On Tue, 23 Nov 1999, Benjamin Elijah Griffin wrote:
>
> Here's what I am using:
>
> LOGFORMAT (%u %S - %j [%d/%M/%Y:%h:%n:%j %j] "%j %r %j" %c %b "%f" "%B")
>
> And I seem to get 'corrupt' log file errors where I can't figure out
> the error, even with the little error flag. Eg:
>
> C: "geoffmac.lanminds.com" - - [09/Nov/1999:23:25:41 -0800] "GET /images/ph2.jpg
>HTTP/1.0" 200 19910 "http://store.cddb.com/news.html" "Mozilla/4.51 (Macintosh; I;
>PPC)"
> C: *
>
> For the benefit of those for whom that line has folded, the '*'
> is at the 54th char on the line, which corresponds to the '-' of
> the time zone ('-0800'). Why isn't the %j working on that line?
>
No, the problem is that the %u is missing. (Also, you should have the %S in
quotes, it seems).
Analog hasn't diagnosed this very helpfully because it can make some sense
of it up until then:
%u = "geoffmac.lanminds.com"
%S = -
- = -
%j = [09/Nov/1999:23:25:41
[ = oh whoops, I got a - instead of a [
> Also I find the documentation a little bit vague on two points
> so far:
>
> 1 Can I specify multiple log formats to try to apply? If so how
> is precedence determined?
Yes, first match applies. This is spelled out in gory detail in
docs/logfmt.html.
> 2 What exactly does %j mean? I'm very comfortable with regular
> expressions, do a definition in terms of regular expressions would
> be useful. My guess is that it is something akin to /.*?/ in Perl.
>
Well, it's actually something like /.*?(?=c)/ where c is the character
(often just a space) after the %j. In words, it matches everything up to the
first c, but not including c itself.
--
Stephen Turner [EMAIL PROTECTED] http://www.statslab.cam.ac.uk/~sret1/
Statistical Laboratory, 16 Mill Lane, Cambridge CB2 1SB, England
"As always, it's considered good practice to temporarily disable any
virus detection software prior to installing new software." (Netscape)
------------------------------------------------------------------------
This is the analog-help mailing list. To unsubscribe from this
mailing list, send mail to [EMAIL PROTECTED]
with "unsubscribe analog-help" in the main BODY OF THE MESSAGE.
List archived at http://www.mail-archive.com/[email protected]/
------------------------------------------------------------------------
