What's helped me in the past (with custom logs in analog) is to "junk" each of the fields and slowly add back in what you need...
On Mon, Jun 12, 2006 at 11:52:53PM +0100, Pete Mason wrote: > Hi, > I wonder if anyone can see what I'm doing wrong... > > [...] > > It was odd because the log files are very similar to the apache combined log > files I had before. Typical output is > > 62.252.32.11 - - [04/Jun/2006:23:59:57 +0200] "GET > /Images/furniture/covers/thumb/51.48.jpg HTTP/1.1" 200 1878 > www.socialistparty.org.uk <http://www.socialistparty.org.uk/> > "http://www.socialistparty.org.uk/cgi-bin/bookform7.pl?nextten=31 > <http://www.socialistparty.org.uk/cgi-bin/bookform7.pl?nextten=31&ordernumbe > r=2211&cat=0&findword=0&sortby> &ordernumber=2211&cat=0&findword=0&sortby=" > "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; Tesco; .NET CLR > 1.1.4322)" "86.29.142.254" > > I downloaded analog 6.0, and tested it OK with my old log files. > > 1and1 told me the custom log: > > CustomLog /var/log/httpd/access_log "%{Host}i %h %l %u %t \"%r\" %s %b %v > \"%{Referer}i\" \"%{User-agent}i\" > > [...] > > APACHELOGFORMAT (%s %j %j [%d/%M/%Y:%h:%n:%j %j] \"%j %r %j\" %b %v %S > \"%f\" \"%B\" \"%j\") My first impression, based on your custom log statement (which looks to be at least one or two fields in-error) and deciphering your HTML-ized email (log?) would be: LOGFORMAT (%S %j %u [%d/%M/%Y:%h:%n:%j %j] "%j %r %j" %c %b "%f" "%B" "%v") ...but I'd more likely start with... LOGFORMAT (%S %j %j [%d/%M/%Y:%h:%n:%j %j] "%j %r %j" %j %j "%j" "%j" "%j") ...and see if you get at least dates and requests, there. Hope that somehow helps... Russell -- Russell M. Van Tassell [EMAIL PROTECTED] Do you realize how many holes there could be if people would just take the time to take the dirt out of them? +------------------------------------------------------------------------ | TO UNSUBSCRIBE from this list: | http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +------------------------------------------------------------------------
