Zebra wrote: > > Can you help me... > In my Log file I got some "special" lines, which I don't want to read > > How can I write LOGFORMAT to exclude this lines??? > > Example: > Such lines I want to exclude. They are "special" > > #Fields: date time s-event s-process-type s-user-time s-kernel-time s-page-faults >s-total-procs s-active-procs s-stopped-procs > 2002-03-31 00:02:03 Periodic-Log All 00.000% 00.000% 0 0 0 0 > > But this lines I want to READ > #Fields: date time c-ip cs-username s-sitename s-computername s-ip s-port cs-method >cs-uri-stem cs-uri-query sc-status sc-win32-status sc-bytes cs-bytes time-taken >cs-version cs-host cs(User-Agent) cs(Cookie) cs(Referer) > 2002-03-31 05:10:53 194.87.58.2 - W3SVC10 2K-PIE 194.87.58.2 8000 GET >/img/logo_bot2.gif - 304 0 234 184 0 HTTP/1.0 www.regfin.ru MSProxy/2.0 - - > > SO, What shall I do?
Define a log format that matches the first line but uses %j for all fields, and a log format that matches the second line with field labels. Alternatively filter out the lines before invoking analog, or only define a log format for the lines you want to keep and let analog ignore the other lines it doesn't understand (you will get warnings about invalid log lines though if you have warnings enabled) -- Klaus Johannes Rusch [EMAIL PROTECTED] http://www.atmedia.net/KlausRusch/ +------------------------------------------------------------------------ | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to | http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at | http://www.mail-archive.com/[email protected]/ | http://lists.isite.net/listgate/analog-help/archives/ | http://www.tallylist.com/archives/index.cfm/mlist.7 +------------------------------------------------------------------------
