Greetings,
Analog 5.32 has been working fine for me, using the standard log format
of my web server (apache 2.0.46), running under GNU/Linux (Red Hat WS
2.1, not that it matters).
But then I switched mylog format to this fairly complex declaration:
LogFormat
"%h\t%l\t%u\t%t\t\"%r\"\t%>s\t%b\t\"%{Referer}i\"\t\"%{User-Agent}i\"\t%V\t%{SSL_PROTOCOL}x\t%{SSL_CIPHER}x\t%{SSL_CLIENT_S_DN_CN}x"
combined
All items are separated by tabs and not spaces (not sure if the tabs
will get preserved in this mail); this has proven more reliable for us
to process.
So then, following the advice in logfmt.html, I added the analog
declaration (before any LOGFILE statement) to be:
APACHELOGFORMAT
(%h\t%l\t%u\t%t\t\"%r\"\t%>s\t%b\t\"%{Referer}i\"\t\"%{User-Agent}i\"\t%V\t%{SSL_PROTOCOL}x\t%{SSL_CIPHER}x\t%{SSL_CLIENT_S_DN_CN}x)
Unfortunately, analog thinks the log lines are corrupt (all of them,
there are many thousands in many files for different vhosts). The error
message is:
analog: Warning L: Large number of corrupt lines in logfile
../logs/access_log.200307.gz: turn debugging on or try different LOGFORMAT
Current logfile format:
%St%jt%jt[%d/%M/%Y:%h:%n:%j]t"%j%w%r%wHTTP%j"t%ct%bt"%f"t"%B"t%vt%jt%jt%j\n
I did DEBUG ON, and got this result:
C: 199.165.143.7 - - [25/Jul/2003:14:44:04 -0600] "GET /
HTTP/1.1" 200 644 "-" "-" www.zref.net - - -
C:
*
which, unless the tabs have confused things, is apparently saying that
the standard byte count %b (644) is the problematic location.
That didn't make sense to me, so I tried replacing every directive from
the %>s onward, including the %b, with %j (and changing APACHELOGFORMAT
to LOGFORMAT) to see if I could narrow down the problematic location
that way. No luck, same result.
I tried searching the mailing list archives, but couldn't find anything
(probably just wasn't creative enough in what to search for).
Any help or pointers very much appreciated.
Thanks,
[EMAIL PROTECTED]
+------------------------------------------------------------------------
| TO UNSUBSCRIBE from this list:
| http://lists.isite.net/listgate/analog-help/unsubscribe.html
|
| Digest version: http://lists.isite.net/listgate/analog-help-digest/
| Usenet version: news://news.gmane.org/gmane.comp.web.analog.general
| List archives: http://www.analog.cx/docs/mailing.html#listarchives
+------------------------------------------------------------------------
