Re: [analog-help] LOGFORMAT assistance please!
ggn wrote: axx.uk: [13/Feb/2009:00:44:17 +] 24.210.252.186 - - GET /dbugarchive.png HTTP/1.1 200 7296 http://axx.uk/; Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.18) Gecko/20081029 Firefox/2.0.0.18 LOGFORMAT (%v: [%d/%M/%Y:%h:%n:%j %j] %S - - %j %r %j %c - - %B) The log format does not match the sample provided: * The log entry shows a byte count after the status code but the log format specifies - (should be %b). * The log entry shows a referring URL enxt but the log format specifies - (should be %f). This should work (ECLF plus leading virtual host): LOGFORMAT (%v: %S %j %u [%d/%M/%Y:%h:%n:%j] %j%w%r%wHTTP%j %c %b %f %B) LOGFORMAT (%v: %S %j %u [%d/%M/%Y:%h:%n:%j] %j%w%r %c %b %f %B) LOGFORMAT (%v: %S %j %u [%d/%M/%Y:%h:%n:%j] %r %c %b %f %B) -- Klaus Johannes Rusch klausru...@atmedia.net http://www.atmedia.net/KlausRusch/ + | TO UNSUBSCRIBE from this list: |http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +
Re: [analog-help] LOGFORMAT assistance please!
ggn ggn...@gmail.com wrote: Hi all, I'm trying to get analog to parse logfiles from a linux server I'm administering. The log lines are typically something like this: axx.uk: [13/Feb/2009:00:44:17 +] 24.210.252.186 - - GET /dbugarchive.png HTTP/1.1 200 7296 http://axx.uk/; Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.18) Gecko/20081029 Firefox/2.0.0.18 LOGFORMAT (%v: [%d/%M/%Y:%h:%n:%j %j] %S - - %j %r %j %c - - %B) As Klaus said, - is not a wildcard, it's a specific string, and 7296 doesn't match -, and neither does http://axx.uk/ If you don't care about the byte count, or the referrer, use %j instead of those particular - characters, or use %b for the byte-count field, and %f for the referrer. Aengus + | TO UNSUBSCRIBE from this list: |http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +
