j:%j:%j %j %j: %s %j - - [%d/%M/%Y:%h:%n:%j %j] %j %r %j %c %b - %B) #LOGFORMAT (%j %j %j:%j:%j %j %j: %s %j - - [%d/%M/%Y:%h:%n:%j %j] %j %r %j %c %b - %u) #LOGFORMAT (%j %j %j:%j:%j %j %j: %s %j - - [%d/%M/%Y:%h:%n:%j %j] %j %r %j %c %b - %f) (ignore the # as I just kept these in the file so I don't have to retype) All cause the program to fail to produce any data, but sometimes it does create html files with no data. I really want to use the output with ReportMagic. You don't have to make a new format for me, but if you can point out where I am astray that would help immensely. At 10:27 AM 7/25/01 +0100, you wrote: On Wed, 25 Jul 2001, Josh Hill wrote: Ok, so I spent several hours examining my files and trying to get Analog to recognize them. The server is Apache. But the httpd.conf file indicates that it is using COMMON and COMBINED. But that is not what I'm getting in the logs. You're right, it's not! You've got to look for the CustomLog line in your Apache httpd.conf to see which log format you're using. Once you've found it, the easiest thing is to use the APACHELOGFORMAT command, which uses the same syntax as Apache's LogFormat command, rather than plain LOGFORMAT. -- Stephen Turner http://www.statslab.cam.ac.uk/~sret1/ Statistical Laboratory, Wilberforce Road, Cambridge, CB3 0WB, England This is Henman's 8th Wimbledon, and he's only lost 7 matches. BBC, 2/Jul/01 _ Josh Hill Community Development Manager eXtropia - the open web technology company 10 Science Park Road, #03-22 The Alpha, Singapore Science Park II, Singapore 117684 http://www.eXtropia.com tel: (65) 773-8550 fax: (65) 872-3788 _ + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help@lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 +
Re: [analog-help] help with LOGFORMAT codes
On Wed, 25 Jul 2001, Josh Hill wrote: Ok, so I spent several hours examining my files and trying to get Analog to recognize them. The server is Apache. But the httpd.conf file indicates that it is using COMMON and COMBINED. But that is not what I'm getting in the logs. You're right, it's not! You've got to look for the CustomLog line in your Apache httpd.conf to see which log format you're using. Once you've found it, the easiest thing is to use the APACHELOGFORMAT command, which uses the same syntax as Apache's LogFormat command, rather than plain LOGFORMAT. -- Stephen Turner http://www.statslab.cam.ac.uk/~sret1/ Statistical Laboratory, Wilberforce Road, Cambridge, CB3 0WB, England This is Henman's 8th Wimbledon, and he's only lost 7 matches. BBC, 2/Jul/01 + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help@lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 +
RE: [analog-help] help w/ dnscache.txt
Stephen, This happened to me a few times. Each time, I renamed the dnscache file and restarted, causing the program to get the names all over again in a new file. Of course this is time consuming since I have analog look at logs from up to a year ago. But, for me, this has always fixed the problem. For a more elegant solution, I assume someone more familiar with the program will chime in... Richard -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of [EMAIL PROTECTED] Sent: Thursday, July 12, 2001 8:55 AM To: [EMAIL PROTECTED] Subject: [analog-help] help w/ dnscache.txt Hi everyone, My dnscache file used to give back the machine names that were accessing my site but now it keeps giving me * instead of the machine name. 16562503 194.126.53.247 * 16562503 155.126.53.156 * 16562503 197.1.4.138 * 16562503 194.1.4.133 * Does anyone know how I can resolve this? Much thanks, Stephen + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help@lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 + + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help@lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 +
RE: [analog-help] help w/ dnscache.txt
Richard, Thanks for the Tip. I thought about doing that, but was hoping for the more elegant solution you are in search of. Hope one materialized but for now I'll use the workaround you suggeted. thanks, Stephen Richard Z. Ward [EMAIL PROTECTED]@lists.isite.net on 07/12/2001 09:38:34 AM Please respond to [EMAIL PROTECTED] Sent by: [EMAIL PROTECTED] To: [EMAIL PROTECTED] cc: Subject: RE: [analog-help] help w/ dnscache.txt Stephen, This happened to me a few times. Each time, I renamed the dnscache file and restarted, causing the program to get the names all over again in a new file. Of course this is time consuming since I have analog look at logs from up to a year ago. But, for me, this has always fixed the problem. For a more elegant solution, I assume someone more familiar with the program will chime in... Richard -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of [EMAIL PROTECTED] Sent: Thursday, July 12, 2001 8:55 AM To: [EMAIL PROTECTED] Subject: [analog-help] help w/ dnscache.txt Hi everyone, My dnscache file used to give back the machine names that were accessing my site but now it keeps giving me * instead of the machine name. 16562503 194.126.53.247 * 16562503 155.126.53.156 * 16562503 197.1.4.138 * 16562503 194.1.4.133 * Does anyone know how I can resolve this? Much thanks, Stephen + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help@lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 + + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help@lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 + + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help@lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 +
