Aengus - thanks for the help on the logformat. That seemed to really
help, but I'm still having trouble with specific areas on the actual
report output, specifically in the area of the request report.
Here's an example of one my log files I'm pulling from from 10/29
(hopefully not too hard to read)
*********************
#StartDate: 2005-10-29 00:00:01
#EndDate: 2005-10-30 00:00:02
#TimeFormat: UTC
#EncodingFormat: UTF-8
#ServerName: wmvstream.dese.state.mo.us
#ServerIP: 10.24.248.48
#Software: Windows Media Services
#Version: 9.01.01.3814
#PublishingPoint: [Global]
#Fields: c-ip date time c-dns cs-uri-stem c-starttime x-duration c-rate
c-status c-playerid c-playerversion c-playerlanguage cs(User-Agent)
cs(Referer) c-hostexe c-hostexever c-os c-osversion c-cpu filelength
filesize avgbandwidth protocol transport audiocodec videocodec
channelURL sc-bytes c-bytes s-pkts-sent c-pkts-received
c-pkts-lost-client c-pkts-lost-net c-pkts-lost-cont-net c-resendreqs
c-pkts-recovered-ECC c-pkts-recovered-resent c-buffercount
c-totalbuffertime c-quality s-ip s-dns s-totalclients s-cpu-util
cs-user-name s-session-id s-content-path cs-url cs-media-name
c-max-bandwidth cs-media-role s-proxied
4.89.242.29 2005-10-29 11:55:41 - /findingmissouri2 0 145 1 408
{3300AD50-2C39-46C0-AE0A-73CD763E69E1} 9.0.0.3250 - WMPlayer/9.0.0.3250
- - - Windows_XP 5.1.0.2600 Pentium 676 22233402 24910 rtsp UDP - - -
1545415 - 2016 - - - - - - - - - - 10.24.248.48
wmvstream.dese.state.mo.us 1 0 - 414
file://E:\wmpub\LETS\Finding%20Missouri\findmo_unit2.wmv
rtsp://wmvstream.dese.mo.gov/findingmissouri2 findmo_unit2.wmv 24910 - 0
68.188.98.9 2005-10-29 18:43:53 - /findingmissouri3 0 160 5 200
{3300AD50-2C39-46c0-AE0A-F98BB56EF98D} 9.0.0.2980 en-US
WMFSDK/9.0.0.2980_WMPlayer/9.0.0.3250 - wmplayer.exe 9.0.0.2980
Windows_2000 5.0.0.2195 Pentium 767 26806028 1350280 rtsp TCP - - -
27076024 27076024 18558 18558 0 0 0 0 0 0 1 0 100 10.24.248.48
wmvstream.dese.state.mo.us 1 0 - 416
file://E:\wmpub\LETS\Finding%20Missouri\findmo_unit3.wmv
mms://wmvstream.dese.mo.gov/findingmissouri3 findmo_unit3.wmv - - 0
67.176.75.8 2005-10-29 19:52:17 - /mlu10-05 0 452 5 200
{3300AD50-2C39-46c0-AE0A-01A23582ADCB} 9.0.0.3250 en-US
WMFSDK/9.0.0.3250_WMPlayer/9.0.0.3250 - wmplayer.exe 9.0.0.3250
Windows_XP 5.1.0.2600 Pentium 1795 62899228 1111129 rtsp TCP - - -
63532091 63532091 43548 43548 0 0 0 0 0 0 1 1 100 10.24.248.48
wmvstream.dese.state.mo.us 1 0 - 417 file://E:\wmpub\lvis\mlu10-05.wmv
mms://wmvstream.dese.mo.gov/mlu10-05 mlu10-05.wmv 2313862 - 0
