Please keep your posts on the list - that's what it's there for.
Analog recognizes your logfiles format from the Fields statement, which
looks like this:
#Fields: c-ip date time c-dns cs-uri-stem c-starttime x-duration c-rate
c-status c-playerid c-playerversion c-playerlanguage cs(User-Agent)
cs(Referer) c-hostexe c-hostexever c-os c-osversion c-cpu filelength
filesize avgbandwidth protocol transport audiocodec videocodec channelURL
sc-bytes c-bytes s-pkts-sent c-pkts-received c-pkts-lost-client
c-pkts-lost-net c-pkts-lost-cont-net c-resendreqs c-pkts-recovered-ECC
c-pkts-recovered-resent c-buffercount c-totalbuffertime c-quality s-ip s-dns
s-totalclients s-cpu-util cs-user-name s-session-id s-content-path cs-url
cs-media-name c-max-bandwidth cs-media-role s-proxied
When you run Analog, it says that it parses this string as:
%s%w%Y-%m-%d%w%h:%n:%j%w%S%w%r%w%j%w%j%w%j%w%j%w%j%w%j%w%j%w"%B"%w"%f"%w%j
%w%j%w%j%w%j%w%j%w%j%w%j%w%j%w%j%w%j%w%j%w%j%w%j%w%b%w%j%w%j%w%j%w%j%w%j%w%j
%w%j
%w%j%w%j%w%j%w%j%w%j%w%j%w%v%w%j%w%j%w%j%w%j%w%j%w%j%w%j%w%j%w%j%w%j\n
In a slightly more legible format, this is:
%s %Y-%m-%d %h:%n:%j %S %r %j %j %j %j %j %j %j "%B" "%f"%j.../n
If you look at your logfile lines, you'll see that cs(User-Agent) field is
WMFSDK/10.0.0.3802_WMPlayer/10.0.0.3802, whereas Analog expects it to be in
quotes ("%B" in the logformat). This causes Analog to see the line as
corrupt. The same goes for the next field, cs(Referer).
1.2.3.4 2005-10-23 14:46:38 - /1st%20Steps%20Providers%20Training/ 0 1350 5
200 {3300AD50-2C39-46c0-AE0A-4A5EEED122CA} 10.0.0.3802 en-US
WMFSDK/10.0.0.3802_WMPlayer/10.0.0.3802 - wmplayer.exe 10.0.0.3802
Windows_XP 5.1.0.2600 Pentium 6747 529081707 1645031 rtsp TCP - - -
280385841 280385841 170673 170673 0 0 0 0 0 0 1 2 100 10.24.248.48
wmvstream.dese.state.mo.us 1 0 - 52
file://E:\wmpub\Sped\1st%20Steps\Training\Module%201%20Orientation_MBR.wmv
mms://wmvstream.dese.mo.gov/1st%20Steps%20Providers%20Training/
Module%201%20Orientation_MBR.wmv 2600573 - 0
You could start by using a LOGFORMAT without the quotes,
LOGFORMAT (%s %Y-%m-%d %h:%n:%j %S %r %j %j %j %j %j %j %j %B %f %j)
I'm not quite sure why Analog is counting the lines as successful requests,
when there's no status code in that LOGFORMAT, but that line will give you a
basic report. It doesn't report on the actual stream requested, or the bytes
sent (because they're all marked as junk at the end), but you can modify the
LOGFORMAT to pick up those specific fields, if you can figure out which
fields are actually useful.
(You can also include LOGFORMAT (#%j) to get Analog to ignore the header
lines if you're manually specifying the format).
LOGFORMAT (%s %Y-%m-%d %h:%n:%j %S %r %j %j %j %j %j %j %j %B %f %j)
LOGFORMAT (#%j)
logfile WMS_20051023.log
Aengus
On Tuesday, October 25, 2005 5:07 PM [EDT],
Strange, Lainie <[EMAIL PROTECTED]> wrote:
> Hi Aengus - Attached is an example of the WMS file format.
>
> -- Lainie
> ------------------------------
>
> Message: 2
> Date: Mon, 24 Oct 2005 17:01:33 -0400
> From: "Aengus" <[EMAIL PROTECTED]>
> Subject: Re: [analog-help] Reading Windows Media Server Logs
> To: "Support for analog web log analyzer" <[email protected]>
> Message-ID: <[EMAIL PROTECTED]>
> Content-Type: text/plain; charset=iso-8859-1
>
> On Monday, October 24, 2005 2:14 PM [EDT],
> Strange, Lainie <[EMAIL PROTECTED]> wrote:
>
>> I read through the archive and never really saw this answered.
>
> If it was never answered, then nobody reading the list knew the
> answer.
>
>> I want to read Windows Media logs on a Windows 2003 Server running
>> Windows Media Services using Analog. What does my analog.cfg file
>> need to look like to do this?
>
> What does a Windows Media Services logfile look like? (Other streaming
> media
> servers create logs that aren't particularly amenable to analysis by
> Analog,
> because they create multiple entries for a single stream. You might
> want to
> create a simple log based on a small number of (preferably
> simultaneous) tests from 2 or 3 test clients).
>
> Aengus
+------------------------------------------------------------------------
| TO UNSUBSCRIBE from this list:
| http://lists.meer.net/mailman/listinfo/analog-help
|
| Analog Documentation: http://analog.cx/docs/Readme.html
| List archives: http://www.analog.cx/docs/mailing.html#listarchives
| Usenet version: news://news.gmane.org/gmane.comp.web.analog.general
+------------------------------------------------------------------------
