|
I have been using Sambar Server (Windows version) for several years, but have never attempted log file analysis until recently. All of my old log files are in a format peculiar to Sambar Server, and so far I have been unable to construct a working LOGFORMAT to analyze these logs.
Here is the information about this format from the Sambar documentation.
Thanks,
Barry
---
The performance log format is specific to the Sambar Server. It is a variant of the extended
common log format; the time in milliseconds that it took to respond to the client's request
is inserted into the stream after the bytes. The following are two typical log lines:
206.53.239.229 - - [17/Sep/2004:14:25:25 -0500] "GET /Newsletter/newsletters.htm HTTP/1.1" 200 1068 0 " http://www.testsite.com/Page1.htm" "Mozilla/5.0 (X11; U; Linux i386; en-US; rv:1.4) Gecko/20030624 Netscape/7.1" 206.53.239.229 - - [17/Sep/2004:14:25:25 -0500] "GET /session/pagecount?page=newsletters HTTP/1.1" 200 900 0 " http://www.testsite.com/index.htm" "Mozilla/5.0 (X11; U; Linux i386; en-US; rv:1.4) Gecko/20030624 Netscape/7.1"
The performance log file format has the following fields:
remotehost Remote hostname or IP address number if DNS is not enabled/available.
rfc931 The remote login name of the user. (This is not implemented by the Sambar Server).
authuser The username of the authenticated user. This is available when using password
protected WWW pages.
[date] Date and time of the request.
"request" The HTTP request line as it came from the client.
status The HTTP response code returned to the client. Indicates whether or not the file was
successfully retrieved, and if not, what error message was returned.
bytes The number of bytes transferred. If the status is 200 and bytes are 0, the dynamic page
size could not be determined.
msec The time in milliseconds that it took the server to respond to the request.
"referer" The url the client was on before requesting this url.
"agent" The browser the client is using. | 
