a) I use version 4.01 on win 98 When I import my logfiles the format of the log is automatically detected to be like this(I'm using the Extended Common Format): LOGFORMAT (%S%w%j%w%Y-%m-%d%w%h:%n:%j%w%j%w%r%w%c%w%b%w%j%w"%B"%w"%f"%w%j\n) Unfortunately my server only uses "" when the browser and file strings(%B and %f) are sent by the browser. If not, the log entry field will only be -, not "-". Consequently many errors are reported. To remedy, I removed the "", so the LOGFORMAT became like the one below: LOGFORMAT (%S%w%j%w%Y-%m-%d%w%h:%n:%j%w%j%w%r%w%c%w%b%w%j%w%B%w%f%w%j\n) Now there are hardly any errors reported, but the browser string will only be read until the first space, and after that no information is read by the analyzer for the remainder of that line. Here are a copule of log lines: #Version: 1.0 #GMT-Offset: +0100 #Software: Spyglass_Prism/2.2fc5 #Start-Date: 1999-11-28 00:00:28 #Fields: c-ip c-auth-id date time cs-method cs-uri sc-status bytes rs(Content-Length) cs(User-Agent) cs(Referer) x-cachestatus #Date: 1999-11-28 00:00:27 212.17.128.60 - 1999-11-28 00:00:27 GET http://www.dagbladet.no/cgi-bin/go2?/nyheter/1999/11/27/184442.html 302 237 0 "Nokia-Communicator-WWW-Browser/3.0 (Geos 3.0 Nokia-9110)" - Miss 212.17.128.60 - 1999-11-28 00:00:32 GET http://www.dagbladet.no:80/nyheter/1999/11/27/184442.html 200 18914 0 "Nokia-Communicator-WWW-Browser/3.0 (Geos 3.0 Nokia-9110)" - Miss 212.17.128.4 - 1999-11-28 00:00:54 GET http://www.sol.no/cgi-bin/go4/1_sak_3/http:/www.sol.no/cgi-bin/diskuter/disk uter.cgi/nettflort/16-19/ 302 244 0 "Nokia-Communicator-WWW-Browser/3.0 (Geos 3.0 Nokia-9110)" - Miss 212.17.128.40 - 1999-11-28 00:00:49 GET http://search.msn.no/spresults.asp?UN=doc&Form=IE4&CY=no&MT=exite&CO=50&UDo= &ULo=europe&LA=english&TP=&DF=&summaryCheck=on 200 48944 48944 "Mozilla/4.0 (compatible; MSIE 5.0; Windows 98; DigExt; Nomade)" "http://search.msn.no/spbasic.htm" Miss I attach this as a text file also: <<log.txt>> Fields are separated by tabs. In the first line the browser is the Nokia-Comunicator-WWW-Browser/3.0 etc. In the browser report information after ...3.0 will not be read because here comes the first space within the browser string. It will be mistaken for the whitespace which is supposed to be the tab after the ...9110)". I hope you can see my problem. If only I could specify a tab specifically(like %wt(whitespace-tab) and %ws(whitespace-space or some other one character escape character), that couldn't be mistaken for a space, I would be allright. mvh/Best Regards Trond Arild Tobiassen ___________________________________________________________________________ Telenor Mobil AS Postboks 6746 St. Olavs plass 0130 Oslo Office: Universitetsgt. 7 Phone numbers: Office: +47 22 78 41 14 Fax: +47 22 11 55 64 Faxmail: +47 91 45 15 09 Cellular: +47 91 71 46 58 Other e-Mail adresses: [EMAIL PROTECTED], Directly to my GSM phone
#Version: 1.0 #GMT-Offset: +0100 #Software: Spyglass_Prism/2.2fc5 #Start-Date: 1999-11-28 00:00:28 #Fields: c-ip c-auth-id date time cs-method cs-uri sc-status bytes rs(Content-Length) cs(User-Agent) cs(Referer) x-cachestatus #Date: 1999-11-28 00:00:27 212.17.128.60 - 1999-11-28 00:00:27 GET http://www.dagbladet.no/cgi-bin/go2?/nyheter/1999/11/27/184442.html 302 237 0 "Nokia-Communicator-WWW-Browser/3.0 (Geos 3.0 Nokia-9110)" - Miss 212.17.128.60 - 1999-11-28 00:00:32 GET http://www.dagbladet.no:80/nyheter/1999/11/27/184442.html 200 18914 0 "Nokia-Communicator-WWW-Browser/3.0 (Geos 3.0 Nokia-9110)" - Miss 212.17.128.4 - 1999-11-28 00:00:54 GET http://www.sol.no/cgi-bin/go4/1_sak_3/http:/www.sol.no/cgi-bin/diskuter/diskuter.cgi/nettflort/16-19/ 302 244 0 "Nokia-Communicator-WWW-Browser/3.0 (Geos 3.0 Nokia-9110)" - Miss 212.17.128.40 - 1999-11-28 00:00:49 GET http://search.msn.no/spresults.asp?UN=doc&Form=IE4&CY=no&MT=exite&CO=50&UDo=&ULo=europe&LA=english&TP=&DF=&summaryCheck=on 200 48944 48944 "Mozilla/4.0 (compatible; MSIE 5.0; Windows 98; DigExt; Nomade)" "http://search.msn.no/spbasic.htm" Miss
