Walter Greenwood wrote:
> Thanks for the suggestion. I created a custom Logformat entry for the
> ssl_request_log. (to avoid double counting the GETs and bytes, I used %j)
>
> LOGFORMAT ([%d/%M/%Y:%h:%n:%j %j] %S %B %u "%j %j %j" %j)
>
> [19/Jan/2001:06:51:25 -0800] 127.0.0.1 SSLv3 RC4-MD5 "GET / HTTP/1.1"
> 11841
> [19/Jan/2001:09:30:42 -0800] 127.0.0.1 TLSv1 EDH-RSA-DES-CBC3-SHA "GET /
> HTTP/1.0" 8214
If you don't want to double count requests, then use %*r (see
docs/logfmt.html).
However, then I'm not sure that you even need to parse the log (unless,
as you show, you just want to get an idea of what protocols are being
used by the requesting agents).
> The ssl_engine_log has 5 lines per request, so it wouldn't work with this
> file.
>
> [19/Jan/2001 09:30:40 00571] [info] Connection to child 5 established
> (server localhost:443, client 127.0.0.1)
This is an informative log. Analog won't parse it because it's not meant
to be parsed -- it's meant to be read. See the FAQ, regarding parssing
an error log.
--
Jeremy Wadsack
Wadsack-Allen Digital Group
------------------------------------------------------------------------
This is the analog-help mailing list. To unsubscribe from this
mailing list, send mail to [EMAIL PROTECTED]
with "unsubscribe" in the main BODY OF THE MESSAGE.
List archived at http://www.mail-archive.com/[email protected]/
------------------------------------------------------------------------
