OK I have debug turned on and here is what it gives me (don't fret the 4-16
is an old directory i just never replaced it to 5.01
root@log1cic# ./analog --version
This is analog version 5.01/Unix
For help see docs/Readme.html, or http://www.analog.cx/
F: Opening /usr/local/analog-4.16/analog-4.16/lang/uk.lng as language file
F: Closing language file /usr/local/analog-4.16/analog-4.16/lang/uk.lng
F: Opening /usr/local/analog-4.16/analog-4.16/lang/ukdom.tab as domains
file
F: Closing domains file /usr/local/analog-4.16/analog-4.16/lang/ukdom.tab
F: Opening /usr/local/analog-4.16/analog-4.16/lang/ukdesc.txt as report
descriptions file
F: Closing report descriptions file
/usr/local/analog-4.16/analog-4.16/lang/ukdesc.txt
F: Opening /usr/local/analog/analog/logs.log as logfile
F: Detect that it's in Microsoft's version of extended format
F: Closing logfile /usr/local/analog/analog/logs.log
S: Successful requests: 0
S: Redirected requests: 0
S: Failed requests: 0
S: Requests returning informational status code: 0
S: Status code not given: 3
S: Unwanted lines: 6
S: Corrupt lines: 0
S: No times in logfile
but here is the entire logfile stripped down ( for testing )
#Software: Microsoft Internet Information Services 5.0
#Version: 1.0
#Date: 2001-08-31 00:00:22
#Fields: date time c-ip cs-username s-sitename cs-method cs-uri-stem
cs-uri-query sc-status sc-win32-status sc-bytes cs-bytes time-taken cs-vers
ion cs-host cs(User-Agent) cs(Referer)
2001-08-31 00:00:22 1.96.5.58 - W3SVC3 GET /index.htm - 200 0 2763 230 0
HTTP/1.1 161.231.20.195 Mozilla/4.0+(compatible;+MSIE+5.5;+Windows+NT+4
.0) -
2001-08-31 00:00:23 1.96.5.58 - W3SVC3 GET /common/asp/top.asp GabbyTO=60
200 0 17463 259 1078 HTTP/1.1 161.231.20.195 Mozilla/4.0+(compatible;+
MSIE+5.5;+Windows+NT+4.0) -
2001-08-31 00:00:23 1.96.5.58 - W3SVC3 GET /common/html/control.htm - 200 0
1568 253 0 HTTP/1.1 161.231.20.195 Mozilla/4.0+(compatible;+MSIE+5.5
;+Windows+NT+4.0) -
2001-08-31 00:00:25 1.96.5.58 - W3SVC3 GET
/singleSignOn/asp/WCCPreSignOn.asp GabbyTO=60 200 0 5362 274 1500 HTTP/1.1
161.231.20.195 Mozilla/4.0
+(compatible;+MSIE+5.5;+Windows+NT+4.0) -
2001-08-31 00:00:25 1.96.5.58 - W3SVC3 GET /common/asp/monitor.asp
Action=Check_UNIX&GabbyTO=30 200 0 153 259 266 HTTP/1.1 161.231.20.195
Micros
oft+URL+Control+-+6.00.8862 -
2001-08-31 00:01:12 1.58.8.47 - W3SVC3 GET
/singleSignOn/asp/WCCSignOffProc.asp - 200 0 2587 830 16 HTTP/1.1 10.1.1.1
Mozilla/4.0+(co
mpatible;+MSIE+5.01;+Windows+NT) -
I have search all config files in my string (i run several split it up for
ease of reading) and none of them have LOGFORMAT in them now
Stephen Turner <[EMAIL PROTECTED]>@lists.isite.net on
09/13/2001 10:05:09 AM
Please respond to [EMAIL PROTECTED]
Sent by: [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
cc:
Subject: Re: [analog-help] having problem with a log file
On Wed, 12 Sep 2001 [EMAIL PROTECTED] wrote:
> I have a logfile as follows and my LOGFORMAT command is follows and a
> snippet of the log file I just keep getting errors. when running analog.
>
If you turn debugging on, it will tell you which lines were corrupt and
where they were corrupt. But if this logfile has a #Fields: line at the
top,
you don't need a LOGFORMAT at all. Delete it.
> 1st question I quess is can there be lines that begin with #'s in the log
> file?
You mean, you have lines like that in your logfile and you want to
understand them? You can have several LOGFORMATs for each logfile.
> 2nd do I have to escape the - characters?
>
No.
--
Stephen Turner http://www.statslab.cam.ac.uk/~sret1/
Statistical Laboratory, Wilberforce Road, Cambridge, CB3 0WB, England
"This is Henman's 8th Wimbledon, and he's only lost 7 matches." BBC,
2/Jul/01
+------------------------------------------------------------------------
| This is the analog-help mailing list. To unsubscribe from this
| mailing list, go to
| http://lists.isite.net/listgate/analog-help/unsubscribe.html
|
| List archives are available at
| http://www.mail-archive.com/[email protected]/
| http://lists.isite.net/listgate/analog-help/archives/
| http://www.tallylist.com/archives/index.cfm/mlist.7
+------------------------------------------------------------------------
+------------------------------------------------------------------------
| This is the analog-help mailing list. To unsubscribe from this
| mailing list, go to
| http://lists.isite.net/listgate/analog-help/unsubscribe.html
|
| List archives are available at
| http://www.mail-archive.com/[email protected]/
| http://lists.isite.net/listgate/analog-help/archives/
| http://www.tallylist.com/archives/index.cfm/mlist.7
+------------------------------------------------------------------------
