Jeremy Wadsack wrote: > The "C: *" lines that Analog shows are intended to indicate > where in the preceding line the parser failed. > > In this case all those lines do not have a HTTP/1.x protocol. This > implies that they are from HTTP/0.9-compatible clients??? Anyway, add > another LOGFORMAT line like this: > > LOGFORMAT (%S - %u [%d/%M/%Y:%h:%n:%j %j] "%j %r" %c %b %D) > > OK, that seemed to avoid all but 1 line being flagged as corrupt when I replaced your previous suggested line (or did you really mean to "add" it so that there would be 2 LOGFORMAT lines?). It does seem counter-intuitive though to remove the "junk" parameter (%j) that corresponds to the client HTTP setting, but if that's what it takes to work, cool. Also, remember that the one line that was not flagged previously (in my previous posting) since it did have the HTTP setting, was grouped with the 3 without because they all had the same jsessionid (and IP address even though I masked that a bit), so all 4 should have come from the same client/browser as part of a single session. Most likely that client would be a recent version of Internet Explorer - is that another one of its non-standard "misbehaviors"? Then again, searching back through that log file, I don't find any browser/OS info, so I'm thinking this set of transactions may be from a LoadRunner test-generation server, and maybe it does not normally put that info into its generated transactions (nor the HTTP level in a lot of them it would seem). Thanks again, Rory O'Connor +------------------------------------------------------------------------ | TO UNSUBSCRIBE from this list: | http://lists.isite.net/listgate/analog-help/unsubscribe.html | | Digest version: http://lists.isite.net/listgate/analog-help-digest/ | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general | List archives: http://www.analog.cx/docs/mailing.html#listarchives +------------------------------------------------------------------------
