I've got some very old (1998) IIS4 logs - not the extended format even! - which I've had to edit a bit to get to the basic standard. Thing is, no matter which LOGFORMAT I try, I get errors.:
F: Closing configuration file C:\analog 6.0\analog 6.0\analog.cfg C:\analog 6.0\analog 6.0\analog.exe: Warning M: Logfile M:\logs\intranet\W3SVC1\ex9811*.log contains lines with no users, which are being filtered C:\analog 6.0\analog 6.0\analog.exe: Warning M: Logfile M:\logs\intranet\W3SVC1\ex9811*.log contains lines with no bytes: byte counts may be low F: Opening C:\analog 6.0\analog 6.0\lang\uk.lng as language file F: Closing language file C:\analog 6.0\analog 6.0\lang\uk.lng F: Opening C:\analog 6.0\analog 6.0\lang\ukdom.tab as domains file F: Closing domains file C:\analog 6.0\analog 6.0\lang\ukdom.tab F: Opening C:\analog 6.0\analog 6.0\lang\ukdesc.txt as report descriptions file F: Closing report descriptions file C:\analog 6.0\analog 6.0\lang\ukdesc.txt C:\analog 6.0\analog 6.0\analog.exe: Warning F: Failed to open DNS input file C:\analog 6.0\analog 6.0\dnscache: ignoring it F: Opening M:\logs\intranet\W3SVC1\ex981102.log as logfile C: #Software: Microsoft Internet Information Server 4.0 C: * C: #Version: 1.0 C: * C: #Date: 1998-11-02 09:46:56 C: * C: #Fields: date time c-ip cs-method cs-uri-stem sc-status C: * C: 1998-11-02 09:46:56 125.24.1.101 GET / 401 C: * C: 1998-11-02 09:47:00 125.24.1.101 GET /Default.htm 304 C: * C: 1998-11-02 09:47:00 125.24.1.101 GET /pages/LeftFrame.asp 200 C: * C: 1998-11-02 09:47:00 125.24.1.101 GET /pages/main.asp 200 C: * C: 1998-11-02 09:47:00 125.24.1.101 GET /pages/top.asp 200 C: * C: 1998-11-02 09:47:03 125.24.1.101 GET /images/Buttons/cou.gif 304 using DEBUG ON LOGFORMAT (%Y-%m-%d %h:%n:%j %S %j %r %c) #1998-11-03 08:50:01 125.22.4.128 GET / 401 #LOGFORMAT MICROSOFT-NA LOGFILE M:\logs\intranet\W3SVC1\ex9811*.log #LOGFORMAT MS-EXTENDED OUTPUT XHTML # #OUTPUT COMPUTER OUTFILE Report.htm VERSUS:: F: Closing configuration file C:\analog 6.0\analog 6.0\analog.cfg F: Opening C:\analog 6.0\analog 6.0\lang\uk.lng as language file F: Closing language file C:\analog 6.0\analog 6.0\lang\uk.lng F: Opening C:\analog 6.0\analog 6.0\lang\ukdom.tab as domains file F: Closing domains file C:\analog 6.0\analog 6.0\lang\ukdom.tab F: Opening C:\analog 6.0\analog 6.0\lang\ukdesc.txt as report descriptions file F: Closing report descriptions file C:\analog 6.0\analog 6.0\lang\ukdesc.txt C:\analog 6.0\analog 6.0\analog.exe: Warning F: Failed to open DNS input file C:\analog 6.0\analog 6.0\dnscache: ignoring it F: Opening M:\logs\intranet\W3SVC1\ex981102.log as logfile C: #Software: Microsoft Internet Information Server 4.0 C: * C: #Version: 1.0 C: * C: #Date: 1998-11-02 09:46:56 C: * C: #Fields: date time c-ip cs-method cs-uri-stem sc-status C: * C: 1998-11-02 09:46:56 125.24.1.101 GET / 401 C: * C: 1998-11-02 09:47:00 125.24.1.101 GET /Default.htm 304 C: * C: 1998-11-02 09:47:00 125.24.1.101 GET /pages/LeftFrame.asp 200 using DEBUG ON #LOGFORMAT (%Y-%m-%d %h:%n:%j %S %j %r %c) #1998-11-03 08:50:01 125.22.4.128 GET / 401 LOGFORMAT MICROSOFT-INT LOGFILE M:\logs\intranet\W3SVC1\ex9811*.log #LOGFORMAT MS-EXTENDED OUTPUT XHTML # #OUTPUT COMPUTER OUTFILE Report.htm VERSUS F: Closing configuration file C:\analog 6.0\analog 6.0\analog.cfg F: Opening C:\analog 6.0\analog 6.0\lang\uk.lng as language file F: Closing language file C:\analog 6.0\analog 6.0\lang\uk.lng F: Opening C:\analog 6.0\analog 6.0\lang\ukdom.tab as domains file F: Closing domains file C:\analog 6.0\analog 6.0\lang\ukdom.tab F: Opening C:\analog 6.0\analog 6.0\lang\ukdesc.txt as report descriptions file F: Closing report descriptions file C:\analog 6.0\analog 6.0\lang\ukdesc.txt C:\analog 6.0\analog 6.0\analog.exe: Warning F: Failed to open DNS input