If only one line is desired for all log entries that
begin with "/case/book/buy", then the following
might be helpful (covered in docs/args.html):
ARGSEXCLUDE /case/book/buy*
-- Duke Hillard
[EMAIL PROTECTED] wrote:
> I need some help with monitoring this one url that shows up with
> multiple parameters in the request section.
> For example I need to monitor www.abc.com/case/book/buy
> The thing is that the url shows up in the logs in multiple formats like
>
> www.a.com - - [01/Jan/2001:00:10:11 -0700] "GET /case/book/buy
> HTTP/1.0" 200 11111
> www.me.com - - [01/Jan/2001:00:10:11 -0700] "GET /case/book/buy?this=1234
> HTTP/1.0" 200 11111
> www.him.com - - [01/Jan/2001:00:10:11 -0700] "GET /case/book/buy?here=ABCD
> HTTP/1.0" 200 11111
> www.her.com - - [01/Jan/2001:00:14:11 -0700] "GET /case/book/buy?hey=SKDSKLDSKDS
> HTTP/1.0" 200 11111
> etc.
>
> I tried using this
> REQINCLUDE /case/book/buy*
> REQINCLUDE *cas*
> REQINCLUDE *book*
> REQINCLUDE */case/book/buy*
> REQINCLUDE */case/book/buy?*
> PAGEINCLUDE */
>
> This does not work I end up getting a bunch of requests in my report like
> /case/book/buy.rm
> /this_book
> etc.
>
> I tried putting this in along with everything above
> FILEINCLUDE /case/book/buy*
>
> Then it complains of this and produces an empty log file.
> /usr/bin/analog: analog version 4.16/Unix
> /usr/bin/analog: Warning R: Turning off empty time reports
> (For help on all errors and warnings, see docs/errors.html)
> /usr/bin/analog: Warning R: Turning off empty Request Report
> /usr/bin/analog: Warning R: Turning off empty File Type Report
> /usr/bin/analog: Warning R: Turning off empty Directory Report
> /usr/bin/analog: Warning R: Turning off empty Domain Report
> /usr/bin/analog: Warning R: Turning off empty Organisation Report
> /usr/bin/analog: Warning R: Turning off empty Search Word Report
> /usr/bin/analog: Warning R: Turning off empty Operating System Report
> /usr/bin/analog: Warning R: Turning off empty File Size Report
> /usr/bin/analog: Warning R: Turning off empty Status Code Report
>
> Any help would be appreciated.
>
> Free, encrypted, secure Web-based email at www.hushmail.com
begin:vcard
n:Hillard;Duke
tel;work:337-482-5763
x-mozilla-html:TRUE
url:http://www.louisiana.edu/
org:University of Louisiana at Lafayette;University Computing Support Services
adr:;;P.O. Box 42770;Lafayette;LA;70504-2770;USA
version:2.1
email;internet:[EMAIL PROTECTED]
title:Computing Resources Coordinator
fn:Duke Hillard
end:vcard
