I've trolled the mail list archives and seen quite a few requests for
help with LOGFORMAT-related issues, but none quite on target with what
I'm experiencing. Apologies in advance for the length of this post; if
you're not interested in helping diagnose an odd problem, feel free to
delete this message now.
Here's my environment:
* Sparc/Solaris 7
* Netscape Enterprise 3.6
* Apache 1.3.20
* analog 5.03 (compiled first with gcc 2.8.1, then with 3.0.1 after
having problems)
Netscape log format:
* format=%Ses->client.ip% - %Req->vars.auth-user% [%SYSDATE%]
"%Req->reqpb.clf-request%" %Req->srvhdrs.clf-status%
%Req->srvhdrs.content-length%
* Analog handles Netscape logs fine, across several servers, some
with this format, others with a more complete format (referers &
browsers). This has been true for a few years, dating back to
analog 3.x, so I thought I knew what I was doing. :~) I also figured
this means my analog executable is essentially working.
Apache log format:
* Standard, uncustomized httpd.conf log definitions:
---
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\""
combined
CustomLog /usr/local/apache/logs/plan9_access_log combined
---
* Sample log entry:
---
toccata.3ge.com - - [02/Oct/2001:10:53:42 -0600] "GET / HTTP/1.0" 200
2369 "-" "Mozilla/4.78 [en] (Windows NT 5.0; U)"
---
* I just put in my first Apache web server recently, and analog 5.03
can't handle the log files. I have tried automatic mode, LOGFORMAT
COMBINED, explicit LOGFORMAT and explicit APACHELOGFORMAT. None
work, all fail with the same error:
---
analog: analog version 5.03/Unix
analog: Warning L: Large number of corrupt lines in logfile
/usr/local/apache/logs/plan9_access_log: try different LOGFORMAT
(For help on all errors and warnings, see docs/errors.html)
Current logfile format:
%S %j %u [%d/%M/%Y:%h:%n:%j] "%j%w%r%wHTTP%j" %c %b "%f" "%B"\n
%S %j %u [%d/%M/%Y:%h:%n:%j] "%j%w%r" %c %b "%f" "%B"\n
%S %j %u [%d/%M/%Y:%h:%n:%j] "%r" %c %b "%f" "%B"\n
---
* When I enable DEBUG C to find out what lines are failing, they all
-- every single one -- come back looking like this example:
---
C: toccata.3ge.com - - [02/Oct/2001:10:55:16 -0600] "GET / HTTP/1.0" 200
2369
C:
*
---
* Note that the input line evidently has been truncated right after the
%b, so analog rightly complains that the line is corrupted -- no "%f"
"%B" at the end. All complaints for all input lines are the same,
truncation right after %b. However the %b value itself is always
complete; none of the numbers are cut off early.
* If I quickly tweak the sample input line to look like the following,
there is a different failure mode. Note I removed the space between
the %b and "%f":
---
toccata.3ge.com - - [02/Oct/2001:10:53:42 -0600] "GET / HTTP/1.0" 200
2369"-" "Mozilla/4.78 [en] (Windows NT 5.0; U)"
---
* With the above input line, analog appears to read in the entire line
although it still (legitimately) fails with a "corrupted line" error:
---
C: toccata.3ge.com - - [02/Oct/2001:10:53:42 -0600] "GET / HTTP/1.0" 200
2369"-" "Mozilla/4.78 [en] (Windows NT 5.0; U)"
C:
*
---
* I also restored the input line and instead tweaked the analog
LOGFORMAT. Note I again removed the space between the %b and "%f":
---
LOGFORMAT (%S %j %u [%d/%M/%Y:%h:%n:%j] "%j%w%r%wHTTP%j" %c %b"%f" "%B")
---
* With the above LOGFORMAT, analog also appears to read in the entire
input line (this time for every line of log file), again failing with
a legit corrupted line error:
---
C: toccata.3ge.com - - [02/Oct/2001:10:53:42 -0600] "GET / HTTP/1.0" 200
2369 "-" "Mozilla/4.78 [en] (Windows NT 5.0; U)"
C:
*
---
Without going in and actually debugging the analog input file parsing
code, I'm at a loss to explain the observed behavior. I mentioned above
that I had previously compiled analog 5.03 with gcc 2.8.1. I was running
that version with Netscape Enterprise server fine for some period. After
having the problem with Apache, I immediately recompiled analog 5.03
from a fresh source install, with gcc 3.0.1. Same problems.
I have not yet taken the time to verify whether this behavior is present
with another Apache LogFormat, or with analog on any other platform such
as Windows.
Any ideas or tips from the list would be much appreciated. I don't know
whether to hope I'm just missing something blindingly obvious, or that
there is a real gremlin in there. :~) Thanks in advance!
Royce Howland
+------------------------------------------------------------------------
| This is the analog-help mailing list. To unsubscribe from this
| mailing list, go to
| http://lists.isite.net/listgate/analog-help/unsubscribe.html
|
| List archives are available at
| http://www.mail-archive.com/[email protected]/
| http://lists.isite.net/listgate/analog-help/archives/
| http://www.tallylist.com/archives/index.cfm/mlist.7
+------------------------------------------------------------------------