Re: [analog-help] help w/ dnscache.txt
On Thu, 12 Jul 2001 [EMAIL PROTECTED] wrote: My dnscache file used to give back the machine names that were accessing my site but now it keeps giving me * instead of the machine name. 16562503 194.1.4.133 * * indicates that the name couldn't be resolved. This would be the case if you ran it off line, or if your DNS wasn't set up correctly, for example. -- Stephen Turner http://www.statslab.cam.ac.uk/~sret1/ Statistical Laboratory, Wilberforce Road, Cambridge, CB3 0WB, England This is Henman's 8th Wimbledon, and he's only lost 7 matches. BBC, 2/Jul/01 + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help@lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 +
Re: [analog-help] help w/ dnscache.txt
Date: Thu, 12 Jul 2001 15:10:55 +0100 (BST) From: Stephen Turner [EMAIL PROTECTED] Subject: Re: [analog-help] help w/ dnscache.txt On Thu, 12 Jul 2001 [EMAIL PROTECTED] wrote: My dnscache file used to give back the machine names that were accessing my site but now it keeps giving me * instead of the machine name. 16562503 194.1.4.133 * * indicates that the name couldn't be resolved. This would be the case if you ran it off line, or if your DNS wasn't set up correctly, for example. Most likely, given the trend to dynamically-assigned IP addresses (DHCP), it's a case of *their* DNS not being set-up correctly; i.e., reverse-DNS entries not existing. It's too bad, because it's a one-time deal -- do it, and you're done. I dunno... good job, cheap job, fast job -- pick any two probably applies here. yo!natan + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help@lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 +
Re: [analog-help] help w/ dnscache.txt
On Thu, 12 Jul 2001, Jonathan B. Horen wrote: Most likely, given the trend to dynamically-assigned IP addresses (DHCP), it's a case of *their* DNS not being set-up correctly; i.e., reverse-DNS entries not existing. Right. It depends whether only some are like that, or whether all of them are. You should expect a proportion of failures. -- Stephen Turner http://www.statslab.cam.ac.uk/~sret1/ Statistical Laboratory, Wilberforce Road, Cambridge, CB3 0WB, England This is Henman's 8th Wimbledon, and he's only lost 7 matches. BBC, 2/Jul/01 + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help@lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 +
Re: [analog-help] Help on
C.Cardoso ([EMAIL PROTECTED]): The log of my server is like this: 992339256.181209 192.168.10.22 TCP_MISS/304 290 GET http://www.djogos.misericordiadelisboa.pt/calendario/sabado/s16o.gif - FIRST_UP_PARENT/proxy.meganet.pt image/gif Analog cant identify anytinhig. The Report is 0. the problem must be LOGFORMAT Can you help me Analog will not analyze log files that do not have both time and date on every line of the file. -- Jeremy Wadsack Wadsack-Allen Digital Group + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help@lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 +
Re: [analog-help] Help on
On Tue, 19 Jun 2001, Jeremy Wadsack wrote: C.Cardoso ([EMAIL PROTECTED]): The log of my server is like this: 992339256.181209 192.168.10.22 TCP_MISS/304 290 GET http://www.djogos.misericordiadelisboa.pt/calendario/sabado/s16o.gif - FIRST_UP_PARENT/proxy.meganet.pt image/gif Analog cant identify anytinhig. The Report is 0. the problem must be LOGFORMAT Can you help me Analog will not analyze log files that do not have both time and date on every line of the file. I assume 992339256.181 is the date actually (09:47 GMT on June 12 2001). Anyway, analog would analyse the line if it had neither date nor time. The next version of the docs will say this: 7. Can analog analyse Squid proxy logfiles? It can analyse Squid's common log format, although Squid uses some extra HTTP status codes which will be rejected as corrupt by analog. But really you want to know different statistics from a proxy log, such as percentage of requests retrieved from cache, and you might be better to use Squid's native format and a tool specifically designed to analyse it such as Calamaris. -- Stephen Turner http://www.statslab.cam.ac.uk/~sret1/ Statistical Laboratory, Wilberforce Road, Cambridge, CB3 0WB, England Your account can only be used for a single internet session at any one time and for no more than 24 hours in any one day. (NTL terms of use) + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help@lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 +
Re: [analog-help] help
On Fri, 25 May 2001, Duke Hillard wrote: I went to the Debian site and noticed that they offer versions 4.01 (stable) and 5.02 (development). This surprised me as I thought that version 5.01 was stable. But I don't use Debian, so I might be way off base. It's 5.0-2. The Debian numbering system is (in the simplest case) upstreamversion-Debianpatch So this is the second Debian release of 5.0. Compiling might be an option to consider if problems with the Debian download aren't resolved. /etc/ is the correct location for configuration files in Debian. Analog is set up under Debian to use /etc/analog.conf as its main configuration file. -- Stephen Turner http://www.statslab.cam.ac.uk/~sret1/ Statistical Laboratory, Wilberforce Road, Cambridge, CB3 0WB, England Your account can only be used for a single internet session at any one time and for no more than 24 hours in any one day. (NTL terms of use) + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help@lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 +