71.0.61.135 2005-10-29 20:45:20 - /findingmissouri4 0 218 1 200
{3300AD50-2C39-46c0-AE0A-F06F1CE36E98} 10.0.0.3646 en-US
WMFSDK/10.0.0.3646_WMPlayer/10.0.0.3646 - wmplayer.exe 10.0.0.3646
Windows_XP 5.1.0.2600 Pentium 600 20845256 379727 rtsp TCP - - -
10501833 10468281 7197 7174 0 0 0 0 0 0 1 3 100 10.24.248.48
wmvstream.dese.state.mo.us 1 0 - 418
file://E:\wmpub\LETS\Finding%20Missouri\findmo_unit4.wmv
mms://wmvstream.dese.mo.gov/findingmissouri4 findmo_unit4.wmv 434379 - 0
71.0.63.30 2005-10-29 22:42:36 - /svj5-05_1 0 113 1 200
{3300AD50-2C39-46c0-AE0A-95D4D07974F0} 10.0.0.3646 en-US
WMFSDK/10.0.0.3646_WMPlayer/10.0.0.3646 - wmplayer.exe 10.0.0.3646
Windows_XP 5.1.0.2600 Pentium 113 8441045 370955 rtsp TCP
Windows_Media_Audio_9 Windows_Media_Video_9 - 5225263 5225263 2810 2810
0 0 0 0 0 0 1 5 100 10.24.248.48 wmvstream.dese.state.mo.us 1 0 - 420
file://E:\wmpub\lvis\svj5-05%201.wmv
mms://wmvstream.dese.mo.gov/svj5-05_1 svj5-05%201.wmv 448799 - 0
71.0.63.30 2005-10-29 22:44:58 - /svj5-05_2 0 44 1 200
{3300AD50-2C39-46c0-AE0A-1D30F2F22A29} 10.0.0.3646 en-US
WMFSDK/10.0.0.3646_WMPlayer/10.0.0.3646 - wmplayer.exe 10.0.0.3646
Windows_XP 5.1.0.2600 Pentium 44 3568191 387660 rtsp TCP
Windows_Media_Audio_9 Windows_Media_Video_9 - 2198789 2198789 1186 1186
0 0 0 0 0 0 1 6 100 10.24.248.48 wmvstream.dese.state.mo.us 1 0 - 421
file://E:\wmpub\lvis\svj5-05%202.wmv
mms://wmvstream.dese.mo.gov/svj5-05_2 svj5-05%202.wmv 430508 - 0
71.1.117.168 2005-10-29 23:43:42 - /mosafe 0 39 1 200
{3300AD50-2C39-46c0-AE0A-0468C1323892} 9.0.0.3250 en-US
WMFSDK/9.0.0.3250_WMPlayer/9.0.0.3250 - wmplayer.exe 9.0.0.3250
Windows_XP 5.1.0.2600 Pentium 1416 178369243 545005 rtsp TCP - - -
2674943 2674943 2324 2324 0 0 0 0 0 0 1 3 100 10.24.248.48
wmvstream.dese.state.mo.us 1 0 - 422 file://E:\wmpub\DHSS\mosafe.wmv
mms://wmvstream.dese.mo.gov/mosafe mosafe.wmv 604427 - 0
*****************
But my report I run for the period of 10/24/05 to 10/31/05, this is the
output for the request report portion:
reqs: %bytes: file
----: ------: ----
45: : /1st steps providers training/
9: : [not listed: 2 files]
Any ideas on what I need to to do in my analog.cfg? I can post that too
if needed.
Thanks! Lainie
------------------------------
Message: 4
Date: Thu, 27 Oct 2005 11:41:23 -0400
From: "Aengus" <[EMAIL PROTECTED]>
Subject: Fw: Subject: Re: [analog-help] Reading Windows Media Server
Logs
To: "Support for analog web log analyzer" <[email protected]>
Message-ID: <[EMAIL PROTECTED]>
Content-Type: text/plain; charset=iso-8859-1
Please keep your posts on the list - that's what it's there for.
