From: "Aengus" <[EMAIL PROTECTED]> > "Carsten B�ttcher" <[EMAIL PROTECTED]> wrote: > > > The admin had added a new field at the end of the fileformat... > > (you can see the IP) > > > > 195.206.128.91 - - [13/Mar/2002:09:50:00 +0100] "GET > > /spots/sevenone/demo/airmarin/anfang176x144.gif HTTP/1.0" 200 > > 10103 217.160.73.138 "-" "Mozilla/4.0 (compatible; MSIE 6.0; > > Win32)" "192.168.100.44" > > > > The admin wrote to me with the information that the field is > > named "X-Forwarded-For". It is used by HTTP-Header-Entry wich > > is used by HTTP-Proxy-Server. > > > > Any idea to integrate the last field in the format you sent me ? > > > > LOGFORMAT (%S %j %u [%d/%M/%Y:%h:%n:%j] "%j%w%r%wHTTP%j" %c %b > > %v "%f" "%B") > > > > If you have any idea please let me know.... > > Analog doesn't have any specific support for "X-Forwarded-For" > (though I can see how it might be useful). Normally when you need > to make a report on an unsupported field, you use the User report > or the virtual host report, but your are using both of these > already. But if you only have one server, and all your log files > have 217.160.73.138 in the field before the referrer, then you > can ignore that field, and use the Virtual Host report for the > extra field instead. > > LOGFORMAT (%S %j %u [%d/%M/%Y:%h:%n:%j] "%j%w%r%wHTTP%j" %c %b > 217.160.73.138 "%f" "%B" %v)
Just after I sent this, I realized that "X-Forwarded-For" is actually the "real" host IP address, and when it's present, the initial IP address is really the address of the proxy server. Therefore, you really need two logformats, to deal with the two different situations. LOGFORMAT (%S %j %u [%d/%M/%Y:%h:%n:%j] "%j%w%r%wHTTP%j" %c %b 217.160.73.138 "%f" "%B" "-") LOGFORMAT (%v %j %u [%d/%M/%Y:%h:%n:%j] "%j%w%r%wHTTP%j" %c %b 217.160.73.138 "%f" "%B" "%S") Most of your entries will probably end with "-". Any that don't, should be picked up by the second entry. (You should check whether the last field has quotes around it, especially when the request wasn't proxied). Aengus +------------------------------------------------------------------------ | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to | http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at | http://www.mail-archive.com/[email protected]/ | http://lists.isite.net/listgate/analog-help/archives/ | http://www.tallylist.com/archives/index.cfm/mlist.7 +------------------------------------------------------------------------