Re: [analog-help] help
On Sat, 26 May 2001, Timothy Downing wrote: I Debian version numbers work the same as Linux kernal version numbers, anything ending in an odd number is development, and anything ending in even is finalized This is not true, for Debian itself or the packages within it. -- Stephen Turner http://www.statslab.cam.ac.uk/~sret1/ Statistical Laboratory, Wilberforce Road, Cambridge, CB3 0WB, England Your account can only be used for a single internet session at any one time and for no more than 24 hours in any one day. (NTL terms of use) + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help@lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 +
Re: [analog-help] help
I went to the Debian site and noticed that they offer versions 4.01 (stable) and 5.02 (development). This surprised me as I thought that version 5.01 was stable. But I don't use Debian, so I might be way off base. Compiling might be an option to consider if problems with the Debian download aren't resolved. I work in a Solaris 8 environment and compile analog from the source code. I am not a wizard in C++, but Stephen has built and packaged analog in a foolproof manner. I know that compiling isnt' for everybody and that it can present its own unique set of problems at times, but it has been working very well for us. -- Duke Hillard Bill Pulte wrote: I used the precompiled version set up on the Debian server. I found an analog.conf file but it is located in my /etc directory. The other installed stuff seems to be located in the /usr/doc/analog directory. don't know if this is any help, but thanks for your time Bill -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Duke Hillard Sent: Wednesday, May 23, 2001 1:08 PM To: [EMAIL PROTECTED] Subject: Re: [analog-help] help Yes, analog can generate HTML pages to be read from an intranet or internet server via a browser. Analog also has the capacity to produce text files (plain and ASCII), LaTeX code, and delimited flat files with the analog user specifying a special string to use as delimiter (very handy for importing into spreadsheets). Concerning setup, analog usually produces an analog.cfg file in the main analog directory (same place in which the analog binary resides). Which version do you have? Did you download source code that you compiled or did you download a pre-compiled executable file? Please respond to the list (more help that way). -- Duke Hillard Bill Pulte wrote: I am new to this analog thing and am looking for guidance. I work for a school district and I want a number of people to access the analog information for logging purposes (ie) through a browser. I am running Apache on Debian Gnu/Linux and I added the analog module, but there is no .cfg file listed within the database. My two questions are 1) first will analog do what I want it to. 2) Second what am I missing in the setup. Any help would be appreciated begin:vcard n:Hillard;Duke tel;work:337-482-5763 x-mozilla-html:TRUE url:http://www.louisiana.edu/ org:University of Louisiana at Lafayette;University Computing Support Services adr:;;P.O. Box 42770;Lafayette;LA;70504-2770;USA version:2.1 email;internet:[EMAIL PROTECTED] title:Computing Resources Coordinator fn:Duke Hillard end:vcard
list traffic volume was RE: [analog-help] help
Is it me, or has the volume of traffic on this list gone up tenfold in the past week? Any particular reason why? + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help@lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 +
Re: [analog-help] help
Yes, analog can generate HTML pages to be read from an intranet or internet server via a browser. Analog also has the capacity to produce text files (plain and ASCII), LaTeX code, and delimited flat files with the analog user specifying a special string to use as delimiter (very handy for importing into spreadsheets). Concerning setup, analog usually produces an analog.cfg file in the main analog directory (same place in which the analog binary resides). Which version do you have? Did you download source code that you compiled or did you download a pre-compiled executable file? Please respond to the list (more help that way). -- Duke Hillard Bill Pulte wrote: I am new to this analog thing and am looking for guidance. I work for a school district and I want a number of people to access the analog information for logging purposes (ie) through a browser. I am running Apache on Debian Gnu/Linux and I added the analog module, but there is no .cfg file listed within the database. My two questions are 1) first will analog do what I want it to. 2) Second what am I missing in the setup. Any help would be appreciated begin:vcard n:Hillard;Duke tel;work:337-482-5763 x-mozilla-html:TRUE url:http://www.louisiana.edu/ org:University of Louisiana at Lafayette;University Computing Support Services adr:;;P.O. Box 42770;Lafayette;LA;70504-2770;USA version:2.1 email;internet:[EMAIL PROTECTED] title:Computing Resources Coordinator fn:Duke Hillard end:vcard
RE: [analog-help] help
