Stephen Turner wrote:
> On Wed, 3 Mar 1999, Wallace Nicoll wrote:
>
> > Michael Maurer wrote:
> >
> > > 192.168.100.20, -, -, N, 13/02/99, 05:28:25, 1, -, -, 195.63.104.45, -,
> > > 80, 45054, 381, 73, http, -, -, http://195.63.104.45/images/logout.gif, -,
> > > Cache, 10060
> >
> > LOGFORMAT (%S, %u, -, N, %d/%m/%y, %h:%n:%j, 1, -, -, %f, -, %j, %j, %j, %b,
> > %j, -, -, %r, -, %j, %j, %j)
> >
> > I only get a handful of corrupt lines using the above. I'm still not 100%
> > convinced I've got the total Bytes transferred correct (the totals seem low
> > from a 20Mb logfile).
> >
>
> It looks like you've got the %b too late. Shouldn't it be the 45054 not
> the 73 in the above example? So you would have ... %f, -, %j, %b, %j, %j, ...
> or something like that.
>
That's what I thought before I found the table format. Assuming the 80 is the
PORT, the format should be ...
DestHostPort = 80
processingtime = 45054
bytessent = 381
bytesrecvd = 73
Given that the sample was returned to the user from local cache, I assume the
381bytes refer to the GIF being sent to the user's PC, and the 73 relates to a
query sent to check up on whether the original had been changed at source.
> Also, I don't think what you've called %f is actually %f. I think it's
> probably %v.
I really wasn't too bothered about that field, as I'm trying to measure requests
from within the organisation out to the web for sizing, charging etc. Again, the
table format seems to indicate ...
logTime = 13/02/99, 05:28:25
service = 1
servername = -
referredserver = -
DestHost = 195.63.104.45
DestHostIP = -,
DestHostPort = 80
Best wishes,
Wallace
======================================================================
Wallace Nicoll [EMAIL PROTECTED]
City of Edinburgh Council IT Services,
Chesser House, 500 Gorgie Road, Phone : 0131 469 5343
Edinburgh, EH11 3YJ, Scotland Fax : 0131 469 5335
======================================================================
--------------------------------------------------------------------
This is the analog-help mailing list. To unsubscribe from this
mailing list, send mail to [EMAIL PROTECTED]
with "unsubscribe analog-help" in the main BODY OF THE MESSAGE.
--------------------------------------------------------------------
