On Monday, November 21, 2005 8:09 AM [EDT], Bonnie Powers <[EMAIL PROTECTED]> wrote:
> Aengus, > > Thanks for your quick response. I tried using the VHOSTEXCLUDE and I > also tried HOSTEXCLUDE, but I didn't have any luck. > > HOSTEXCLUDE fc.antiochne.edu > HOSTEXCLUDE mail.antiochsea.edu > HOSTEXCLUDE mail.antiochla.edu > HOSTEXCLUDE mail.antiochsb.edu In Analog terms, "host" is the "incoming" computer. HOSTEXCLUDE says to exclude all requests that come from aa specific IP address or hostname. VHOST is the term Analog uses for a Virtual Host, or Virtual Server, where one physical server serves up several "virtual" websites, using different names or addresses. If your logfiles have a specific field that Analog recognizes as the VHOST field (%v in the LOGFORMAT), then you should be abale to VHOSTEXCLUDE specific hosts). > I have included some lines from my logfile. These are old logfiles > that I am trying to analyze, so I can't adjust the format or > anything. I am thinking that I may need to try and remove the > unwanted lines from the logfile if I can't do it with Analog, but > that is going to be a serious pain in the tush. My reference to changing the LOGFORMAT was to changing the way you tell Analog to parse the existing logs, not to changing the format of the logs themselves. In this case, I was suggesting that if Analog doesn't known which field should be %v, you might be able to create a LOGFORMAT to help it find the VHOST field. > You are welcome to email me directly at [EMAIL PROTECTED] if you > have any further suggestions. > > c-24-17-62-160.client.comcast.net - - [30/Sep/2004:00:00:03 -0400] > "GET http://mail.antiochsea.edu/Images/PwrdByFC.gif HTTP/1.1" 304 175 > "http://mail.antiochsea.edu/Login/000293FF-80000002/"; "Mozilla/4.0 > (compatible; MSIE 6.0; Windows NT 5.1; Q312461; .NET CLR 1.1.4322)" This is a good example. The "virtual host information is included in the Request field. Therefore the LOGFORMAT for this line could be either: %S %j [%d/%M/%Y:%h:%n:%j %j] "%j %r %j" %c %b "%f" "%B" or %S %j [%d/%M/%Y:%h:%n:%j %j] "%j %j://%v/%r %j" %c %b "%f" "%B" If it's the first form, the FILEEXCLUDE http://mail.antiochsea.edu/* would exclude all requests to mail.antiochsea.edu, because Analog sees the hostname as part of the file requested. If it's the second form, then VHOSTEXCLUDE mail.antiochsea.edu should do the job. I can't tell whether Analog is automatically detecting the LOGFORMAT (in which case it's probably the forst form), or if the logfile has a #Fields entry at the start that documents that LOGFORMAT for Analog (probably the second form), or if you've got a hardcoded LOGFORMAT or APACHELOGFORMAT in your Analog.cfg. But if the entries in the Request Report have http://etc, etc in them, then you probably need FILEEXCLUDE, if the Request Report just has entries like /Images/Banner.gif, then VHOSTEXCLUDE format will probably work. Aengus +------------------------------------------------------------------------ | TO UNSUBSCRIBE from this list: | http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +------------------------------------------------------------------------
