On Fri, 2 Jun 2000 [EMAIL PROTECTED] wrote:
> I have a Apache server writing 3 separate logs: access, referrer, browser.
> Access log line looks like this-
> cache-rp02.proxy.aol.com - - [29/May/2000:00:00:16 -0400] "GET /
> HTTP/1.0" 200 526
> Browser log line looks like this-
> 205.188.208.199 - - [29/May/2000:00:00:16 -0400] "GET / HTTP/1.0"
> Mozilla/4.0 (c
> ompatible; MSIE 5.0; AOL 5.0; Windows 98; DigExt)
>
My first comment is why are you recording the stuff in this way? You have
reorded almost all the data twice. If you just wrote a single logfile, it
would take up about half the space, and contain more information (because
you could measure bytes downloaded by each browser, for example).
> logformat commands are :
> for the access log
> APACHELOGFORMAT (%h %l %u %t \"%r\" %>s %b)
> for the referrer log
> APACHELOGFORMAT (%{Referer}i -> %U)
> for the browser log -
> APACHELOGFORMAT (%h %l %u %t \"%r\" %{User-agent}i)
>
> When I run it I get message "browser-log overlaps possible double
> counting"
> The html output shows "successful requests 733,314".
> If I remove the browser log from the files being scanned it then says
> "successful requests 488,565"
> Implying to me that there is indeed double counting happening. Am I correct
> in thinking this?
>
Yes.
> The manual says 'to get around counting requests that have been already
> counted
> specify a * in the item format string"
> I'm assuming that the %r field is the one being double counted? Is that
> correct?
Yes, and also the hosts.
> So I tried putting a * there-
> APACHELOGFORMAT (%h %l %u %t \"%*r\" %{User-agent}i)
> I also tried
> LOGFORMAT (%S %j %j [%d/%M/%Y:%h:%n:%j] "%*r" %B\n )
> The error message saying the files overlap goes away but now I get
> the errors "large number of corrupt lines" and "browser-file contains lines
> with no file names"
> and no browser or operating system report are produced.
>
* only works with the LOGFORMAT not the APACHELOGFORMAT.
The second one is fine except for the space after the \n. (And use %*S).
But as I say, you really want to change your LOGFORMAT. Just use this to
read legacy logs.
--
Stephen Turner http://www.statslab.cam.ac.uk/~sret1/
Statistical Laboratory, Centre for Mathematical Sciences,
Wilberforce Road, Cambridge, CB3 0WB, England
"8th March 2000. National No Smoking Day. Ash Wednesday." (On a calendar)
------------------------------------------------------------------------
This is the analog-help mailing list. To unsubscribe from this
mailing list, send mail to [EMAIL PROTECTED]
with "unsubscribe" in the main BODY OF THE MESSAGE.
List archived at http://www.mail-archive.com/[email protected]/
------------------------------------------------------------------------
