Guillaume <[EMAIL PROTECTED]> wrote: > Hello > I am running analog 5.32 on mac os X 10.3 > > When I used the "Auto" or " Default" LOGFORMAT analog said I had the > "Large number of corrupt lines " error, and I didnt get any result in > the report > > So I asked the web host to send me the apache logformat from his > httpd.conf file. > > He sent me this : > > (%S %j %u [%d/%M/%Y:%h:%n:%j] "%j%w%r%wHTTP%j" %c %b "%f" "%B" %j > %j) > > On my log files it looks like this : > > 195.93.73.16 - - [07/Dec/2003:21:41:26 +0200] "GET > /images/titre-1_r2_c2.gif HTTP/1.0" 200 2510 > "http://www.matrans-concept.com/"; "Mozilla/4.0 (compatible; MSIE 6.0; > AOL 8.0; Windows NT 5.1)" - www.matrans-concept.com > > So it looks ok to me although I dont really understand what all the %j > stand for (junk ? whats that ?!!!) > Also my web hosts says this logformat is supposed to be the "Full > format" ; is there any doc about this format somewhere ? > > So I used it for LOGFORMAT but I still have two errors : > 1 - large number of corrupt lines for some of the log files (it looks > like analog will ignore the log files with corrupted lines but will > succesfully use the other ones)
If you turn Debugging on, Analog puts a * under the field that it can't match to your logfile. (http://www.analog.cx/docs/debug.html). Compare one of the lines that Analog can't match with the Logformat you are using. > 2 - Logfiles overlap: possible double counting > I dont really understand if this is bad or not. http://www.analog.cx/docs/errors.html If you are analysing logs from two different servers, you would expect overlapping times. If you're analyzing logs from a single server, then overlapping times would suggest that you've somehow got the same data in there twice. Analog can't tell where your logs came from, so it can't make that decision for you (and neither can anyone else - we don't know your environment). > You see, my logfiles are daily logs. So I opened two logfiles from 2 > consecutive days (december 08 and december 09) and found out that some > lines are identical in both files. Do you have lines in the December 09 log file that have December 08 dates on them? That would suggest a problem. Aengus +------------------------------------------------------------------------ | TO UNSUBSCRIBE from this list: | http://lists.isite.net/listgate/analog-help/unsubscribe.html | | Digest version: http://lists.isite.net/listgate/analog-help-digest/ | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general | List archives: http://www.analog.cx/docs/mailing.html#listarchives +------------------------------------------------------------------------
