Yes they are the same date: >head -2 logtest format="%Ses->client.ip%" "[%SYSDATE%]" "%Req->reqpb.clf-request%" "%Req->srvhdrs.clf-status%" "%Req->srvhdrs.content-length%" "%Req->headers.referer%" "%Req->headers.user-agent%" "%Req->headers.cookie%" "%duration%" "199.67.140.80" "[25/Aug/2005:00:07:46 -0400]" "GET /server.txt HTTP/1.1" "200" "84" "-" "Mozilla/4.61 [en] (WinNT; I)" "-" "950"
>tail -1 logtest "192.193.221.149" "[25/Aug/2005:22:58:20 -0400]" "GET /fotrd/invalidUser.html HTTP/1.1" "200" "245" "-" "Mozilla/4.61 [en] (WinNT; I)" "-" "115670" I tried removing the first couple of hundred lines and last couple hundred lines and the same problem.. I just tried running 10 lines in the middle of the day it did not give me the the 7 day summary .... very flaky results. Thanks, Brendan -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Jeremy Wadsack Sent: Thursday, September 01, 2005 4:35 PM To: Support for analog web log analyzer Subject: Re: [analog-help] driving me crazy In the general summary are the date of first and last request on the 25th? If so, can you make this happen with a very small log file? -- Jeremy Wadsack Seven Simple Machines Fitzpatrick, Brendan wrote: >All, > >I'm seeing a very strange problem... I've been using analog for a while now >without a hitch. I analyze a couple of hundred logs each month and this month >I'm seeing something that I cannot explain and it's driving me crazy. > >I have a log which contains 1 days worth of data from August 25th (which >happens to be 7 days ago, could be related??). When I run analog on it (today >Sept. 1st) I see the following line: > >z.html:<br /><span class="gensumtitle">Data transferred:</span> 14,510,371 >bytes (3,993,185 bytes) > >I didn't expect to see the data in the parenthesis because that should only >appear when the data spans multiple days (and yes - I confirmed all the data >was from a 24 hour period on Aug 25th). So I did a test and replaced Aug 25th >with Aug 28th and it appeared to display as expected as follows: > >zz.html:<br /><span class="gensumtitle">Data transferred:</span> 14,510,371 >bytes > >I did another test just to doublecheck if it was because the data was within >the last 7 days but I confirmed it acted as expected: > >zzz.html:<br /><span class="gensumtitle">Data transferred:</span> 14,510,371 >bytes > >For the goof I changed the dates back to Aug 25th and the parenthesis appeared >again! > >zzzz.html:<br /><span class="gensumtitle">Data transferred:</span> 14,510,371 >bytes (3,955,051 bytes) > >As another goof, I ran dos2unix on the file because it's an NT log being >processed on a unix machine (and I've never had a problem doing this before >and nothing has changed recently). > > >zzzzz.html:<br /><span class="gensumtitle">Data transferred:</span> 14,510,371 >bytes (3,791,065 bytes) > > >Does anyone know why the date of the entries in the log would cause the 7 day >info to appear in parenthesis? Even more disturbing - each time the 7 day info >appears - it's random (sometimes it's higher, and sometimes it's lower than >the previous run). > >Thanks, > >Brendan > > +------------------------------------------------------------------------ | TO UNSUBSCRIBE from this list: | http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +------------------------------------------------------------------------ +------------------------------------------------------------------------ | TO UNSUBSCRIBE from this list: | http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +------------------------------------------------------------------------