file C:\analog 6.0\analog 6.0\dnscache: ignoring it F: Opening M:\logs\intranet\W3SVC1\ex981102.log as logfile C:\analog 6.0\analog 6.0\analog.exe: Warning M: Logfile M:\logs\intranet\W3SVC1\ex981102.log contains lines with no users, which are being filtered C:\analog 6.0\analog 6.0\analog.exe: Warning M: Logfile M:\logs\intranet\W3SVC1\ex981102.log contains lines with no bytes: byte counts may be low C: 1998-11-02 12:1998-11-02 09:00 125.22.4.148 GET /pages/asp/phone1.asp 200 C: * C: 1998-11-02 12:1998-11-02 09:31 125.22.4.148 POST /pages/asp/phone2.asp 200 C: * F: Closing logfile M:\logs\intranet\W3SVC1\ex981102.log S: Successful requests: 0 S: Redirected requests: 0 S: Failed requests: 0 S: Requests returning informational status code: 0 S: Status code not given: 3 S: Unwanted lines: 982 S: Corrupt lines: 2 S: No times in logfile using LOGFORMAT MS-EXTENDED here's a sample of the log file: #Software: Microsoft Internet Information Server 4.0 #Version: 1.0 #Date: 1998-11-02 09:46:56 #Fields: date time c-ip cs-method cs-uri-stem sc-status 1998-11-02 09:46:56 125.24.1.101 GET / 401 1998-11-02 09:47:00 125.24.1.101 GET /Default.htm 304 1998-11-02 09:47:00 125.24.1.101 GET /pages/LeftFrame.asp 200 1998-11-02 09:47:00 125.24.1.101 GET /pages/main.asp 200 1998-11-02 09:47:00 125.24.1.101 GET /pages/top.asp 200 1998-11-02 09:47:03 125.24.1.101 GET /images/Buttons/cou.gif 304 1998-11-02 09:47:03 125.24.1.101 GET /images/Misc/leftback.jpg 304 1998-11-02 09:47:03 125.24.1.101 GET /images/Buttons/psp.gif 304 1998-11-02 09:47:03 125.24.1.101 GET /images/Buttons/sdv.gif 304 1998-11-02 09:47:03 125.24.1.101 GET /images/Buttons/cbs.gif 304 1998-11-02 09:47:03 125.24.1.101 GET /images/Buttons/new.gif 304 1998-11-02 09:47:03 125.24.1.101 GET /images/Misc/york+logo.gif 304 1998-11-02 09:47:03 125.24.1.101 GET /images/Buttons/ext.gif 304 1998-11-02 09:47:03 125.24.1.101 GET /images/Misc/topback.jpg 304 1998-11-02 09:47:06 125.24.1.101 GET /pages/asp/phone1.asp 200 1998-11-02 09:47:38 125.24.1.101 GET /images/Buttons/phonedir.gif 304 1998-11-02 09:47:38 125.24.1.101 POST /pages/asp/phone2.asp 200 1998-11-02 10:01:35 125.24.1.101 GET /images/Buttons/search.gif 304 1998-11-02 10:02:05 125.24.1.101 GET /images/Buttons/home.gif 304 1998-11-02 10:02:05 125.24.1.101 GET /images/Buttons/help.gif 304 1998-11-02 10:02:05 125.24.1.101 GET /images/Buttons/bulletins.gif 304 1998-11-02 10:02:05 125.24.1.101 GET /images/Buttons/publish.gif 304 1998-11-02 10:20:43 125.24.1.101 GET /pages/asp/phone1.asp 200 1998-11-02 10:20:56 125.24.1.101 POST /pages/asp/phone2.asp 200 how to get it to behave? I'm reckoning that by switching to the custom format LOGFORMAT (%Y-%m-%d %h:%n:%j %S %j %r %c) it should be fine, as that seems to be a correct mapping, but its the worst behaving of the three? * * * * * * * * * * * * This communication is from City of York Council. The information contained within, and in any attachment(s), is confidential and legally privileged. It is for the exclusive use of the intended recipient(s). If you are not the intended recipient(s), please note that any form of distribution, copying or use of this communication, or the information within, is strictly prohibited and may be unlawful. Equally, you must not disclose all, or part, of its contents to any other person. If you have received this communication in error, please return it immediately to the sender, then delete and destroy any copies of it. City of York Council disclaims any liability for action taken in reliance on the content of this communication. +------------------------------------------------------------------------ | TO UNSUBSCRIBE from this list: | http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +------------------------------------------------------------------------
