On Sunday, March 19, 2006 6:08 PM [EDT], Chris Hampartsoumian <[EMAIL PROTECTED]> wrote:
> I am replying to an ancient post I saw archived on the web site; > http://lists.meer.net/pipermail/analog-help/2005-August/018703.html > > Back on Fri Aug 19 2005, Aye Mon posted: >> >> Does anyone has any idea how to work with Helix Server log format? >> Below is a >> sample log from the server. I tried using different log formats, and >> it's not >> working. >> >> 138.220.124.82 - - [30/Sep/2004:12:06:45 -0400] "GET >> bspan/wbi/626/1251/poverty_impact_MACRO_May-06-AM.rm RTSPT/1.0" 200 >> 170990 >> [WinNT_5.0_0.0.0.0_play32_EP80_en-US_686_axembed] >> [b525af11-12fa-11d9-e033-6d502592b936] [Stat1: 128 >> 0 0 >> 0 0 32_Kbps_Voice][Stat2: 32115 81499 >> 0 0 >> 0 0 0 0 0 1 20 >> 32_Kbps_Voice] 136654670 7599 7 0 0 37 >> >> Thanks, >> Aye Mon > > > I couldn't find a reply out on the net, and I was trying to process > my helix server log with analog as well. I ended up writing a log > string for the Helix Server Log which goes like this: > > LOGFORMAT (%S - - [%d/%M/%Y:%h:%n:%j] "%j %r %j" %c %b [%j] [%j] [% > j] %j %j %j %j %j %j) > > You can get the details on what that lot means form the Analog Home > Page, but the key which kept me stumped for a while is that the Helix > Server enteres two spaces after the date enclosed by []'s and just > before the GET. > > Details can be found at: http://www.soumian.com/resources.php > > Thought I'd post it in case it ever goes up as a reply to the > original post. - Sorry if I've used the list in totally the wrong > way, I've just suddenly decied I should at least try and post an > answer instead of only ever searching for them This is a perfectly good use of the list - posts to the list get archived, and your answer will be here for the next person who asks. But you can probably make your LOGFORMAT a little bit simpler by just treating everything after the byte count as %j, and using %w instead of the 2 spaces: LOGFORMAT (%S - - [%d/%M/%Y:%h:%n:%j]%w"%j %r %j" %c %b %j) Some would argue that you should always use %w, (whitespace) even for a single space, (it will cover one or more spaces or a tab), but usually it's not needed, and it's much esier to read a LOGFORMAT with spaces rather than %w). By the way, the question has come up before, but there ws never any really definitive answer provided by someone familiar with Helix: http://lists.meer.net/pipermail/analog-help/2002-November/013677.html http://lists.meer.net/pipermail/analog-help/2004-August/016823.html http://lists.meer.net/pipermail/analog-help/2004-August/016824.html http://lists.meer.net/pipermail/analog-help/2004-August/016825.html http://lists.meer.net/pipermail/analog-help/2004-August/016826.html http://lists.meer.net/pipermail/analog-help/2004-November/017319.html Aengus +------------------------------------------------------------------------ | TO UNSUBSCRIBE from this list: | http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +------------------------------------------------------------------------
