Wow..i have tried i too...with just a small s at the and....its
running....but
now there is at least one open question...
analog doesn`t read my old logfiles since i added teh new formatline..is
there a special rating
in the liens ? Must i pick the lines you send me at the top of the two
old ones ? Thats the last
question i hope...
Thanks a lot
Carsten
-----Urspr�ngliche Nachricht-----
Von: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]] Im Auftrag von Aengus
Gesendet: Donnerstag, 14. M�rz 2002 17:56
An: [EMAIL PROTECTED]
Betreff: Re: [analog-help] new LOGFORMAT needed
From: "Aengus" <[EMAIL PROTECTED]>
> "Carsten B�ttcher" <[EMAIL PROTECTED]> wrote:
>
> > The admin had added a new field at the end of the fileformat... (you
> > can see the IP)
> >
> > 195.206.128.91 - - [13/Mar/2002:09:50:00 +0100] "GET
> > /spots/sevenone/demo/airmarin/anfang176x144.gif HTTP/1.0" 200 10103
> > 217.160.73.138 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Win32)"
> > "192.168.100.44"
> >
> > The admin wrote to me with the information that the field is named
> > "X-Forwarded-For". It is used by HTTP-Header-Entry wich is used by
> > HTTP-Proxy-Server.
> >
> > Any idea to integrate the last field in the format you sent me ?
> >
> > LOGFORMAT (%S %j %u [%d/%M/%Y:%h:%n:%j] "%j%w%r%wHTTP%j" %c %b %v
> > "%f" "%B")
> >
> > If you have any idea please let me know....
>
> Analog doesn't have any specific support for "X-Forwarded-For" (though
> I can see how it might be useful). Normally when you need to make a
> report on an unsupported field, you use the User report or the virtual
> host report, but your are using both of these already. But if you only
> have one server, and all your log files have 217.160.73.138 in the
> field before the referrer, then you can ignore that field, and use the
> Virtual Host report for the extra field instead.
>
> LOGFORMAT (%S %j %u [%d/%M/%Y:%h:%n:%j] "%j%w%r%wHTTP%j" %c %b
> 217.160.73.138 "%f" "%B" %v)
Just after I sent this, I realized that "X-Forwarded-For" is actually
the "real" host IP address, and when it's present, the initial IP
address is really the address of the proxy server. Therefore, you really
need two logformats, to deal with the two different situations.
LOGFORMAT (%S %j %u [%d/%M/%Y:%h:%n:%j] "%j%w%r%wHTTP%j" %c %b
217.160.73.138 "%f" "%B" "-")
LOGFORMAT (%v %j %u [%d/%M/%Y:%h:%n:%j] "%j%w%r%wHTTP%j" %c %b
217.160.73.138 "%f" "%B" "%S")
Most of your entries will probably end with "-". Any that don't, should
be picked up by the second entry. (You should check whether the last
field has quotes around it, especially when the request wasn't proxied).
Aengus
+-----------------------------------------------------------------------
+-
| This is the analog-help mailing list. To unsubscribe from this
| mailing list, go to
| http://lists.isite.net/listgate/analog-help/unsubscribe.html
|
| List archives are available at
| http://www.mail-archive.com/[email protected]/
| http://lists.isite.net/listgate/analog-help/archives/
| http://www.tallylist.com/archives/index.cfm/mlist.7
+-----------------------------------------------------------------------
+-
+------------------------------------------------------------------------
| This is the analog-help mailing list. To unsubscribe from this
| mailing list, go to
| http://lists.isite.net/listgate/analog-help/unsubscribe.html
|
| List archives are available at
| http://www.mail-archive.com/[email protected]/
| http://lists.isite.net/listgate/analog-help/archives/
| http://www.tallylist.com/archives/index.cfm/mlist.7
+------------------------------------------------------------------------
