I have been trying for a couple of weeks now and still have not had any luck getting Analog to process Real Media streaming log files.
 
The current logformat I have been trying is:
 
      %S %j %j [%d/%M/%Y:%h:%n:%j %j] "%j %r %j/%j" %c %b [%j] [%j] [%j] [%j] %j %j %j %j %j %j\n
      %S %j %j [%d/%M/%Y:%h:%n:%j %j] "%j %r %j/%j" %c %b [%j] [%j] []  %j %j %j %j %j %j\n
 
and many variations thereof.
 
Here's what Analog +DFS keeps spitting back at me:
 
F: Opening /mnt/logs/Real8/rmaccess.log.20020630133449 as logfile
F: Closing logfile /mnt/logs/Real8/rmaccess.log.20020630133449
S: Successful requests: 0
S: Redirected requests: 0
S: Failed requests: 0
S: Requests returning informational status code: 0
S: Status code not given: 0
S: Unwanted lines: 0
S: Corrupt lines: 152
analog: Warning L: Large number of corrupt lines in logfile
  /mnt/logs/Real8/rmaccess.log.20020630133449: turn debugging on or try
  different LOGFORMAT
    Current logfile format:
      %S %j %j [%d/%M/%Y:%h:%n:%j %j] "%j %r %j/%j" %c %b [%j] [%j] [%j] [%j] %j %j %j %j %j %j\n
      %S %j %j [%d/%M/%Y:%h:%n:%j %j] "%j %r %j/%j" %c %b [%j] [%j] []  %j %j %j %j %j %j\n
 
There are only two types of lines in the Real Media log files that look like:
 
65.81.67.211 - - [14/Jun/2002:10:57:45 -0400]  "GET rnc/061202v1.rm RTSP/1.0" 200 14202 [Win98_4.10_6.0.9.380_play32_L280_en-US_586_axembed] [08a27361-e8e3-4c01-92dd-3f39b0b0bffa] [] 11090948 227 4 0 0 891
 
and

65.81.67.211 - - [14/Jun/2002:11:01:39 -0400]  "GET rnc/061202v1.rm RTSPT/1.0" 200 965784 [Win98_4.10_6.0.9.380_play32_L280_en-US_586_axembed] [08a27361-e8e3-4c01-92dd-3f39b0b0bffa] [Stat1:       792          0          0          0          0 8.5_Kbps_Voice][Stat2:      8500          0          0          0          0          0          0          0          0          1         55 8.5_Kbps_Voice] 11090948 227 233 0 0 892
 
Has anyone managed to get Analog to process Real Media/Real Audio 8 logs?  If so, what LOGFORMAT lines did you use?  If not, can any LOGFORMAT experts help me out with this?
 
Thank you so very much!
Garrett Bartley
 

Reply via email to