The "C: *" lines that Analog shows are intended to indicate where in the preceding line the parser failed.
In this case all those lines do not have a HTTP/1.x protocol. This implies that they are from HTTP/0.9-compatible clients??? Anyway, add another LOGFORMAT line like this: LOGFORMAT (%S - %u [%d/%M/%Y:%h:%n:%j %j] "%j %r" %c %b %D) -- Jeremy Wadsack Wadsack-Allen Digital Group Rory O'connor <[EMAIL PROTECTED]> (Friday, October 17, 2003 4:21 PM): > Thanks for the LOGFORMAT example, Jeremy. That seems to be exactly what I > needed. > Now, however, I have the situation of a large number of the records being > considered "corrupt" (at least that's how I read the errfile output with > debug on when it has a "C: " followed by a record). They all (of the few > of the 20,000+ I scanned initially ;-) seem to follow this pattern: > -------------------- > C: xxx.xxx.xxx.225 - - [02/Oct/2003:00:04:45 -0400] "GET > /XXXdealer/jsp/LeftNavi > gation.jsp;jsessionid=17jeOSQDSPGUDBMV1vEDpv2Rn4XQsdd4teRhwwqokpqVbQwEWkuc!-106 > 1943409" 200 5166 13000 > C: > * > C: xxx.xxx.xxx.225 - - [02/Oct/2003:00:04:46 -0400] "GET > /XXXdealer/jsp/BottomNa > vigation.jsp;jsessionid=17jeOSQDSPGUDBMV1vEDpv2Rn4XQsdd4teRhwwqokpqVbQwEWkuc!-1 > 061943409" 200 1637 11000 > C: > * > C: xxx.xxx.xxx.225 - - [02/Oct/2003:00:04:46 -0400] "GET > /XXXdealer/jsp/TopNavig > ation.jsp;jsessionid=17jeOSQDSPGUDBMV1vEDpv2Rn4XQsdd4teRhwwqokpqVbQwEWkuc!-1061 > 943409?year=2003&month=04&day=02&hours=00&minutes=04&seconds=42&timeZone=GMT%2B > 04%3A00" 200 4306 264000 > C: > * > -------------------- > (Curious about those intervening records with just "C: ... * " - are they > "spacers" of some sort, or an indication of something else in the log > file?) > When I grepped for the records with that jsessionid, one extra (rec #192) > turned up that apparently was not flagged (line numbers precede the IP > address, represented by the "xxx.xxx.xxx" - gotta be "discreet"): > 191:xxx.xxx.xxx.225 - - [02/Oct/2003:00:04:45 -0400] "GET > /XXXdealer/jsp/LeftNavigation.jsp > ;jsessionid=17jeOSQDSPGUDBMV1vEDpv2Rn4XQsdd4teRhwwqokpqVbQwEWkuc!-1061943409" > 200 5166 130 > 00 > 192:xxx.xxx.xxx.225 - - [02/Oct/2003:00:04:46 -0400] "GET > /home_content.html;jsessionid=17je > OSQDSPGUDBMV1vEDpv2Rn4XQsdd4teRhwwqokpqVbQwEWkuc!-1061943409 HTTP/1.1" 200 > 3478 3000 > 193:xxx.xxx.xxx.225 - - [02/Oct/2003:00:04:46 -0400] "GET > /XXXdealer/jsp/BottomNavigation.j > sp;jsessionid=17jeOSQDSPGUDBMV1vEDpv2Rn4XQsdd4teRhwwqokpqVbQwEWkuc!-1061943409" > 200 1637 1 > 1000 > 194:xxx.xxx.xxx.225 - - [02/Oct/2003:00:04:46 -0400] "GET > /XXXdealer/jsp/TopNavigation.jsp; > jsessionid=17jeOSQDSPGUDBMV1vEDpv2Rn4XQsdd4teRhwwqokpqVbQwEWkuc!-1061943409?year=2003&mont > h=04&day=02&hours=00&minutes=04&seconds=42&timeZone=GMT%2B04%3A00" 200 4306 > 264000 > Record #192, of course has a somewhat different URI, single-depth vs. the > XXXdeal/dsp path of the "corrupt" ones - is that what makes them "corrupt"? > This is occurring with 5.91beta1 from pre-compiled binary for Solaris. I > noticed the one of the "What's New" items is "Automatically strips ;params > section from URLs (for example, jsessionid's). ", so it's interesting that > my problem records all seem to have those jsessionid's - any possiblity of > a beta bug? > BTW, I did not know how to reply to your reply to my original post - I > tried from the newgroup view, but that has not shown up after some hours, > so I guess there must be another way? > TIA, > Rory O'Connor > +------------------------------------------------------------------------ > | TO UNSUBSCRIBE from this list: > | http://lists.isite.net/listgate/analog-help/unsubscribe.html > | > | Digest version: http://lists.isite.net/listgate/analog-help-digest/ > | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general > | List archives: http://www.analog.cx/docs/mailing.html#listarchives > +------------------------------------------------------------------------ +------------------------------------------------------------------------ | TO UNSUBSCRIBE from this list: | http://lists.isite.net/listgate/analog-help/unsubscribe.html | | Digest version: http://lists.isite.net/listgate/analog-help-digest/ | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general | List archives: http://www.analog.cx/docs/mailing.html#listarchives +------------------------------------------------------------------------
