David, Analog parses a log file line following the FORMAT string. For each item, it matches everything until it reaches the subsequent character. So the construct "%B" will look for a quote, and then grab everything until the next quote as the browser.
Following that you have " -" in your sample logfile line. But the logformat you gave has " %j %j", so Analog is looking for two spaces and some data in between. If you don't care what comes after the browser, you can just dump everything with a single %j (because it will match everything to the end of the line.) The following LOGFORMAT should work, assuming most of your log file contains lines like the ones shown. LOGFORMAT (%S %j %u [%d/%M/%Y:%h:%n:%j] "%j%w%r%wHTTP%j" %c %b "%f" "%B" %j) Note that if you are specifying the LOGFILE in a different configuration file (or on the command-line or through the form interface) you will need to use DEFAULTLOGFORMAT. Otherwise, just put the LOGFILE line immediately after the LOGFORMAT line. Hope that helps, -- Jeremy Wadsack Seven Simple Machines -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Aengus Sent: Wednesday, January 04, 2006 6:08 AM To: Support for analog web log analyzer Subject: Re: [analog-help] Corrupt log files - extra character at end oflineinCombined Log Format On Wednesday, January 04, 2006 8:34 AM [EDT], David Batten <[EMAIL PROTECTED]> wrote: > # > HOSTURL "none" > # Host name will be a link to here > # > DEFAULTLOGFORMAT > # this is the log format used for drag and dropped logs > # > LOGFORMAT (%S %j %u [%d/%M/%Y:%h:%n:%j] "%j%w%r%wHTTP%j" %c %b "%f" > "%B" %j %j) I'm embarrassed that I have to spell this out for you - how many extra fields do you want to ignore after the Browser (%B)? Here's your sample logfile line: 62.253.96.44 - - [09/Nov/2005:23:38:41 +0000] "GET /hooklinks/pike/articles/artindex.html HTTP/1.1" 200 4819 "FROM http://www.hooklinks.co.uk/pike/navigation2/homenav2.html"; "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; Hotbar 4.6.1)" - 62.253.96.44 is %S - is %j - is %u [09/Nov/2005:23:38:41 +0000] is [%d/%M/%Y:%h:%n:%j] "GET /hooklinks/pike/articles/artindex.html HTTP/1.1" is "%j%w%r%wHTTP%j" 200 is %c 4819 is %b "FROM http://www.hooklinks.co.uk/pike/navigation2/homenav2.html"; is "%f" "Mozilla/4.0 (...)" is "%B" Aengus +----------------------------------------------------------------------- - | TO UNSUBSCRIBE from this list: | http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +----------------------------------------------------------------------- - +------------------------------------------------------------------------ | TO UNSUBSCRIBE from this list: | http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +------------------------------------------------------------------------
