Aengus,
I wasn't sure how to use Logformat to capture the lines I don't want to measure. However your mail gave me the idea to use a specific Logformat to capture the lines that I do want to measure. I changed my Logformat to the following:
LOGFORMAT (%s, %u, %d/%m/%y, %h:%n%j, %j, %v, %j, %j, %j, %j, %b, %j, [%j]%j, abcuser, %j,)
This works fine now. It counts instances of users passing their username only. For reports where I want to show specific files downloaded, I can just change the end of the line to the appropriate filename.
I guess the pie graph with the title "This report lists the computers which requested files." actually shows all connections as specified with my LOGFORMAT. The user didn't necessarily request a file. Am I correct?
Thanks for all your help.
Regards
Andrew
-----Original Message-----
From: Aengus [mailto:[EMAIL PROTECTED]]
Sent: 17 October 2001 13:52
To: analog-help
Subject: Re: [analog-help] MS IIS4 MS IIS Log file Format (from FTP)
"Andrew Gaskell" <[EMAIL PROTECTED]> wrote:
> That's great Aengus. It works now. Thank-you.
>
> I need to tidy up the output though. Analog is treating every FTP
command as
> a separate request. It therefore appears from the report, that there are
> more separate connections than there really are. So:
>
> xx.xx.xx.xxx, someuser, 10/8/01, 8:01:14, MSFTPSVC1, servername,
> yy.yy.yyy.yyy, 0, 0, 0, 331, 0, [1038]USER, abcuser, -,
> xx.xxx.xx.xxx, someuser, 10/8/01, 8:01:14, MSFTPSVC1, servername,
> yy.yy.yyy.yyy, 0, 0, 0, 230, 0, [1038]PASS, -, -,
> xx.xxx.xx.xxx, someuser, 10/8/01, 8:01:18, MSFTPSVC1, servername,
> yy.yy.yyy.yyy, 0, 0, 0, 226, 0, [1038]sent, /abclatest/abcalert.rtf, -,
> xx.xxx.xx.xxx, someuser, 10/8/01, 8:01:19, MSFTPSVC1, servername,
> yy.yy.yyy.yyy, 701, 0, 734, 226, 0, [1038]sent,
/abclatest/abcalert.rtf, -,
>
> Appears as FOUR requests. Since this routine happens everytime a user
> connects to the server (including the sent file) I want only ONE request
to
> be returned.
>
> Any further instances of the above 4 FTP requests should each return ONE
> request in the Analog summary.
>
> Is this possible in Analog?
You could try something like
LOGFORMAT (%j 0, 0, 0, %j)
to capture the lines you don't want to measure. (The examples you gave
have 3 0, fields in the lines you want to ignore - I don't know if this
would always be the case).
Aengus
+------------------------------------------------------------------------
| This is the analog-help mailing list. To unsubscribe from this
| mailing list, go to
| http://lists.isite.net/listgate/analog-help/unsubscribe.html
|
| List archives are available at
| http://www.mail-archive.com/[email protected]/
| http://lists.isite.net/listgate/analog-help/archives/
| http://www.tallylist.com/archives/index.cfm/mlist.7
+------------------------------------------------------------------------
