Julia Jacobs <[EMAIL PROTECTED]> wrote: > I read everything (Analog docs, FAQ, list archives) and am still at a > loss! How can I set up my analog.cfg file for multiple Virtual hosts > when my big ol access_log file comes up with this format (has no %v): > > ./analog: Warning L: Large number of corrupt lines in logfile > /var/log/httpd/access_log: turn debugging on or try different > LOGFORMAT Current logfile format: > %S %j %u [%d/%M/%Y:%h:%n:%j] "%j%w%r%wHTTP%j" %c %b "%f" "%B"\n > %S %j %u [%d/%M/%Y:%h:%n:%j] "%j%w%r" %c %b "%f" "%B"\n > %S %j %u [%d/%M/%Y:%h:%n:%j] "%r" %c %b "%f" "%B"\n > > An snippet of my access_log from Analog's DEBUG: > > C: (%v in file prefix but no VHOST in line) > C: 68.55.64.103 - - [23/Jun/2002:19:12:36 -0500] "GET > /yorkismallimages/yorkiepoemframed.jpg HTTP/1.1" 200 1528 > "http://www.dogsarepeople.com/yorki/gifts.html"; "Mozilla/4.0 > (compatible; MSIE 6.0; Windows 98; Win 9x 4.90; Q312461)" > C: (%v in file prefix but no VHOST in line) > C: 68.55.64.103 - - [23/Jun/2002:19:12:36 -0500] "GET > /yorkismallimages/yorkiepoem2framed.jpg HTTP/1.1" 200 1756 > "http://www.dogsarepeople.com/yorki/gifts.html"; "Mozilla/4.0 > (compatible; MSIE 6.0; Windows 98; Win 9x 4.90; Q312461)" > > www.dogsarepeople.com is one of my Virtual Hosts but I was not sure > if I could replace %v with something else and then output multiple > cache files. I'm not even sure how to do that!
As others have pointed out, if Apache doesn't store vhost information in the logs, then it doesn't exist, and Analog won't pretend that it does. But you can "teach" Analog to make the same assumption that you have done, ie, that the hostname in the referrer field tells you what VHost is involved. Depending on how your site is used, this will be an approximation, but then, everything is an approximation anyway, so it might be good enough for the time being. If most people who visit a particular vhost only look at one or two pages, then a high proportion of the referrer entries hits for that vhost will not have that VHost listed. On the other hand, if the "home page" for a particular vhost has 12 different images, and it's fairly typical for people to read 10 or 20 pages on that site, then 95% of the hits for that VHost will have an "internal" referrer, so using the referrer field as a psuedo vhost field will be better than nothing, especially when you consider that there's a considerable amount of "fudge" in the logs anyway, because of the effects of proxy servers, etc. The simplest thing is to use a LOGFORMAT like this: LOGFORMAT (%S %j %u [%d/%M/%Y:%h:%n:%j] "%j%w%r%wHTTP%j" %c %b "http://www.%v.com/%j"; "%B"\n) (This will not recognize lines that don't have a referrer that matches your pattern, so you might need a couple of similar LOGFORMAT lines to catch all the options, and you might still get errors from lines that don't have any referrer at all). This will "sacrifice" the referrer field. If you want to retain the referrer field, then you'll have to consider using a script to modify your logs and add an extra field. If you wanted to, you could consider using a "look-ahead" mechanism that, when it encountered a log entry that didn't have a referrer entry from one of your sites, would scan through the next 100 lines for another request from the same IP address, and see what vhost it used, but that would probably be a lot of work for relatively little benefit. > Since I have multiple Virtual Hosts in my httpd.conf that output to > ONE access_log file right now, and I want to create multiple Analog > Reports for each Virtual Host without having to create a different > .cfg file, I'm not sure what to do. You might try the REFINCLUDE directive http://www.analog.cx/docs/include.html This will create a report based only on records that use a particular referrer. This will exclude requests for the home page on each site, and understand total numbers, but may give you a starting point, at least. Aengus +------------------------------------------------------------------------ | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to | http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at | http://www.mail-archive.com/[email protected]/ | http://lists.isite.net/listgate/analog-help/archives/ | http://www.tallylist.com/archives/index.cfm/mlist.7 +------------------------------------------------------------------------