I used the precompiled version set up on the Debian server. I found an analog.conf file but it is located in my /etc directory. The other installed stuff seems to be located in the /usr/doc/analog directory. don't know if this is any help, but thanks for your time Bill -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Duke Hillard Sent: Wednesday, May 23, 2001 1:08 PM To: [EMAIL PROTECTED] Subject: Re: [analog-help] help Yes, analog can generate HTML pages to be read from an intranet or internet server via a browser. Analog also has the capacity to produce text files (plain and ASCII), LaTeX code, and delimited flat files with the analog user specifying a special string to use as delimiter (very handy for importing into spreadsheets). Concerning setup, analog usually produces an analog.cfg file in the main analog directory (same place in which the analog binary resides). Which version do you have? Did you download source code that you compiled or did you download a pre-compiled executable file? Please respond to the list (more help that way). -- Duke Hillard Bill Pulte wrote: I am new to this analog thing and am looking for guidance. I work for a school district and I want a number of people to access the analog information for logging purposes (ie) through a browser. I am running Apache on Debian Gnu/Linux and I added the analog module, but there is no .cfg file listed within the database. My two questions are 1) first will analog do what I want it to. 2) Second what am I missing in the setup. Any help would be appreciated + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help@lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 +
Re: [analog-help] Help with using Analog for accounting
Analog is designed to parse raw data in one or more log files. Do you have data about your subnets in some type of log file? -- Duke Hillard Jayesh Jina wrote: Hi All Is there anyone that can help me with the following Can I use Analog to do give me a list of IP Subnets in our Company and the amount of bytes downloaded.. eg 146.64.1.0 - 2000 bytes 146.64.2.0 - 1 000 000 bytes 146.64.3.0 - 1 387 000 bytes and so on to 146.64.254.0 Thanx JJ Jayesh Jina NT Systems Administrator (MCSE) Tel :- 27 12 841 4903 Cell :- 082 448 2153 Jayesh Jina.vcfName: Jayesh Jina.vcf Type: Plain Text (text/plain) begin:vcard n:Hillard;Duke tel;work:337-482-5763 x-mozilla-html:TRUE url:http://www.louisiana.edu/ org:University of Louisiana at Lafayette;University Computing Support Services adr:;;P.O. Box 42770;Lafayette;LA;70504-2770;USA version:2.1 email;internet:[EMAIL PROTECTED] title:Computing Resources Coordinator fn:Duke Hillard end:vcard
Re: [analog-help] Help with using Analog for accounting
Jayesh Jina [EMAIL PROTECTED] wrote: Hi All Is there anyone that can help me with the following Can I use Analog to do give me a list of IP Subnets in our Company and the amount of bytes downloaded.. eg 146.64.1.0 - 2000 bytes 146.64.2.0 - 1 000 000 bytes 146.64.3.0 - 1 387 000 bytes and so on to 146.64.254.0 You can use HOSTALIAS 146.64.1.* Subnet1 ... and use the Host report to get the numbers you want. (Actually, I think you can use a regular expression to have Analog pick out the 3rd field in the IP number, rather than write a seperate line for each - I can't figure out REs to save my life, but it might be something like this: HOSTALIAS REGEXP:^(146.64.(.+?).*) $2 You'll also want to modify the HOSTCOLS to specify bytes. Aengus + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help@lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 +
Re: [analog-help] Help needed: How can I get anglform.pl working from browser?
Thanks Wallace, I did this but it has no effect even after restarting my Netscape to make sure that every cache is cleaned. My problem is that I do not understand why the anlgform.pl does not produce any output when called directly. So since I just want to use the default configuration file why does the following URL produce 'The document contains no data' http://hhundt.de.oracle.com/perl/anlgform.pl?GENERAL=ONMONTHLY=ONWEEKLY=OFFDAILY=ONFULLDAILY=OFFHOURLY=ONDOMAIN=ONORGANISATION=ONDIRECTORY=ONFILETYPE=OFFREQUEST=ONSIZE=OFFREFERRER=OFFSEARCHQUERY=OFFSEARCHWORD=OFFBROWSER=OFFOSREP=OFFSTATUS=OFFignore1=10Mignore2=bignore3=-50ignore4=bDOMSORTBY=BYTESDOMFLOORA=DOMFLOORB=bORGSORTBY=REQUESTSORGFLOORA=ORGFLOORB=rDIRSORTBY=BYTESDIRFLOORA=DIRFLOORB=bREQSORTBY=REQUESTSREQFLOORA=REQFLOORB=rREQINCLUDE=*REFSORTBY=PAGESREFFLOORA=REFFLOORB=pFROM=TO=FILEINCLUDE=FILEEXCLUDE=HOSTNAME=HOSTURL= Thanks everybody for answering but still in trouble Heike ;-) "Mills, Wallace" wrote: Remove the !-- from the start and the -- from the end of the line in which it states what cfg file to use and do not leave a space between the and the first word and the same applies to the ending word. ie It should look like this input type=hidden name="cg" value="c:\analog\analog 4.16\analog.cfg" also remove the -- from the other line like so form action="/perl/anlgform.pl" method="GET" By leaving those in the line is only a comment so you have to remove them for the lines to take effect. Hope this helps. Cheers -Original Message- From: Heike Hundt [SMTP:[EMAIL PROTECTED]] Sent: Monday, 12 March 2001 22:52 To: [EMAIL PROTECTED] Subject: [analog-help] Help needed: How can I get anglform.pl working from browser? Due to no response up to now I am asking once again: Meanwhile I have tested also on SUN Solaris with the same effect. Everything works fine on commandline except anlgform.pl from the Browser. What am I doing wrong? Heike Following my first message: After reading many many emails dealing with this subject it is my last try to get it working. I have installed analog 4.16 for NT into the following directory: C:\analog\analog 4.16 o analog itself works fine I configured anlgform.pl with the appropriate path to the executable: ... $analog = 'C:\analog\analog 4.16\analog.exe'; ... My HTML file anglform.html looks like form action="/perl/anlgform.pl" method="GET" -- !