You could modify the source, but I think the best approach is just to
pre-process the logs. Something like sed would be very fast (faster than
a 302ISSUCCESS in Analog unless you significantly reduce the number of
files with FILEEXCLUDE). You could even run it in-line through analog by
hijacking the UNCOMPRESS command (which just runs a pre-process on a
particular type of file):
UNCOMPRESS * (sed 's/" 302 /" 200 /')
--
Jeremy Wadsack
Seven Simple Machines
James Aylett wrote:
This has been asked before, and the answer tends to be "you don't need
this". In our case, this is not true.
We're logging very little of what goes through our web server, due to
the volumes. We actually only care about URLs from one segment of the
server (which are handled by an Apache module). They come in 200 and
302 flavours, and the 302 flavours either get redirected off to
another host, or get redirected to within the same VHOST but to a URL
that will not be logged.
The logging serves a purpose beyond that as data input to analog, and
only some of the log lines are interesting to analog - but they tend
to be 302 lines. This means that analog will not consider them for
most reports, which basically means that analog will not work for us.
Now we could pipe it all through something to rewrite all those status
codes back to 200. I'm loathe to do this because we're talking a
fairly large amount of data, and I'm not convinced I'll be able to
write an Apache log line parser which is sufficiently fast that this
won't make the analysis impractical in the timeslice we have available.
The alternative is to modify analog to provide me with a new command
(or, I guess, to compile up a second binary for just this analysis,
urgh) to consider 302 a success, much as 304ISSUCCESS works. Before I
do this, I'd like to check:
* if 304ISSUCCESS works after FILEEXCLUDE (since that should be more
efficient)
* if a patch would be accepted for this (as I hate maintaining patches
against evolving software)
* if there's anything else anyone thinks I should consider first.
I need daily report, hourly summary, browser summary, operating
system report, directory report... in case that makes a difference.
Cheers,
James
+------------------------------------------------------------------------
| TO UNSUBSCRIBE from this list:
| http://lists.meer.net/mailman/listinfo/analog-help
|
| Analog Documentation: http://analog.cx/docs/Readme.html
| List archives: http://www.analog.cx/docs/mailing.html#listarchives
| Usenet version: news://news.gmane.org/gmane.comp.web.analog.general
+------------------------------------------------------------------------
