"Berigan, Matthew" <[EMAIL PROTECTED]> wrote: > I'm not a log guru and folks around me tend to use webtrends. I used > to use Analog and it did a great job of detecting formats but my logs > changed to what I believe is combined but for the life of me I can't > get it to run without excessive errors. > > Here's a sample of my log: > 66.170.71.135 - - [03/Mar/2002:08:22:17 -0600] "GET ... > (compatible; MSIE 5.01; Windows 98)" > > I find it odd that I get two lines for every event but the Apache > admin guy says it is normal (and that if I just used webtrends I'd > have no problem).
Or if you had an administrator that know how to configure the webserver, you'd have no problem, but I suppose that's out of your hands. Because of line wraps, it's not entirely clear whether you posted 6 sample lines, or 3 sample lines. If it's 6 lines, then it looks like every short line is immediately followed by a long line with some additional fields. If you are sure that every request is logged twice (and the examples you gave certainly suggest this), then you probably want to just discard the short lines, so you'll need 2 LOGFORMAT lines, one of which will recognize the short lines as junk, and the other which will recognize the long lines as valid data. For example: LOGFORMAT (%S %j %u [%d/%M/%Y:%h:%n:%j] "%j %r HTTP%j" %c %b "%f" "%B") LOGFORMAT (%j[%j] "%j" %j) returns this output for the 6 sample lines you provided. S: Successful requests: 0 S: Redirected requests: 3 S: Failed requests: 0 S: Requests returning informational status code: 0 S: Status code not given: 3 S: Unwanted lines: 0 S: Corrupt lines: 0 > S: Successful requests: 0 > S: Redirected requests: 7034 The sample lines you provided all show a 302 status code, and what would normally be sizes of 302 bytes and 297 . It looks like the rest of your log file is also only returning 302 codes, suggesting that whoever configured logging on your Apache server didn't know what he was doing. (And I'd be interested to see what Webtrends reports for your site?) Aengus +------------------------------------------------------------------------ | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to | http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at | http://www.mail-archive.com/[email protected]/ | http://lists.isite.net/listgate/analog-help/archives/ | http://www.tallylist.com/archives/index.cfm/mlist.7 +------------------------------------------------------------------------
