"Rodney Knott" <[EMAIL PROTECTED]> wrote: > I got those lines from the fields string at the top of the log > file, but when I did not specify a logformat command it said > that the closest that it found was the w3 extended and it would > use that but it only worked for less than 2% of the lines and > the others it gave me corrupt lines errors. I am enclosing a > sample of the log. It is the first 10-20 lines of the log file.
And it's not the same format as the example you posted at the start of the thread. Your date format has changed from 2002-01-12 to 1/12/2002, and you've added an extra field between the port number and the protocol (there were two in the line you posted at the start of the thread, and now there are 3). LOGFORMAT (%S\t%u\t%B\t%m/%d/%Y\t%h:%n:%j\t%j\t%j\t%v\t%j\t%j\t%j\t%b\t%T\t%j\t%j\t% r\t%j\t%c)" Before you waste any more time on this, just change your logformat back to the default W3C format. It's self documenting, and doesn't require you to specify any LOGFORMAT string, and gives you more flexibility, without losing any of the information in the ISA logformat. http://www.isaserver.org/pages/tutorials/configuring_isa_server_log_files. htm Aengus +------------------------------------------------------------------------ | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to | http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at | http://www.mail-archive.com/[email protected]/ | http://lists.isite.net/listgate/analog-help/archives/ | http://www.tallylist.com/archives/index.cfm/mlist.7 +------------------------------------------------------------------------
