On Tuesday, February 07, 2006 10:01 AM [EDT], dotnet works <[EMAIL PROTECTED]> wrote:
> Hi, > > I have a logfile that is processsable by Mach5 Analyzer but will not > work with Analog, I have tried various logformat commands as it is > unable to auto detect the format but can't seem to get it right, > below are some sample lines: > > 154.5.92.181 - - [02/Jan/2006:00:49:04 +0100] "GET /uk/av/back2.jpg > HTTP/1.1" 200 526 www.friouk.biz > "http://www.friouk.biz/uk/contact.php"; "Mozilla/4.0 (compatible; MSIE > 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)" "-" > > I have tried the following format commands: > > LOGFORMAT %S %j %j [%d/%M/%Y:%h:%n:%j] "%j%w%r%wHTTP%j" %c %b\n What about all the stuff after %b in the sample lines you provided? www.friouk.biz "http://www ... CLR 1.0.3705)" "-" doesn't look like \n to me. LOGFORMAT (%S %j %j [%d/%M/%Y:%h:%n:%j] "%j%w%r%wHTTP%j" %c %b %j) would work, but it discards some of the information in your logfile. > LOGFORMAT %S %j %j [%d/%M/%Y:%h:%n:%j] %v "%j%w%r%wHTTP%j" %c %b\n None of your sample lines have a Virtual host (%v) between the timestamp and the request. A more complete LOGFORMAT would be: LOGFORMAT (%S %j %j [%d/%M/%Y:%h:%n:%j] "%j%w%r%wHTTP%j" %c %b %v "%f" %B" %j) (I don't know what the last field might be). Aengus +------------------------------------------------------------------------ | TO UNSUBSCRIBE from this list: | http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +------------------------------------------------------------------------
