Some of you might find this useful (or might have suggestions for
improvements!)
I have a large IIS server with about 60 separate FrontPage Webs hosted
on it, with different Authors. I create a daily logfile, but tend to
work with the logfiles on a monthly basis.
Only a few of the authors are interested in their logfiles, so I run a
short batchfile to parse out their logs into a separate file: eg
copy header.log %1.log
for /l %%f in (801,1,831) do findstr /i /c:" /%1/" ex990%%f.log >> %1.log
%1 is the particular webspace I'm interested in extracting
Header.log includes the standard #Software: #Date: and #Fields: headers
that Analog needs to parse an extended log file.
FOR /L creates a loop running from 801 to 831, so that I can parse each of
my daily logs in sequence (ex990801.log, ex990802.log, etc)
FINDSTR is an NT command that searches for all occurrences of "
/webspace/". /i causes it to ignore case (note the leading space, so that I
don't get
" /otherweb/webspace/")
This month, I encountered a slight problem - I had turned on the "referer"
(sic) header in mid month, so I didn't have a consistent logfile format. It
turns out that I was able to use another parameter for FINDSTR to solve
this problem: /g causes FINDSTR to read the search strings from a file.
So I modified the batch file slightly to look like this:
echo #Date: > headers.txt
echo #Fields: >> headers.txt
echo #Software: Microsoft Internet Information Server 4.0 > %1.log
for /l %%f in (801,1,831) do findstr /i /c:" /%1/" /g:headers.txt
ex990%%f.log >> %1.log
del headers.txt
Now, when the logformat changes, it gets recorded in the parsed logfile.
Analog requires the #Software: field to be in the log, but it doesn't
change, so I just put it at the beginning.
One advantage of this approach is that I feel much more comfortable
allowing these webspaces to use Anlgform on the server, because their logs
are relatively small. Using FILEINCLUDE to allow them to run reports
against just their own webspace meant that they were parsing through about
100M of data every time they looked at a report, which isn't terribly
efficient. As the people interested in using this tool only represent about
15-20% of the actual logfiles, the duplicated disk space is not that big a
deal.
Aengus
------------------------------------------------------------------------
This is the analog-help mailing list. To unsubscribe from this
mailing list, send mail to [EMAIL PROTECTED]
with "unsubscribe analog-help" in the main BODY OF THE MESSAGE.
List archived at http://www.mail-archive.com/[email protected]/
------------------------------------------------------------------------
