Philip Veale <[EMAIL PROTECTED]> wrote: > I have two sets of logfiles for a domain, which are identical but for > one starts with the hostname of client, and one starts with the IP > (see brief samples below) > > Analog will process the ones with the hostname just fine, but doesn't > want to know about the ones that start with IP. > What logformat directives should I apply for these logs, or is there > another way ? > > type 1 (works): > ham.ulcc.wwwcache.ja.net - - [22/Apr/2002:01:49:43 +0100] "GET <snip> > > type 2 (fails with analog: Warning L: Large number of corrupt lines in > logfile and data not added to results) > 203.172.31.62 - - [19/Apr/2002:01:13:40 +0100] "GET <snip>
Are you sure that there isn't a difference in the rest of the entry? Analog doesn't care whether the Client IP address has been resolved or not. If you just take one complete entry from the second log, and run Analog against it with "DEBUG ON", Analog will disply the line, with an asterisk under the first field that it didn't understand. Aengus +------------------------------------------------------------------------ | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to | http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at | http://www.mail-archive.com/[email protected]/ | http://lists.isite.net/listgate/analog-help/archives/ | http://www.tallylist.com/archives/index.cfm/mlist.7 +------------------------------------------------------------------------