--input type=hidden name="cg" value="c:\analog\analog 4.16\analog.cfg" -- I have changed the method to get to see the whole query string. Everything works fine from the command line as well as other perl scripts from the browser. C:\ perl anlgform.pl REQINCLUDE=pages produces the whole report. I registered that starting anlgform.pl from my cgi-bin directory I need to have an analog.cfg file there. If not I am getting those Failed to open configuration file errors. Why? Trying to access anlgform.pl from my browser or even from a telnet session gives back Document contains no data but no error_log entry since HTTP Return Code 200 means successful but 0 bytes. Any idea where to look or what to test? Thanks in advance Heike This is the analog-help mailing list. To unsubscribe from this mailing list, send mail to [EMAIL PROTECTED] with "unsubscribe" in the main BODY OF THE MESSAGE. List archived at http://www.mail-archive.com/analog-help@lists.isite.net/ DISCLAIMER The information contained in the above e-mail message or messages (which includes any attachments) is confidential and may be legally privileged. It is intended only for the use of the person or entity to which it is addressed. If you are not the addressee any form of disclosure, copying, modification, distribution or any action taken or omitted in reliance on the information is unauthorised. Opinions contained in the message(s) do not necessarily reflect the opinions of the Queensland Government and its authorities. If you received this communication in error, please notify the sender immediately and delete it from your computer system network. This is the analog-help mailing list. To unsubscribe from this mailing list, send mail to [EMAIL PROTECTED] with "unsubscribe" in the main BODY OF THE MESSAGE. List archived at http://www.mail-archive.com/analog-help@lists.isite.net/ This is the analog-help mailing list. To unsubscribe from this mailing list, send mail to [EMAIL PROTECTED] with "unsubscribe" in the main
Re: [analog-help] Help needed: How can I get anglform.pl working from browser?
On Tue, 13 Mar 2001, Heike Hundt wrote: Thanks Wallace, I did this but it has no effect even after restarting my Netscape to make sure that every cache is cleaned. My problem is that I do not understand why the anlgform.pl does not produce any output when called directly. So since I just want to use the default configuration file why does the following URL produce 'The document contains no data' Have you followed the troubleshooting guide in the docs? In particular, did you look in the error log? -- Stephen Turner http://www.statslab.cam.ac.uk/~sret1/ Statistical Laboratory, Wilberforce Road, Cambridge, CB3 0WB, England "Your account can only be used for a single internet session at any one time and for no more than 24 hours in any one day." (NTL terms of use) This is the analog-help mailing list. To unsubscribe from this mailing list, send mail to [EMAIL PROTECTED] with "unsubscribe" in the main BODY OF THE MESSAGE. List archived at http://www.mail-archive.com/analog-help@lists.isite.net/
Re: [analog-help] Help needed: How can I get anglform.pl working from browser?
Thanks for the tip but nothing changed and I don't believe that something in the HTML file has influence on that. Is my understanding wrong that the perl script provided with the necessary parameters should work if called directly from the browser? Since I only wanted to use the default analog.cfg configuration file I have also commented out the "cg" parameter. http://hhundt.de.com/perl/anlgform.pl?GENERAL=ONMONTHLY=ONWEEKLY=OFFDAILY=ONFULLDAILY=OFFHOURLY=ON gives back Document contains no data. Heike :-) Aengus wrote: From: "Heike Hundt" [EMAIL PROTECTED] ... My HTML file anglform.html looks like form action="/perl/anlgform.pl" method="GET" -- !-- and -- denote a HTML comment. Anything between those markers is ignored. Change the line to: input type=hidden name="cg" value="c:\analog\analog 4.16\analog.cfg" Aengus This is the analog-help mailing list. To unsubscribe from this mailing list, send mail to [EMAIL PROTECTED] with "unsubscribe" in the main BODY OF THE MESSAGE. List archived at http://www.mail-archive.com/analog-help@lists.isite.net/ This is the analog-help mailing list. To unsubscribe from this mailing list, send mail to [EMAIL PROTECTED] with "unsubscribe" in the main BODY OF THE MESSAGE. List archived at http://www.mail-archive.com/analog-help@lists.isite.net/
Re: [analog-help] Help needed: How can I get anglform.pl working from browser?
Try using 4.90beta3 -- it's much easier to set up because it makes assumptions about the correct directories for the config file etc. -- Stephen Turner http://www.statslab.cam.ac.uk/~sret1/ Statistical Laboratory, Wilberforce Road, Cambridge, CB3 0WB, England "Your account can only be used for a single internet session at any one time and for no more than 24 hours in any one day." (NTL terms of use) This is the analog-help mailing list. To unsubscribe from this mailing list, send mail to [EMAIL PROTECTED] with "unsubscribe" in the main BODY OF THE MESSAGE. List archived at http://www.mail-archive.com/analog-help@lists.isite.net/
Re: [analog-help] Help needed: How can I get anglform.pl working from browser?
