So I used it for LOGFORMAT but I still have two errors : 1 - large number of corrupt lines for some of the log files (it looks like analog will ignore the log files with corrupted lines but will succesfully use the other ones)
If you turn Debugging on, Analog puts a * under the field that it can't match to your logfile. (http://www.analog.cx/docs/debug.html). Compare one of the lines that Analog can't match with the Logformat you are using.
In my analog.cfg I have
SETTINGS ON DEBUG ON WARNINGS ON
Then when I run analog I get this :
BOULOT:log_apache2:www.matrans-concept.com_20030728.log.gz
Logfile format:
%S %j %u [%d/%M/%Y:%h:%n:%j] "%j%w%r%wHTTP%j" %c %b "%f" "%B" %j %j\n
BOULOT:log_apache2:www.matrans-concept.com_20030729.log.gz
Logfile format:
%S %j %u [%d/%M/%Y:%h:%n:%j] "%j%w%r%wHTTP%j" %c %b "%f" "%B" %j %j\n
BOULOT:log_apache2:www.matrans-concept.com_20030730.log.gz
Logfile format:
%S %j %u [%d/%M/%Y:%h:%n:%j] "%j%w%r%wHTTP%j" %c %b "%f" "%B" %j %j\n
etc.
Would the * be placed under these lines if the field didnt match ???
(also I cant read the whole analog 5.32.out / the first lines are always missing / that may be a bug on OS X ?)
2 - Logfiles overlap: possible double counting I dont really understand if this is bad or not.
http://www.analog.cx/docs/errors.html
If you are analysing logs from two different servers, you would expect
overlapping times. If you're analyzing logs from a single server, then
overlapping times would suggest that you've somehow got the same data in
there twice. Analog can't tell where your logs came from, so it can't
make that decision for you (and neither can anyone else - we don't know
your environment).
Theres only one domain on one server.
You see, my logfiles are daily logs. So I opened two logfiles from 2 consecutive days (december 08 and december 09) and found out that some lines are identical in both files.
Do you have lines in the December 09 log file that have December 08 dates on them? That would suggest a problem.
Yes, thats what I have. Does it mean that the results will get screwed up ?
Do you think this problem could be a web server log configuration problem ?
Aengus
+------------------------------------------------------------------------ | TO UNSUBSCRIBE from this list: | http://lists.isite.net/listgate/analog-help/unsubscribe.html | | Digest version: http://lists.isite.net/listgate/analog-help-digest/ | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general | List archives: http://www.analog.cx/docs/mailing.html#listarchives +------------------------------------------------------------------------
