Thanks for the LOGFORMAT example, Jeremy. That seems to be exactly what I
needed.
Now, however, I have the situation of a large number of the records being
considered "corrupt" (at least that's how I read the errfile output with
debug on when it has a "C: " followed by a record). They all (of the few
of the 20,000+ I scanned initially ;-) seem to follow this pattern:
--------------------
C: xxx.xxx.xxx.225 - - [02/Oct/2003:00:04:45 -0400] "GET
/XXXdealer/jsp/LeftNavi
gation.jsp;jsessionid=17jeOSQDSPGUDBMV1vEDpv2Rn4XQsdd4teRhwwqokpqVbQwEWkuc!-106
1943409" 200 5166 13000
C:
*
C: xxx.xxx.xxx.225 - - [02/Oct/2003:00:04:46 -0400] "GET
/XXXdealer/jsp/BottomNa
vigation.jsp;jsessionid=17jeOSQDSPGUDBMV1vEDpv2Rn4XQsdd4teRhwwqokpqVbQwEWkuc!-1
061943409" 200 1637 11000
C:
*
C: xxx.xxx.xxx.225 - - [02/Oct/2003:00:04:46 -0400] "GET
/XXXdealer/jsp/TopNavig
ation.jsp;jsessionid=17jeOSQDSPGUDBMV1vEDpv2Rn4XQsdd4teRhwwqokpqVbQwEWkuc!-1061
943409?year=2003&month=04&day=02&hours=00&minutes=04&seconds=42&timeZone=GMT%2B
04%3A00" 200 4306 264000
C:
*
--------------------
(Curious about those intervening records with just "C: ... * " - are they
"spacers" of some sort, or an indication of something else in the log
file?)
When I grepped for the records with that jsessionid, one extra (rec #192)
turned up that apparently was not flagged (line numbers precede the IP
address, represented by the "xxx.xxx.xxx" - gotta be "discreet"):
191:xxx.xxx.xxx.225 - - [02/Oct/2003:00:04:45 -0400] "GET
/XXXdealer/jsp/LeftNavigation.jsp
;jsessionid=17jeOSQDSPGUDBMV1vEDpv2Rn4XQsdd4teRhwwqokpqVbQwEWkuc!-1061943409"
200 5166 130
00
192:xxx.xxx.xxx.225 - - [02/Oct/2003:00:04:46 -0400] "GET
/home_content.html;jsessionid=17je
OSQDSPGUDBMV1vEDpv2Rn4XQsdd4teRhwwqokpqVbQwEWkuc!-1061943409 HTTP/1.1" 200
3478 3000
193:xxx.xxx.xxx.225 - - [02/Oct/2003:00:04:46 -0400] "GET
/XXXdealer/jsp/BottomNavigation.j
sp;jsessionid=17jeOSQDSPGUDBMV1vEDpv2Rn4XQsdd4teRhwwqokpqVbQwEWkuc!-1061943409"
200 1637 1
1000
194:xxx.xxx.xxx.225 - - [02/Oct/2003:00:04:46 -0400] "GET
/XXXdealer/jsp/TopNavigation.jsp;
jsessionid=17jeOSQDSPGUDBMV1vEDpv2Rn4XQsdd4teRhwwqokpqVbQwEWkuc!-1061943409?year=2003&mont
h=04&day=02&hours=00&minutes=04&seconds=42&timeZone=GMT%2B04%3A00" 200 4306
264000
Record #192, of course has a somewhat different URI, single-depth vs. the
XXXdeal/dsp path of the "corrupt" ones - is that what makes them "corrupt"?
This is occurring with 5.91beta1 from pre-compiled binary for Solaris. I
noticed the one of the "What's New" items is "Automatically strips ;params
section from URLs (for example, jsessionid's). ", so it's interesting that
my problem records all seem to have those jsessionid's - any possiblity of
a beta bug?
BTW, I did not know how to reply to your reply to my original post - I
tried from the newgroup view, but that has not shown up after some hours,
so I guess there must be another way?
TIA,
Rory O'Connor
+------------------------------------------------------------------------
| TO UNSUBSCRIBE from this list:
| http://lists.isite.net/listgate/analog-help/unsubscribe.html
|
| Digest version: http://lists.isite.net/listgate/analog-help-digest/
| Usenet version: news://news.gmane.org/gmane.comp.web.analog.general
| List archives: http://www.analog.cx/docs/mailing.html#listarchives
+------------------------------------------------------------------------
