Thanks for your help - I tried your format statement - it didn't work either so
I am attaching my .cfg file and a pared down log file - I can't see what I am
doing wrong
Aengus Lawlor wrote:
> Harry Lebowitz wrote:
>
> >Here is my present format statement in my analog.cfg file, can someone
> >help me change it so it will analyze my typical log entries below
> >
> >LOGFORMAT (%s %j %j [%d/%M/%Y:%h;%j:%j %j] "%j%w%r%wHTTP%j" %c %j
> >"%j"
>
> You need to close your parentheses. When I add the closing paranthesis, I
> get the following error message:
> C:\ANALOG\ANALOG.EXE: ...cont..: (reason: time without date or vice versa)
>
> Let's see, you've got ;%j for the minutes in the time section. Fix that, and
> we've got
> LOGFORMAT (%s %j %j [%d/%M/%Y:%h:%n:%j %j] "%j%w%r%wHTTP%j" %c %j "%j")
>
> Fix that, and now I get a star just before the response code - sure enough,
> you have 2 spaces in your LOGFORMAT, only one in the logfile
>
> LOGFORMAT (%s %j %j [%d/%M/%Y:%h:%n:%j %j] "%j%w%r%wHTTP%j" %c %j "%j")
>
> Now we encounter a problem because your first log line one has one quoted
> string at the end, and the others have two. But it doesn't really matter,
> because you're throwing evertything away after the response code anyway, so
> LOGFORMAT (%s %j %j [%d/%M/%Y:%h:%n:%j %j] "%j%w%r%wHTTP%j" %c %j)
> will do nicely, though I'd probably recommend
> LOGFORMAT (%s %j %j [%d/%M/%Y:%h:%n:%j %j] "%j%w%r%wHTTP%j" %c %b %j)
> instead
>
> Better yet, delete that malformed first line, and you don't need a LOGFORMAT
> statement at all
>
> >38.32.10.81 - - [19/Jul/2000:00:00:00 +0500] "GET
> >/er/box/fcsts/BOSZFPBOX HTTP/1.0" 200
> >5590 ""
> >63.140.184.164 - - [19/Jul/2000:00:00:01 +0500] "HEAD /er/archive.htm
> >HTTP/1.0" 404 0 ""
> >"DaviesBot 1.7 (wwww.wholeweb.net"
> >208.231.154.29 - - [19/Jul/2000:00:00:01 +0500] "GET
> >/cgi-bin/mgetmetar.pl?cccc=KFDY
> >HTTP/1.1" 500 226 "" "Mozilla/2.0 (compatible; MSIE 3."
> >207.244.124.104 - - [19/Jul/2000:00:00:01 +0500] "GET
> >/er/box/fcsts/BOSTORBOS.html
> >HTTP/1.0" 200 901 "" "Wget/1.5.3"
> >204.123.28.10 - - [19/Jul/2000:00:00:01 +0500] "GET
> >/graphics/buttons/beginning.gif HTTP/1.0"
> >200 659 "" "Mercator-1.0"
>
> Aengus
>
> ------------------------------------------------------------------------
> This is the analog-help mailing list. To unsubscribe from this
> mailing list, send mail to [EMAIL PROTECTED]
> with "unsubscribe" in the main BODY OF THE MESSAGE.
> List archived at http://www.mail-archive.com/[email protected]/
> ------------------------------------------------------------------------
analog.cfg
63.140.184.164 - - [19/Jul/2000:00:00:01 +0500] "HEAD /er/archive.htm HTTP/1.0" 404 0
""
"DaviesBot 1.7 (wwww.wholeweb.net"
208.231.154.29 - - [19/Jul/2000:00:00:01 +0500] "GET /cgi-bin/mgetmetar.pl?cccc=KFDY
HTTP/1.1" 500 226 "" "Mozilla/2.0 (compatible; MSIE 3."
207.244.124.104 - - [19/Jul/2000:00:00:01 +0500] "GET /er/box/fcsts/BOSTORBOS.html
HTTP/1.0" 200 901 "" "Wget/1.5.3"
204.123.28.10 - - [19/Jul/2000:00:00:01 +0500] "GET /graphics/buttons/beginning.gif
HTTP/1.0"
200 659 "" "Mercator-1.0"
207.244.124.104 - - [19/Jul/2000:00:00:01 +0500] "GET /er/box/fcsts/BOSSVRBOS.html
HTTP/1.0" 200 932 "" "Wget/1.5.3"
165.247.161.133 - - [19/Jul/2000:00:00:01 +0500] "GET /HTTP/1.1" 200 25164
"http://search.msn.com/results.asp?ba=30.0&FORM=SMCRT&RS=CHECKED&;" "Mozilla/4.0
(compatible; MSIE 5."
129.15.195.46 - - [19/Jul/2000:00:00:01 +0500] "GET /tdl/radar/NE_probltg.gif
HTTP/1.0" 304 0
"" "LWP::Simple/5.48"
129.15.195.46 - - [19/Jul/2000:00:00:01 +0500] "GET /tdl/radar/SE_probltg.gif
HTTP/1.0" 304 0
"" "LWP::Simple/5.48"
129.15.195.46 - - [19/Jul/2000:00:00:01 +0500] "GET /tdl/radar/NC_probltg.gif
HTTP/1.0" 304 0
"" "LWP::Simple/5.48"
4.20.188.119 - - [19/Jul/2000:00:00:01 +0500] "GET /HTTP/1.1" 200 25164 "" "Mozilla/4.0
(compatible; AlterEg"
129.15.195.46 - - [19/Jul/2000:00:00:01 +0500] "GET /tdl/radar/SC_probltg.gif
HTTP/1.0" 304 0
"" "LWP::Simple/5.48"
209.113.185.7 - - [19/Jul/2000:00:00:01 +0500] "GET /er/box/shtml/xm04.shtml HTTP/1.1"
200
936 "" "Mozilla/4.0 (compatible; MSIE 5."
129.15.195.46 - - [19/Jul/2000:00:00:01 +0500] "GET /tdl/radar/NW_probltg.gif
HTTP/1.0" 304
0 "" "LWP::Simple/5.48"
129.15.195.46 - - [19/Jul/2000:00:00:01 +0500] "GET /tdl/radar/SW_probltg.gif
HTTP/1.0" 304
0 "" "LWP::Simple/5.48"
209.221.176.184 - - [19/Jul/2000:00:00:01 +0500] "GET /er/box/fcsts/BOSTPTWRN.html
HTTP/1.0" 200 1144 "" "libwww-perl/5.48"
209.221.176.184 - - [19/Jul/2000:00:00:01 +0500] "GET /er/box/fcsts/BOSTPTPAN.html
HTTP/1.0" 200 1729 "" "libwww-perl/5.48"
169.240.105.79 - - [19/Jul/2000:00:00:01 +0500] "GET /HTTP/1.1" 200 25164
"http://www.noaa.gov/wx.html" "Mozilla/4.0 (compatible; MSIE 4."
