> A couple of points - those entries don't seem to match those headers, as > far as I can see. In the header, there's only one field after cs-host, > but you've got 3 "- - -".
Yeah, I thought that was odd, as well. I tabbed out the header and requests to line up and was one out. I don't know what's happening there. > The 2nd point is that "cs-method cs-uri-stem cs-uri-query" is shown here > as "- - -". I think you mentioned using IIS. You might want to use the > URLscan tool that someone else mentioned on the list - it should prevent > such malformed entries getting to your server. I've tried to set up URLScan so that it's as draconian as possible (settings are below). If you spot anything else that I can add to make it stricter, please let me know. UseAllowVerbs=1 UseAllowExtensions=1 NormalizeUrlBeforeScan=1 VerifyNormalization=1 AllowHighBitCharacters=0 AllowDotInPath=0 RemoveServerHeader=0 EnableLogging=1 PerProcessLogging=0 AllowLateScanning=0 PerDayLogging=1 UseFastPathReject=1 > Lastly, if you simply want Analog to ignore these entries, just add an > additional LOGFORMAT that matches these lines, but doesn't match the > real lines that you want. For example: > LOGFORMAT (%j %j %j %j %j %j %j %j - - - 404 %j) Great - thanks for the info. I'll look into that command and play about with it. -- Aidan Whitehall<[EMAIL PROTECTED]> Macromedia ColdFusion Developer Fairbanks Environmental +44 (0)1695 51775 ________________________________________________________________________ This e-mail has been scanned for all viruses by Star Internet. The service is powered by MessageLabs. For more information on a proactive anti-virus service working around the clock, around the globe, visit: http://www.star.net.uk ________________________________________________________________________ +------------------------------------------------------------------------ | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to | http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at | http://www.mail-archive.com/[email protected]/ | http://lists.isite.net/listgate/analog-help/archives/ | http://www.tallylist.com/archives/index.cfm/mlist.7 +------------------------------------------------------------------------
