If this is your LOGFORMAT (%S %j %u [%d/%M/%Y:%h:%n:%j] "%j%w%r%wHTTP%j" %c %b)
And this is a line from your log: 195.93.73.16 - - [07/Dec/2003:21:41:26 +0200] "GET /images/titre-1_r2_c2.gif HTTP/1.0" ABC 2510
Analog would put a * under the ABC, because it doesn't match the %c
field in your logformat. This line would be flagged as "corrupt" because
it doesn't match the logformat.
Where would Analog write it ? In the Analog.out ? In the log files ?
Analog never modifies your logfiles. Analog prints errors to the screen,
unless you specify a file that it should use instead (ERRFILE).
With your explanations I think that I found out what was wrong in the logformat and I fixed it.
Thanx a lot.
But now I still have the "possible double counting" error :
analog: Warning L: logfiles
BOULOT:log_apache2:www.matrans-concept.com_20031206.log.gz and
BOULOT:log_apache2:www.matrans-concept.com_20031207.log.gz overlap: possible
double counting
I still don't understand if theres a way to tell analog to fix this problem ?
Guillaume
+------------------------------------------------------------------------ | TO UNSUBSCRIBE from this list: | http://lists.isite.net/listgate/analog-help/unsubscribe.html | | Digest version: http://lists.isite.net/listgate/analog-help-digest/ | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general | List archives: http://www.analog.cx/docs/mailing.html#listarchives +------------------------------------------------------------------------