Analog recognizes your logfiles format from the Fields statement, which
looks like this:
#Fields: c-ip date time c-dns cs-uri-stem c-starttime x-duration c-rate
c-status c-playerid c-playerversion c-playerlanguage cs(User-Agent)
cs(Referer) c-hostexe c-hostexever c-os c-osversion c-cpu filelength
filesize avgbandwidth protocol transport audiocodec videocodec
channelURL
sc-bytes c-bytes s-pkts-sent c-pkts-received c-pkts-lost-client
c-pkts-lost-net c-pkts-lost-cont-net c-resendreqs c-pkts-recovered-ECC
c-pkts-recovered-resent c-buffercount c-totalbuffertime c-quality s-ip
s-dns
s-totalclients s-cpu-util cs-user-name s-session-id s-content-path
cs-url
cs-media-name c-max-bandwidth cs-media-role s-proxied
When you run Analog, it says that it parses this string as:
%s%w%Y-%m-%d%w%h:%n:%j%w%S%w%r%w%j%w%j%w%j%w%j%w%j%w%j%w%j%w"%B"%w"%f"%w
%j
%w%j%w%j%w%j%w%j%w%j%w%j%w%j%w%j%w%j%w%j%w%j%w%j%w%b%w%j%w%j%w%j%w%j%w%j
%w%j
%w%j
%w%j%w%j%w%j%w%j%w%j%w%j%w%v%w%j%w%j%w%j%w%j%w%j%w%j%w%j%w%j%w%j%w%j\n
In a slightly more legible format, this is:
%s %Y-%m-%d %h:%n:%j %S %r %j %j %j %j %j %j %j "%B" "%f"%j.../n
If you look at your logfile lines, you'll see that cs(User-Agent) field
is
WMFSDK/10.0.0.3802_WMPlayer/10.0.0.3802, whereas Analog expects it to be
in
quotes ("%B" in the logformat). This causes Analog to see the line as
corrupt. The same goes for the next field, cs(Referer).
1.2.3.4 2005-10-23 14:46:38 - /1st%20Steps%20Providers%20Training/ 0
1350 5
200 {3300AD50-2C39-46c0-AE0A-4A5EEED122CA} 10.0.0.3802 en-US
WMFSDK/10.0.0.3802_WMPlayer/10.0.0.3802 - wmplayer.exe 10.0.0.3802
Windows_XP 5.1.0.2600 Pentium 6747 529081707 1645031 rtsp TCP - - -
280385841 280385841 170673 170673 0 0 0 0 0 0 1 2 100 10.24.248.48
wmvstream.dese.state.mo.us 1 0 - 52
file://E:\wmpub\Sped\1st%20Steps\Training\Module%201%20Orientation_MBR.w
mv
mms://wmvstream.dese.mo.gov/1st%20Steps%20Providers%20Training/
Module%201%20Orientation_MBR.wmv 2600573 - 0
You could start by using a LOGFORMAT without the quotes,
LOGFORMAT (%s %Y-%m-%d %h:%n:%j %S %r %j %j %j %j %j %j %j %B %f %j)
I'm not quite sure why Analog is counting the lines as successful
requests,
when there's no status code in that LOGFORMAT, but that line will give
you a
basic report. It doesn't report on the actual stream requested, or the
bytes
sent (because they're all marked as junk at the end), but you can modify
the
LOGFORMAT to pick up those specific fields, if you can figure out which
fields are actually useful.
(You can also include LOGFORMAT (#%j) to get Analog to ignore the header
lines if you're manually specifying the format).
LOGFORMAT (%s %Y-%m-%d %h:%n:%j %S %r %j %j %j %j %j %j %j %B %f %j)
LOGFORMAT (#%j)
logfile WMS_20051023.log
Aengus
On Tuesday, October 25, 2005 5:07 PM [EDT],
Strange, Lainie <[EMAIL PROTECTED]> wrote:
> Hi Aengus - Attached is an example of the WMS file format.
