Hello, I have made the changes to my logformat but I'm still having problems. My logformat doesn't seem to be read properly, browser and referer reports are reversed and still do not see a report for search, even though that report is on. I used the bigbyrep.cfg file in the examples folder as a starting point, and made changes to customize.
My logformat now looks like this: LOGFORMAT (%S%j[%d/%M/%Y:%h:%n:%j%j] "%j%w%rHTTP%j" %c%b "%B" "%f") LOGFILE RR_Jan2002/mysite.bc.caJan1.hst I tried taking out all the spaces but results are the same with or without. I'm at a loss as to what to look at next. Any other suggestions? Thank you so much for the help so far. Laura. ----- Original Message ----- From: "Aengus" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Sunday, March 10, 2002 10:43 AM Subject: Re: [analog-help] Newbie, Problems with SearchWord, SearchQuery, BrowserRep and BrowserSum > "Laura Bucci" <[EMAIL PROTECTED]> wrote: > > > #LOGFORMAT (%S %j %j [%d/%M/%Y:%h:%n:%n %j %j] "%j%w%rHTTP%j" %c %b > > "%B" "%f") > > > This is a line from the raw log: > > 211.117.39.40 - - [01/Jan/2002:00:04:23 -0800] "GET > /services/services.html > > HTTP/1.1" 200 15172 "Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; > > Win 9x 4.90)" > "http://www.altavista.com/sites/search/web?q=WOMEN+RAPE&pg=q&kl=XX"; > > > The logs are created by a unix server. I've downloaded them to my > > windows machine to interpret them. Before I didn't have the logformat > > line, but even with the line above I'm getting the same results, > > meaning the report looks fine except for the browser, and search > > word/phrase reports, I'm not sure if the referrer report is correct. > > > > Could it be that there are errors in my logformat as I've written it > > Your LOGFORMAT as posted starts with a comment indicator (#) - that means > that analog ignores that line, and uses it's own internal logic to > recognize the line. > > If you take the comment out, Analog will complain about the :%n:%n that > you have in the time section, so if you change the time section of your > logformat to > [%d/%M/%Y:%h:%n:%j %j] > then Analog will read the sample line you include above, and show a single > search query of "women rape" and 2 search words of "women" and "rape", and > the browser report has a single entry for "Mozilla/4.0 (compatible; MSIE > 5.5; Windows 98; Win 9x 4.90)", while the Browser Summary shows and entry > for MSIE / MSIE/5. > > > or do I > > need additional LOGFORMAT lines such as LOGFORMAT BROWSER and > LOGFORMAT > > REFERRER. Would these go above or below LOGFORMAT / APACHELOGFORMAT > > The standard Combined log is basically the same as the example that you > posted, except that it has the referrer before the Browser. It looks as > though Analog is trying to parse your Log as a Combined log, and ends up > parsing the Referrer string as a Browser string, and can't find any query > string in what it things is the Referrer (but is actually the Browser > string). It looks as though you were on the right line above, but that you > inadvertently commented out your LOGFORMAT line. > > Aengus > > +------------------------------------------------------------------------ > | This is the analog-help mailing list. To unsubscribe from this > | mailing list, go to > | http://lists.isite.net/listgate/analog-help/unsubscribe.html > | > | List archives are available at > | http://www.mail-archive.com/[email protected]/ > | http://lists.isite.net/listgate/analog-help/archives/ > | http://www.tallylist.com/archives/index.cfm/mlist.7 > +------------------------------------------------------------------------ +------------------------------------------------------------------------ | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to | http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at | http://www.mail-archive.com/[email protected]/ | http://lists.isite.net/listgate/analog-help/archives/ | http://www.tallylist.com/archives/index.cfm/mlist.7 +------------------------------------------------------------------------
