Anyone else had this problem? I can't get Analog to evaluate my COMBINED logfiles
correctly. They're standard-issue NCSA logs - the same as the COMMON log with Referrer
and User Agent in double quotes tagged on at the end.
First I noticed things were going awry when trying to process mixed logs. We switched
from standard to combined part way through the month a couple of months ago. So I set
up Analog as advised with both LOGFORMAT lines - COMMON first cos we switched late in
the month/year - and rolled up a couple of reports summarising 1998. The figures would
alarmingly dip at the point where the logformat changed, and stay low for the rest of
the year.
I'm running Analog 3.11 on a Solaris (SunOS 5.6) box. I've tried compiling it with
-DNOSTRCMP both on and off. I've got a one-month logfile here. It has approximately
400,000 lines. And I've run side by side tests with LOGFORMAT COMBINED running against
the combined version and LOGFORMAT COMMON running against exactly the same logfile
with the Referrer and UserAgent fields stripped courtesy of a quick Perl script.
Remember, apart from this one line the config files are otherwise exactly the same -
I've even turned the Referrer and Browser Reports off. The General Summary for the
COMBINED Report gives aproximately 150,000 sucessful requests and 250,000 unwanted
logfile entries. The same summary for the COMMON Report gives roughly 350,000
successful requests and 50,000 unwanted entries.
No warnings are generated during either of these reports. There are no rogue file
exclusions (even if there were the two config files are exactly the same apart from
the LOGFORMAT line - so it shouldn't make any difference to the underlying metrics).
And the number of corrupt logfile lines is trivially low for both. Why are all these
COMBINED lines going into the 'Unwanted Logfile Entries' bin? How can I get them out?
Yours hopefully,
chocolateboy.
____________________________________________________________________
Get free e-mail and a permanent address at http://www.netaddress.com/?N=1
--------------------------------------------------------------------
This is the analog-help mailing list. To unsubscribe from this
mailing list, send mail to [EMAIL PROTECTED]
with "unsubscribe analog-help" in the main BODY OF THE MESSAGE.
--------------------------------------------------------------------
