On Sunday, July 03, 2005 12:27 PM [EDT], [EMAIL PROTECTED] <[EMAIL PROTECTED]> wrote:
> Hi all, > > I am having difficulties, analyzing an ftp log from german provider > 1&1 (running apache servers). > > A typcial line to be analyzed reads like this: > > 213.102.92.218 UNKNOWN p35105638 [19/Mar/2005:15:21:14 +0100] "PASV" > 227 -213.102.92.218 UNKNOWN p35105638 [19/Mar/2005:15:21:15 +0100] > "STOR galerie11.html" 226 1095 > > But other commands are logged, too: > > [21/Mar/2005:00:06:37 +0100] "PASS (hidden)" 230 -217.95.22.223 > UNKNOWN p35105638 [21/Mar/2005:00:06:37 +0100] "TYPE A" 200 > -217.95.22.223 UNKNOWN p35105638 [21/Mar/2005:00:06:37 +0100] "CWD > alex" 250 -217.95.22.223 UNKNOWN p35105638 [21/Mar/2005:00:06:37 > +0100] "CWD bilder" 250 -217.95.22.223 UNKNOWN p35105638 > [21/Mar/2005:00:06:37 +0100] "PASV" 227 -217.95.22.223 UNKNOWN > p35105638 [21/Mar/2005:00:06:37 +0100] "LIST" 226 2832217.95.22.223 > UNKNOWN p35105638 [21/Mar/2005:00:06:37 +0100] "QUIT" 221 - > > My provider told me, the format for analog would be like this: > > LOGFORMAT (%h %l %u %t \"%r\" %s %b) > LOGFILE ftp.log.* That might be an Apache Logformat - it's not an Analog LOGFORMAT. You could try using it in Analog by specifying APACHELOGFORMAT (%h %l %u %t \"%r\" %s %b) LOGFILE ftp.log.* and see it that works any better. Aengus +------------------------------------------------------------------------ | TO UNSUBSCRIBE from this list: | http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +------------------------------------------------------------------------