>
> -- Lainie
> ------------------------------
>
> Message: 2
> Date: Mon, 24 Oct 2005 17:01:33 -0400
> From: "Aengus" <[EMAIL PROTECTED]>
> Subject: Re: [analog-help] Reading Windows Media Server Logs
> To: "Support for analog web log analyzer" <[email protected]>
> Message-ID: <[EMAIL PROTECTED]>
> Content-Type: text/plain; charset=iso-8859-1
>
> On Monday, October 24, 2005 2:14 PM [EDT],
> Strange, Lainie <[EMAIL PROTECTED]> wrote:
>
>> I read through the archive and never really saw this answered.
>
> If it was never answered, then nobody reading the list knew the
> answer.
>
>> I want to read Windows Media logs on a Windows 2003 Server running
>> Windows Media Services using Analog. What does my analog.cfg file
>> need to look like to do this?
>
> What does a Windows Media Services logfile look like? (Other streaming
> media
> servers create logs that aren't particularly amenable to analysis by
> Analog,
> because they create multiple entries for a single stream. You might
> want to
> create a simple log based on a small number of (preferably
> simultaneous) tests from 2 or 3 test clients).
>
> Aengus
------------------------------
Message: 5
Date: Thu, 27 Oct 2005 11:42:18 -0700 (PDT)
From: Michael Avila <[EMAIL PROTECTED]>
Subject: Re: [analog-help] Upgrade to Apache 2.0.55
To: Support for analog web log analyzer <[email protected]>
Message-ID: <[EMAIL PROTECTED]>
Content-Type: text/plain; charset=iso-8859-1
Yes, I just saw that error. My apologies.
Mike
--- Stephen Turner <[EMAIL PROTECTED]>
wrote:
> On Thu, 27 Oct 2005, Michael Avila wrote:
>
> > I have Windows XP Apache 2.0.52 installed and want
> to upgrade to 2.0.55.
> > When I click on the msi file I am told to delete
> the existing version. If I
> > uninstall, what is deleted? I would want to keep
> the config file and scripts
> > and such. Why does it not overlay the current
> version and make any necessary
> > adjustments? I want to upgrade but I don't want to
> destroy anything in the
> > process, even if I have a backup. (Obviously, this
> is my first Apache
> > upgrade!)
> >
>
> You'd probably be better trying an Apache mailing
> list or newsgroup, rather
> than an analog one.
>
> --
> Stephen Turner, Cambridge, UK
> http://homepage.ntlworld.com/adelie/stephen/
> "Low Priced Cambridge Clare College. Big
> selection at eBay UK!"
> (Ad after Google search for Clare College
> Cambridge)
>
+-----------------------------------------------------------------------
-
> | TO UNSUBSCRIBE from this list:
> |
> http://lists.meer.net/mailman/listinfo/analog-help
> |
> | Analog Documentation:
> http://analog.cx/docs/Readme.html
> | List archives:
> http://www.analog.cx/docs/mailing.html#listarchives
> | Usenet version:
> news://news.gmane.org/gmane.comp.web.analog.general
>
+-----------------------------------------------------------------------
-
>
------------------------------
+-----------------------------------------------------------------------
-
| TO UNSUBSCRIBE from this list:
| http://lists.meer.net/mailman/listinfo/analog-help
|
| Usenet version: news://news.gmane.org/gmane.comp.web.analog.general
| List archives: http://www.analog.cx/docs/mailing.html#listarchives
+-----------------------------------------------------------------------
-
End of analog-help Digest, Vol 14, Issue 21
*******************************************
+------------------------------------------------------------------------
| TO UNSUBSCRIBE from this list:
| http://lists.meer.net/mailman/listinfo/analog-help
|
| Analog Documentation: http://analog.cx/docs/Readme.html
| List archives: http://www.analog.cx/docs/mailing.html#listarchives
| Usenet version: news://news.gmane.org/gmane.comp.web.analog.general
+------------------------------------------------------------------------
