no, I don't think the difference in 200s is due to the errors below. we have
the same situation here with overlapping logiles from different servers so
you can ignore that warning (in fact, I turned it off). the other warning
seems to relate to reporting of file types, not analysis.
if you know perl well - or know someone who does - you might want to create
a quick script to look into the 200s more closely. or do some complex greps
to narrow down where the differences are. for our logs I would try things
like:
grep -c 'html HTTP/1.1" 200 ' access_log.*
grep -c 'gif HTTP/1.1" 200 ' access_log.*
grep -c 'php HTTP/1.1" 200 ' access_log.*
grep -c 'cgi HTTP/1.1" 200 ' access_log.*
> No I do not have any exclude filters. When I run analog I
> don't I get the
> following error:
>
> "Warning C: In File Type Report, P, p, Q and q
> not allowed in COLS: ignoring them"
>
> "Warning L: logfiles
> /backup/logs/web2001/bpb/access_log.2001050401.gz and
> /backup/logs/web2001/bpb/access_log.20010505.gz overlap:
> possible double
> counting"
>
> Do you think it is because the errors above? The reason for
> double counting
> is because the two logs files are from different servers. The data is
> different and analog raises the error if the time is the same
> on different
> records. Correct me if I am wrong.
>
+------------------------------------------------------------------------
| This is the analog-help mailing list. To unsubscribe from this
| mailing list, go to
| http://lists.isite.net/listgate/analog-help/unsubscribe.html
|
| List archives are available at
| http://www.mail-archive.com/[email protected]/
| http://lists.isite.net/listgate/analog-help/archives/
| http://www.tallylist.com/archives/index.cfm/mlist.7
+------------------------------------------------------------------------
