On Tue, 2 Mar 1999, Carrasco, Manel wrote:
> Hi everyone; sorry for my english and my bored question, but recently i
> change my format in a Webstar Server log and i'm going crazy to
> configure it correctly.
>
> Any idea?
>
> I've tried this:
>
> LOGFORMAT (%m/%d/%y %w %h:%n:%j %w %S:%j %j %w %r %w "%j" %w %c %w %b %w %j
> %w "%B" %w "%u" %w %f)
>
> And this is a sample of log lines:
>
> !!LOG_FORMAT DATE TIME C-IP CS-METHOD CS-URI-STEM CS(HOST) CS-STATUS
> BYTES_SENT BYTES CS(USER-AGENT) CS(COOKIE) REFERER
> 02/01/99 10:22:42 155.54.5.144:80 GET /index.html
> "databases.iese.edu" 200 5092 5092 "Mozilla/2.0 (Win95; I;
> 16bit)" ""
> http://www.iese.edu/search/search.idq?CiScope=%2F&CiMaxRecordsPerPage=10&Tem
> plateName=query&CiSort=rank%5Bd%5D&HTMLQueryForm=search.html&CiRestrictionDa
> ta=gastronomia&Submit=Search
> 02/01/99 10:22:43 155.54.5.144:80 GET /images/hpph1.jpeg
> "databases.iese.edu" 200 8762 8762 "Mozilla/2.0 (Win95; I;
> 16bit)" "" http://databases.iese.edu/index.html
The first comment is that if you took out from the format one of BYTES_SENT
and BYTES, analog would be able to analyse this without the need for a
LOGFORMAT command.
Anyway, the problem with your LOGFORMAT seems to be the spaces between items.
You don't want all those spaces and %w's in there. Just put in a single \t (or
whatever is separating the fields). So it would look like
LOGFORMAT (%m/%d/%y\t%h:%n:%j\t...)
--
Stephen Turner [EMAIL PROTECTED] http://www.statslab.cam.ac.uk/~sret1/
Statistical Laboratory, 16 Mill Lane, Cambridge CB2 1SB, England
"Ad infinitum, if not ad nauseam." (Interviewee, BBC Radio 4)
--------------------------------------------------------------------
This is the analog-help mailing list. To unsubscribe from this
mailing list, send mail to [EMAIL PROTECTED]
with "unsubscribe analog-help" in the main BODY OF THE MESSAGE.
--------------------------------------------------------------------
