On Monday, April 17, 2006 2:03 PM [EDT],
Mushtaque, Sayed Imtiaz (GE, Corporate,consultant)
<[EMAIL PROTECTED]> wrote:
> Hi
> I am new to analog and have just compiled the same for my
> environment. We run apache web server with a custom logformat string.
> I have tried several iterations of the logformat but no success yet.
> Pls assist me in setting up the logformat string. Below are my
> details.
>
> LogFormat specified in httpd.conf
> LogFormat "\"%{ClientIP}i\" \"%{sm_user}i\" \"%t\" \"%r\" \"%>s\"
> \"%b\" \"%T\" \"%D\" \"%{Referer}i\" \"%{User-Agent}i\" \"%{host}i\""
> combined
If you just add
APACHELOGFORMAT ("\"%{ClientIP}i\" .... \"%{host}i\"")
to your analog.cfg and run Analog, you'll get the following warning:
analog: Warning C: Bad argument in configuration command: ignoring it:
APACHELOGFORMAT -> LOGFORMAT (""%j" "%j" "[%d/%M/%Y:%h:%n:%j]"
"%j%w%r%wHTTP%j" "%c" "%b" "%t" "%D" "%f" "%B" "%v"")
analog: ...cont..: (reason: one item occurs twice in format)
A quick scan of your logformat shows that you have 2 entries for "Processing
Time", %t (processing time in seconds) and %D (processing time in
microseconds), so you can take the "translated" LOGFORMAT that Analog
displays, and change the %t to %j (Processing Time in seconds is a total
waste of space), and you end up with
LOGFORMAT (""%j" "%j" "[%d/%M/%Y:%h:%n:%j]" "%j%w%r%wHTTP%j" "%c" "%b" "%j"
"%D" "%f" "%B" "%v"")
This still isn't quite right, as you bracketed your original Apache
logformat with ", even though you used " within the logformt itself, so you
need to strip that first and last ". This gives
LOGFORMAT ("%j" "%j" "[%d/%M/%Y:%h:%n:%j]" "%j%w%r%wHTTP%j" "%c" "%b" "%j"
"%D" "%f" "%B" "%v")
which will recognize your logfile.
If you want, you can tighten that up somewhat with this LOGFORMAT string:
LOGFORMAT (%j[%d/%M/%Y:%h:%n:%j]" "%j %r %j" "%c" "%b" "%j" "%D" "%f" "%B"
"%v")
Aengus
>
> Sample log entry
> "3.14.2.203" "500448330" "[17/Apr/2006:12:13:21 -0400]" "GET /
> HTTP/1.1" "302" "-" "0" "2205" "-" "Mozilla/4.0 (compatible; MSIE
> 6.0; Windows NT 5.0; T312461; .NET CLR 1.0.3705; .NET CLR 1.1.4322)"
> "energy.home.ge.com"
>
> Thanks
> Imtiaz
>
> +------------------------------------------------------------------------
>> TO UNSUBSCRIBE from this list:
>> http://lists.meer.net/mailman/listinfo/analog-help
>>
>> Analog Documentation: http://analog.cx/docs/Readme.html
>> List archives: http://www.analog.cx/docs/mailing.html#listarchives
>> Usenet version: news://news.gmane.org/gmane.comp.web.analog.general
> +------------------------------------------------------------------------
+------------------------------------------------------------------------
| TO UNSUBSCRIBE from this list:
| http://lists.meer.net/mailman/listinfo/analog-help
|
| Analog Documentation: http://analog.cx/docs/Readme.html
| List archives: http://www.analog.cx/docs/mailing.html#listarchives
| Usenet version: news://news.gmane.org/gmane.comp.web.analog.general
+------------------------------------------------------------------------
