Ian,
The short answer is that it appears ANALOG is telling you the right information since you only have one entry in your log file
02:15:38 203.23.143.58 - - 500
The squares you see in the file are special characters that IIS uses to give the file some size so IIS doesn't have to resize the file every time it adds new logging information. The squares are *not* logging information. When IIS closes the file to open a new one for the next day, it removes the special characters, leaving just the log text. IIS Log files are text files that you should be able to read in NOTEPAD. Since your file still has these special characters at the end suggests that the log file is either (1) corrupt because it was not properly closed by IIS or (2) is still in use by IIS, in which case, MS WORD would ask to open the file in read-only mode because IIS still has it open.
If you are sure the file is no longer being used by IIS, I recommend deleting the special characters at the end. This leaves only the one line you have immediately following the heading. This means the file you are using for your test is not very interesting since it contains just one line of logging information. I think you should try testing ANALOG with another file that has more logging information. If all of your files are like this one then I think you are having a problem with the IIS logging feature.
The reason ANALOG doesn't give you much from the one line is because the line doesn't include the page that was visited. See the following from one of my log files:
2001-07-17 00:25:19 203.96.111.202 - 64.51.230.194 80 GET /Interim1/default.asp - 200 0 0 148 469 HTTP/1.0 www.surveycrafter.com Mozilla/3.01+(compatible;) -
I am using extended logging so there are more columns than the default logging, but you see "/Interim1/default.asp". This is the page that was visited by the person from the 203.96.111.202 IP address. If your logs do not contain pages that were visited, I'm not sure what ANALOG can do for you.
Look
for another log file that has rows with time/date, IP addresses, and web site
page information and use it instead to test
ANALOG.
I hope this helps.
Richard
-----Original Message-----
From:
[EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of Ian Time Trek
(Aust) Help Desk
Sent: Tuesday, July 17, 2001 10:36 PM
To:
'[EMAIL PROTECTED]'
Subject: RE: [analog-help]
The log is for only 1 day, just so I can test Analog to see if it gives me the info I need.
My file differs from yours after these 2 lines.
#Fields: time c-ip cs-method cs-uri-stem sc-status
02:15:38 203.23.143.58 - - 500From here I have in Word 14 pages of squares.
Is it necessary to convert these squares in some way, or is there a command to interpret what is in these squares.
Ian
-----Original Message-----
From: Richard Z. Ward [mailto:[EMAIL PROTECTED]]
Sent: Wednesday, 18 July 2001 11:18 AM
To: [EMAIL PROTECTED]
Subject: RE: [analog-help]
Ian,
Is that the log file in its entirety? If so, it looks like your log file was
turned on on October 23, 2000 and then turned off shortly thereafter or no
one has visited your web site since October 23, 2000?This is a piece of one of my log files (I'm using IIS 5.0)
#Software: Microsoft Internet Information Services 5.0
#Version: 1.0
#Date: 2001-07-17 00:25:19
#Fields: date time c-ip cs-username s-ip s-port cs-method cs-uri-stem
cs-uri-query sc-status sc-win32-status sc-bytes cs-bytes time-taken
cs-version cs-host cs(User-Agent) cs(Referer)
2001-07-17 00:25:19 203.96.111.202 - 64.51.230.194 80 GET / - 302 0 257 650
15 HTTP/1.0 www.surveycrafter.com
Mozilla/4.0+(compatible;+MSIE+6.0b;+Windows+NT+5.0)
http://search.yahoo.com/bin/search?p=Web+based+polling
2001-07-17 00:25:19 203.96.111.200 - 64.51.230.194 80 GET / - 302 0 257 278
0 HTTP/1.0 www.surveycrafter.com Mozilla/3.01+(compatible;) -
2001-07-17 00:25:19 203.96.111.202 - 64.51.230.194 80 GET
/Interim1/default.asp - 200 0 0 148 469 HTTP/1.0 www.surveycrafter.com
Mozilla/3.01+(compatible;) -
2001-07-17 00:25:20 203.96.111.200 - 64.51.230.194 80 GET
/Interim1/default.asp - 200 0 0 148 563 HTTP/1.0 www.surveycrafter.com
Mozilla/3.01+(compatible;) -There are many rows that follow. I have it set up so a new log file is used
each day rather than having one gigantic log file.If your log file is essentially empty, you may want to look at the logfile
settings in the Internet Information Manager to see if logging is turned on.
You may also want to double-check where the log files actually live. I
forget how this goes with IIS 4.0.I'm not sure if this is helping.
Richard
-----Original Message-----
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of Ian Time Trek (Aust)
Help Desk
Sent: Tuesday, July 17, 2001 9:13 PM
To: '[EMAIL PROTECTED]'
Subject: [analog-help]
I have just downloaded Analog version 5.03 and I have an issue that I cannot
solve.
Each time I run Analog I get the following results.
Successful requests: 0
Logfile lines without status code: 3
Corrupt logfile lines: 5
I believe it is my logfile, but I am not sure what LOGFORMAT command I need
to use. This is an extract of my log file.
#Software: Microsoft Internet Information Server 4.0
#Version: 1.0
#Date: 2000-10-23 02:15:39
#Fields: time c-ip cs-method cs-uri-stem sc-status
02:15:38 203.23.143.58 - - 500
followed by 22 lines of squares.
Can anyone guide me to the correct LOGFORMAT.
Ian+------------------------------------------------------------------------
| This is the analog-help mailing list. To unsubscribe from this
| mailing list, go to
| http://lists.isite.net/listgate/analog-help/unsubscribe.html
|
| List archives are available at
| http://www.mail-archive.com/[email protected]/
| http://lists.isite.net/listgate/analog-help/archives/
| http://www.tallylist.com/archives/index.cfm/mlist.7
+------------------------------------------------------------------------