Exactly the same result with 4.90beta3. Heike Stephen Turner wrote: Try using 4.90beta3 -- it's much easier to set up because it makes assumptions about the correct directories for the config file etc. -- Stephen Turner http://www.statslab.cam.ac.uk/~sret1/ Statistical Laboratory, Wilberforce Road, Cambridge, CB3 0WB, England "Your account can only be used for a single internet session at any one time and for no more than 24 hours in any one day." (NTL terms of use) This is the analog-help mailing list. To unsubscribe from this mailing list, send mail to [EMAIL PROTECTED] with "unsubscribe" in the main BODY OF THE MESSAGE. List archived at http://www.mail-archive.com/analog-help@lists.isite.net/ This is the analog-help mailing list. To unsubscribe from this mailing list, send mail to [EMAIL PROTECTED] with "unsubscribe" in the main BODY OF THE MESSAGE. List archived at http://www.mail-archive.com/analog-help@lists.isite.net/
RE: [analog-help] Help needed: How can I get anglform.pl working from browser?
Remove the !-- from the start and the -- from the end of the line in which it states what cfg file to use and do not leave a space between the and the first word and the same applies to the ending word. ie It should look like this input type=hidden name="cg" value="c:\analog\analog 4.16\analog.cfg" also remove the -- from the other line like so form action="/perl/anlgform.pl" method="GET" By leaving those in the line is only a comment so you have to remove them for the lines to take effect. Hope this helps. Cheers -Original Message- From: Heike Hundt [SMTP:[EMAIL PROTECTED]] Sent: Monday, 12 March 2001 22:52 To: [EMAIL PROTECTED] Subject: [analog-help] Help needed: How can I get anglform.pl working from browser? Due to no response up to now I am asking once again: Meanwhile I have tested also on SUN Solaris with the same effect. Everything works fine on commandline except anlgform.pl from the Browser. What am I doing wrong? Heike Following my first message: After reading many many emails dealing with this subject it is my last try to get it working. I have installed analog 4.16 for NT into the following directory: C:\analog\analog 4.16 o analog itself works fine I configured anlgform.pl with the appropriate path to the executable: ... $analog = 'C:\analog\analog 4.16\analog.exe'; ... My HTML file anglform.html looks like form action="/perl/anlgform.pl" method="GET" -- !--input type=hidden name="cg" value="c:\analog\analog 4.16\analog.cfg" -- I have changed the method to get to see the whole query string. Everything works fine from the command line as well as other perl scripts from the browser. C:\ perl anlgform.pl REQINCLUDE=pages produces the whole report. I registered that starting anlgform.pl from my cgi-bin directory I need to have an analog.cfg file there. If not I am getting those Failed to open configuration file errors. Why? Trying to access anlgform.pl from my browser or even from a telnet session gives back Document contains no data but no error_log entry since HTTP Return Code 200 means successful but 0 bytes. Any idea where to look or what to test? Thanks in advance Heike This is the analog-help mailing list. To unsubscribe from this mailing list, send mail to [EMAIL PROTECTED] with "unsubscribe" in the main BODY OF THE MESSAGE. List archived at http://www.mail-archive.com/analog-help@lists.isite.net/ DISCLAIMER The information contained in the above e-mail message or messages (which includes any attachments) is confidential and may be legally privileged. It is intended only for the use of the person or entity to which it is addressed. If you are not the addressee any form of disclosure, copying, modification, distribution or any action taken or omitted in reliance on the information is unauthorised. Opinions contained in the message(s) do not necessarily reflect the opinions of the Queensland Government and its authorities. If you received this communication in error, please notify the sender immediately and delete it from your computer system network. This is the analog-help mailing list. To unsubscribe from this mailing list, send mail to [EMAIL PROTECTED] with "unsubscribe" in the main BODY OF THE MESSAGE. List archived at http://www.mail-archive.com/analog-help@lists.isite.net/
RE: [analog-help] Help with installation on MAC OS X Server
Okay .. Im a newbie learning. I have the file. But reading that it doesnt run on OS X server but I can compile it. Okay how can I compile it? There is no make command on the server. Where can I get it to compile? Please help a lost sheep who wants to run this program... Thank you, William -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Jeremy Wadsack Sent: Thursday, March 08, 2001 8:18 AM To: [EMAIL PROTECTED] Subject: Re: [analog-help] Help with installation on MAC OS X Server William Lessard wrote: I have downloaded the source code of it. But new to it. Can someone please point me to the right place to do this. I understand I have to make and all that from reading the readme file. But I'm lost. Please point me in the right direction. There's a binary available for Mac OS X. See http://www.analog.cx/download.html (or similar on your nearest mirror). Look for the link Mac OS X / Darwin (under BSD). -- Jeremy Wadsack Wadsack-Allen Digital Group This is the analog-help mailing list. To unsubscribe from this mailing list, send mail to [EMAIL PROTECTED] with "unsubscribe" in the main BODY OF THE MESSAGE. List archived at http://www.mail-archive.com/analog-help@lists.isite.net/ This is the analog-help mailing list. To unsubscribe from this mailing list, send mail to [EMAIL PROTECTED] with "unsubscribe" in the main BODY OF THE MESSAGE. List archived at http://www.mail-archive.com/analog-help@lists.isite.net/
Re: [analog-help] help with error message when downloading Analog
