Re: [analog-help] Can't auto-detect format

[Pete Mason]

Hi,

 

Thanks Aengus and Russell, giving me guidance on the analaog apache log format function, a working formula, and a general method to work from - what more could you ask!

 

Will let you know the outcome in about twelve hours when I get back to home/office.

 

Many thanks, I can see now the circles I went round in!

 

Pete

Aengus <[EMAIL PROTECTED]> wrote:

On Monday, June 12, 2006 6:52 PM [EDT],
Pete Mason <[EMAIL PROTECTED]>wrote:

>> Hi,
>> I wonder if anyone can see what I'm doing wrong...
>>
>> I moved host from Demon to 1and1 and for the first time got a "Can't
>> auto-detect format" in the analog error file, after using analog for
>> years.
>>
>> It was odd because the log files are very similar to the apache
>> combined log files I had before. Typical output is
>>
>> 62.252.32.11 - - [04/Jun/2006:23:59:57 +0200] "GET
>> /Images/furniture/covers/thumb/51.48.jpg HTTP/1.1" 200 1878
>> www.socialistparty.org.uk
>> "http://www.socialistparty.org.uk/cgi-bin/bookform7.pl?nextten=31
>> >> r=2211&cat=0&findword=0&sortby>
>> &ordernumber=2211&cat=0&findword=0&sortby=" "Mozilla/4.0
>> (compatible; MSIE 6.0; Windows NT 5.1; SV1; Tesco; .NET CLR
>> 1.1.4322)" "86.29.142.254"
>>
>> I downloaded analog 6.0, and tested it OK with my old log files.
>>
>> 1and1 told me the custom log:
>>
>> CustomLog /var/log/httpd/access_log "%{Host}i %h %l %u %t \"%r\" %s
>> %b %v \"%{Referer}i\" \"%{User-agent}i\"
>>
>> So in the config file, after trying it exactly as given without
>> success, I changed it to:
>>
>>
>> APACHELOGFORMAT (%s %h %l %u %t \"%r\" %s %b %v \"%f\" \"%u\")
>> LOGFILE C:\logs\splogs\2006\june06\*.*

The whole point of APACHELOGFORMAT is that you just cut and paste the
logformat string from your httpd.conf, so you don't have to "translate" into
Analog. You should use something like:

APACHELOGFORMAT (%{Host}i %h %l %u %t \"%r\" %s %b %v \"%{Referer}i\"
\"%{User-agent}i\")

But your sample string obviously doesn't start with "%{Host}i %h" (it only
has one address at the start, not two), and %{Host}i is the same as %v, so I
took %{Host}i out, and added a %j at the end for that "86.29.142.254" field,
which leaves
APACHELOGFORMAT (%h %l %u %t \"%r\" %s %b %v \"%{Referer}i\"
\"%{User-agent}i\" %j)

That parses the sample line that you provided.

Aengus


+------------------------------------------------------------------------
| TO UNSUBSCRIBE from this list:
| http://lists.meer.net/mailman/listinfo/analog-help
|
| Analog Documentation: http://analog.cx/docs/Readme.html
| List archives: http://www.analog.cx/docs/mailing.html#listarchives
| Usenet version: news://news.gmane.org/gmane.comp.web.analog.general
+------------------------------------------------------------------------

+------------------------------------------------------------------------
|  TO UNSUBSCRIBE from this list:
|    http://lists.meer.net/mailman/listinfo/analog-help
|
|  Analog Documentation: http://analog.cx/docs/Readme.html
|  List archives:  http://www.analog.cx/docs/mailing.html#listarchives
|  Usenet version: news://news.gmane.org/gmane.comp.web.analog.general
+------------------------------------------------------------------------