Ahsan Imam wrote:
> Hello,
> I am trying to estimate the session based on the following
> logformat in ANALOG.CFG:
> (%u %i %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %v).
>
> Sample line from logfile:
> 63.228.147.160.5770984639909332 - [15/Mar/2001:00:05:09 -0700] "GET
> /palette4/current/cover.gif HTTP/1.1" 200
> 4409 "http://www.newtimes.com/" "Mozilla/4.0 (compatible; MSIE 5.0; Windows
> 98; DigExt)" www.newtimesbpb.com
>
> With this format I was able to turn on the User report. However the count I
> get is higher than the following method I used to get a count. I am off
> 10,000.
>
> gawk '{print $1}' logfile | sort | uniq | wc --lines.
>
> I am assuming that the user report will return the unique user based on %u.
>
> What does the user report represent?
Give a report of the number of requests, pages, bytes, etc. sent to each
"user" for whatever you have defined "user" to be.
> Is this method a good way of approximating session s?
I'm assuming that the field you've chosen for %u is your servers session
cookie. If so this is the closest you can probably get. See
docs/webworks.html for reasons why this can't be done precisely.
> Is my counting method using gawk valid?
Not really because it doesn't take into account failed or incomplete
requests. If you got a higher number from Analog than gawk you might
want to run 'analog -settings' to see if Analog is including another
logfile in addition to the one you think it is.
--
Jeremy Wadsack
Wadsack-Allen Digital Group
------------------------------------------------------------------------
This is the analog-help mailing list. To unsubscribe from this
mailing list, send mail to [EMAIL PROTECTED]
with "unsubscribe" in the main BODY OF THE MESSAGE.
List archived at http://www.mail-archive.com/analog-help@lists.isite.net/
------------------------------------------------------------------------