I'm afraid you're not getting any responses because nobody on the list has seen this error message before. It's not an Analog error message, and I presume it's coming from AOL when you try to download the software. I don't think many of the people using Analog are likely to be using AOL to connect to the Internet, so I'm not sure if anyone will be able to confirm whether there is a problem downloading Analog via AOL. If possible, you might want to have someone that uses a different ISP download it for you. Aengus - Original Message - From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, March 06, 2001 10:32 PM Subject: [analog-help] help with error message when downloading Analog When attempting to download either version of Analog (window version) the following occurs: Imaging X The document's format is invalid or not supported. OK box I did look in the section of your site FAQ but did not see this type of message. I do not have a lot of computer knowledge so I apologize if I am incorrect. I appreciate your help. Jennifer Stalford Journey to Healing Foundation This is the analog-help mailing list. To unsubscribe from this mailing list, send mail to [EMAIL PROTECTED] with "unsubscribe" in the main BODY OF THE MESSAGE. List archived at http://www.mail-archive.com/analog-help@lists.isite.net/
Re: [analog-help] Help on differences for data transfer stats
Alex Lee wrote: Hi, I am currently charting my bandwidth usage using both Analog and MRTG. However I am getting results from analog that are almost half the results from MRTG. For example, my last months results for January was 18gb from analog, but mrtg showed 45gb. There is only the one site on this server. Calculating the throughput showed that mrtg was right. I understand that there will be little discrepencies, like ftp and such, but not such a huge gap like that. I'm using apache 1.3.14 on linux 6.2 Analog version 3.14 with rmagic 2.02 Analog only tracks download bandwidth. Not upload or requests. If you had lots of null-requests (like failures, redirects, or not-modified-since) this could generate a lot of up-stream traffic that isn't measured in Analog. Analog can analyze some ftp logs so you could run those through to get a better correlation as well. -- Jeremy Wadsack Wadsack-Allen Digital Group This is the analog-help mailing list. To unsubscribe from this mailing list, send mail to [EMAIL PROTECTED] with "unsubscribe" in the main BODY OF THE MESSAGE. List archived at http://www.mail-archive.com/analog-help@lists.isite.net/
Re: [analog-help] Help on differences for data transfer stats
Alex Lee wrote: Hi, I am currently charting my bandwidth usage using both Analog and MRTG. However I am getting results from analog that are almost half the results from MRTG. For example, my last months results for January was 18gb from analog, but mrtg showed 45gb. There is only the one site on this server. Calculating the throughput showed that mrtg was right. I understand that there will be little discrepencies, like ftp and such, but not such a huge gap like that. I'm using apache 1.3.14 on linux 6.2 Analog version 3.14 with rmagic 2.02 Any ideas? keep in mind that most of your web servers only record the amount of "flies bytes" transferred. You don't have any of the other overhead involved with the communication in there (requests, syn, htacceess, etc.). Is this server a regular web server or secure web server? A secure web server will actually do 4 times (if not a little bit more) the amount of traffic as the actual amount of traffic that would be caused by a normal web server (but your web server will not record the difference). Also, Mrtg will give the results for all traffic (including broadcast) for that ethernet device. It's great for network analysis, but I wouldn't rely on any of the info for actual usage. just my $0.02 - Chuck This is the analog-help mailing list. To unsubscribe from this mailing list, send mail to [EMAIL PROTECTED] with "unsubscribe" in the main BODY OF THE MESSAGE. List archived at http://www.mail-archive.com/analog-help@lists.isite.net/
RE: [analog-help] Help on differences for data transfer stats
Understood, thank you. Then you are saying that analog's report of actual usage is a pretty acurate account for data transfer, minus of course the overheads. Is there a way of collecting those additional overheads then? with additional parameters? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Chuck Pierce Sent: Monday, February 12, 2001 12:17 PM To: [EMAIL PROTECTED] Subject: Re: [analog-help] Help on differences for data transfer stats Alex Lee wrote: Hi, I am currently charting my bandwidth usage using both Analog and MRTG. However I am getting results from analog that are almost half the results from MRTG. For example, my last months results for January was 18gb from analog, but mrtg showed 45gb. There is only the one site on this server. Calculating the throughput showed that mrtg was right. I understand that there will be little discrepencies, like ftp and such, but not such a huge gap like that. I'm using apache 1.3.14 on linux 6.2 Analog version 3.14 with rmagic 2.02 Any ideas? keep in mind that most of your web servers only record the amount of "flies bytes" transferred. You don't have any of the other overhead involved with the communication in there (requests, syn, htacceess, etc.). Is this server a regular web server or secure web server? A secure web server will actually do 4 times (if not a little bit more) the amount of traffic as the actual amount of traffic that would be caused by a normal web server (but your web server will not record the difference). Also, Mrtg will give the results for all traffic (including broadcast) for that ethernet device. It's great for network analysis, but I wouldn't rely on any of the info for actual usage. just my $0.02 - Chuck This is the analog-help mailing list. To unsubscribe from this mailing list, send mail to [EMAIL PROTECTED] with "unsubscribe" in the main BODY OF THE MESSAGE. List archived at http://www.mail-archive.com/analog-help@lists.isite.net/ This is the analog-help mailing list. To unsubscribe from this mailing list, send mail to [EMAIL PROTECTED] with "unsubscribe" in the main BODY OF THE MESSAGE. List archived at http://www.mail-archive.com/analog-help@lists.isite.net/
