Hi! I'm not a log guru and folks around me tend to use webtrends. I used to use Analog and it did a great job of detecting formats but my logs changed to what I believe is combined but for the life of me I can't get it to run without excessive errors.
Here's a sample of my log: 66.170.71.135 - - [03/Mar/2002:08:22:17 -0600] "GET /agencies/oci/ohci/ohcihome.htm HTTP/1.1" 302 302 66.170.71.135 - - [03/Mar/2002:08:22:17 -0600] "GET /agencies/oci/ohci/ohcihome.htm HTTP/1.1" 302 302 "http://search.msn.com/results.asp?q=personnel+information+lookup&origq=soci al+security+numbers&FORM=IE4&v=1&cfg=SMCSP&nosp=0&thr=" "Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; Win 9x 4.90)" 65.25.174.90 - - [03/Mar/2002:08:23:23 -0600] "GET /agencies/oci/oci_home.htm HTTP/1.1" 302 297 65.25.174.90 - - [03/Mar/2002:08:23:23 -0600] "GET /agencies/oci/oci_home.htm HTTP/1.1" 302 297 "-" "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0)" 165.154.245.218 - - [03/Mar/2002:08:27:57 -0600] "GET /agencies/oci/dir_ins/drr-s.htm HTTP/1.1" 302 302 165.154.245.218 - - [03/Mar/2002:08:27:57 -0600] "GET /agencies/oci/dir_ins/drr-s.htm HTTP/1.1" 302 302 "http://search.msn.ca/results.asp?ba=(0..30)0....&co=(0..10)200.1.4.3.&CO=10 &FORM=SPBA&LA=english&UDo=ca&ULo=&UN=doc&aq=seaboard+life+insurance+co&cfg=S MCSP&cp=1252&q=Seaboard%20Life%20Insurance%20Co&v=1" "Mozilla/4.0 (compatible; MSIE 5.01; Windows 98)" I find it odd that I get two lines for every event but the Apache admin guy says it is normal (and that if I just used webtrends I'd have no problem). I used the "big" analog config example and am running this on an NT box. My errorlog says: F: Closing logfile C:\PROGRA~1\analog\ANALOG~1.21\Logs\aa020310.log S: Successful requests: 0 S: Redirected requests: 7034 S: Failed requests: 10 S: Requests returning informational status code: 0 S: Status code not given: 0 S: Unwanted lines: 0 S: Corrupt lines: 7224 C:\Program Files\analog\analog 5.21\analog.exe: Warning L: Large number of corrupt lines in logfile C:\PROGRA~1\analog\ANALOG~1.21\Logs\aa020310.log: turn debugging on or try different LOGFORMAT Current logfile format: %S %j %j [%d/%M/%Y:%h:%n:%j] "%j%w%r%wHTTP%j" %c %b\n %S %j %j [%d/%M/%Y:%h:%n:%j] "%j%w%r" %c %b\n %S %j %j [%d/%M/%Y:%h:%n:%j] "%r" %c %b\n Here's what I tried (and remember I'm a novice): LOGFORMAT (%S - - [%d/%M/%Y:%h:%n:%j %j] "%j %r %j" %c %b /n %j - - [%j/%j/%j:%j:%j:%j %j] "%j %j %j" %j %j "%j" "%B") Thanks for any advice!! Matthew Berigan, Records Management Supervisor Office of the Commissioner of Insurance Phone: (608) 266-0110 [EMAIL PROTECTED] +------------------------------------------------------------------------ | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to | http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at | http://www.mail-archive.com/[email protected]/ | http://lists.isite.net/listgate/analog-help/archives/ | http://www.tallylist.com/archives/index.cfm/mlist.7 +------------------------------------------------------------------------
