On Wednesday, April 06, 2005 10:03 PM [GMT], Johan Eeckhout <[EMAIL PROTECTED]> wrote:
> Hi, > > I'm trying to build a report with some IIS logfiles using Analog 6. > Analog reports lots of corrupt lines. I turned on debugging and got > this : > ------------- > C: 1110026691376 192.168.5.15 - 2005-03-05 12:44:51.376 GET > /IXDIA01EN/Fr/upload_input.asp - 200 5060 - "Mozilla/4.0 (compatible; > MSIE > 6.0)" > C: > * > ------------- > (Asterisk is shown for cs(referer) field). > > The logfile format is as follows : > --------------- > #Fields: x-tmstp c-ip c-auth-id date time cs-method cs-uri-stem > cs-uri-query sc-status sc-bytes cs(referer) cs(user-agent) > --------------- > > Apparently analog has a problem with the Referrer field when it > equals "-", since all entries where the Referrer field has another > value are accepted just fine. > > Any ideas ? That's odd. If I create a 2 line logfile with just your #Fields line and that one log line, Analog says "F: Detect that it's in W3 extended format", but doesn't like your referrer. If I put the 3 lines from an IIS log file that cause Analog to see the log file as "Microsoft's version of extended format", Analog has no problem with your Referrer. This old post from the archives suggests that W3 Extended format is supposed to have quotes around referrers, and that IIS didn't do this, so Analog treats it as a special case, which is why "tricking" Analog into treating your logfile as an IIS logfile works. But the W3 "definition" was never actually finished, as far as I can remember, and there were other issues with it. http://lists.meer.net/pipermail/analog-help/2001-November/010515.html Do the log entries that do have referrers have quotes? If they do, you could use these two LOGFORMAT strings together to read your logfile: LOGFORMAT (%j %s %u %Y-%m-%d %h:%n:%j %j %r %q %c %b "%f" "%B") LOGFORMAT (%j %s %u %Y-%m-%d %h:%n:%j %j %r %q %c %b %f "%B") (You can use DEFAULTLOGFORMAT if you want to keep specifying the logfile on the command line). Aengus +------------------------------------------------------------------------ | TO UNSUBSCRIBE from this list: | http://lists.meer.net/mailman/listinfo/analog-help | | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general | List archives: http://www.analog.cx/docs/mailing.html#listarchives +------------------------------------------------------------------------