Re: [analog-help] Help on differences for data transfer stats
Alex Lee wrote: Hi, I am currently charting my bandwidth usage using both Analog and MRTG. However I am getting results from analog that are almost half the results from MRTG. For example, my last months results for January was 18gb from analog, but mrtg showed 45gb. There is only the one site on this server. Calculating the throughput showed that mrtg was right. I understand that there will be little discrepencies, like ftp and such, but not such a huge gap like that. Are you excluding anything from the Analog report (using *EXCLUDE/*INCLUDE commands in your config file)? ++ | Joshua Cooley([EMAIL PROTECTED]) http://www.kaycee.net/josh | | Programmer/Network Administrator | | KayCee Software, Inc. http://www.kaycee.net/kcsi | ++ This is the analog-help mailing list. To unsubscribe from this mailing list, send mail to [EMAIL PROTECTED] with "unsubscribe" in the main BODY OF THE MESSAGE. List archived at http://www.mail-archive.com/analog-help@lists.isite.net/
Re: [analog-help] Help on differences for data transfer stats
that's up to your web server. I don't know of any that do that. There may be some 3rd party snmp servers out there that will limit it's traps to just port 80 (or whatever), then you could run either analog, or mrtg on the results, but I don't know of one. Try checking out cmu's snmp agent for linux (I think there are some options to do that). - Chuck Alex Lee wrote: Understood, thank you. Then you are saying that analog's report of actual usage is a pretty acurate account for data transfer, minus of course the overheads. Is there a way of collecting those additional overheads then? with additional parameters? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Chuck Pierce Sent: Monday, February 12, 2001 12:17 PM To: [EMAIL PROTECTED] Subject: Re: [analog-help] Help on differences for data transfer stats Alex Lee wrote: Hi, I am currently charting my bandwidth usage using both Analog and MRTG. However I am getting results from analog that are almost half the results from MRTG. For example, my last months results for January was 18gb from analog, but mrtg showed 45gb. There is only the one site on this server. Calculating the throughput showed that mrtg was right. I understand that there will be little discrepencies, like ftp and such, but not such a huge gap like that. I'm using apache 1.3.14 on linux 6.2 Analog version 3.14 with rmagic 2.02 Any ideas? keep in mind that most of your web servers only record the amount of "flies bytes" transferred. You don't have any of the other overhead involved with the communication in there (requests, syn, htacceess, etc.). Is this server a regular web server or secure web server? A secure web server will actually do 4 times (if not a little bit more) the amount of traffic as the actual amount of traffic that would be caused by a normal web server (but your web server will not record the difference). Also, Mrtg will give the results for all traffic (including broadcast) for that ethernet device. It's great for network analysis, but I wouldn't rely on any of the info for actual usage. just my $0.02 - Chuck This is the analog-help mailing list. To unsubscribe from this mailing list, send mail to [EMAIL PROTECTED] with "unsubscribe" in the main BODY OF THE MESSAGE. List archived at http://www.mail-archive.com/analog-help@lists.isite.net/
Re: [analog-help] help
On Wed, 31 Jan 2001, James Robinson wrote: Hi please can you help me with analog. I have used analog on my web sites hosted by easyspace. However I now have my own dedicated server and would like to run analog online for my own site and my clients sites. Can you let me know how to set this up on the server. (my server is a raq3) James, There are "Getting Started" instructions at http://www.analog.cx/docs/start.html Of course, mail this list again if you have more specific questions later. -- Stephen Turner http://www.statslab.cam.ac.uk/~sret1/ Statistical Laboratory, Wilberforce Road, Cambridge, CB3 0WB, England "Your account can only be used for a single internet session at any one time and for no more than 24 hours in any one day." (NTL terms of use) This is the analog-help mailing list. To unsubscribe from this mailing list, send mail to [EMAIL PROTECTED] with "unsubscribe" in the main BODY OF THE MESSAGE. List archived at http://www.mail-archive.com/analog-help@lists.isite.net/
RE: [analog-help] help
On Wed, 31 Jan 2001, Lambert, Michael wrote: Sorry, This is a bit off topic, but can someone post an example of a logfile line that includes a virtual host field? Thanks... again sorry for posting off topic but I cant find this information anywhere. You're looking for a standard format? I don't think there is one. That's why analog accepts configurable formats. -- Stephen Turner http://www.statslab.cam.ac.uk/~sret1/ Statistical Laboratory, Wilberforce Road, Cambridge, CB3 0WB, England "Your account can only be used for a single internet session at any one time and for no more than 24 hours in any one day." (NTL terms of use) This is the analog-help mailing list. To unsubscribe from this mailing list, send mail to [EMAIL PROTECTED] with "unsubscribe" in the main BODY OF THE MESSAGE. List archived at http://www.mail-archive.com/analog-help@lists.isite.net/
RE: [analog-help] help
Sorry, This is a bit off topic, but can someone post an example of a logfile line that includes a virtual host field? Thanks... again sorry for posting off topic but I cant find this information anywhere. --ML
