>Also remember that NT IIS4 will invariably add extra status lines into
>your log files. These are called the MS-EXTENDED headers. They
>identify when a logging pattern has changed. I found out that Analog
>barfs when these headers get placed anywhere else inside the logfile
>other than the first few lines of the logfile.
This isn't my experience at all. I regularly run Analog against W3C
Extended logs with headerlines mid stream - I even make sure to extract
all header lines when I extract a subset of log entries, in case there
is a change of format in mid log.
Analog requires the #Software: header be at the start of the log, but
that's okay, because that's where IIS puts it!
2. Can Analog be trained to handle mid-logfile
header changes using the MS-EXTENDED logformat?
I'm a little bit confused by your reference to MS-Extended - my copy of
IIS4 supports 3 log formats by default - IIS, NCSA and W3C-Extended.
What does your MS-Extended log look like?
Aengus
------------------------------------------------------------------------
This is the analog-help mailing list. To unsubscribe from this
mailing list, send mail to [EMAIL PROTECTED]
with "unsubscribe" in the main BODY OF THE MESSAGE.
List archived at http://www.mail-archive.com/[email protected]/
------------------------------------------------------------------------
