On Monday, August 28, 2006 4:51 PM [EDT],
Shulkin, Vadim <[EMAIL PROTECTED]> wrote:
FYI,
I found very strange reaction of the analog to the log files
contain "\r" characters inside the log line. If it's DOS/Windows EOF
style why analog reacts different to a single character "\r", which
is only in combination with "\n" considered to be EOF. If it's UNIX
type of EOF why this character forces analog to split lines and
report:
./analog: Warning F: Can't auto-detect format of log file
./analog_bug.sample.log: ignoring it
I think the problem is inside input.c file where it tries to parse
the logline. I would probably find the problem myself, but it will
take much more time for me then for you to identify the problem. I
will appreciate the help and attaching 10 lines of logs from my
server, so you can see for yourself. Take a look at the end of the
third field. There is a "\r" at the end.
If I pass the file though DOS2UNIX utility, everything is working
fine after that. Such an arrangement is very, very inconvenient for
me, because will require double processing plus arrangement of
non-standard situation. I prefer to fix and re-compile analog and
not to change anything else.
"Can't auto-detect format of log file" isn't a bug - it just means that you
have a non-standard logfile that Analog doesn't recognize, and none of the
standard logformats that Analog recognizes have a newline in the middle.
The "bug" appears to be in your web server, which includes a terminating \r
in the username field when a user is authenticated. You can work around this
by manually specifying the LOGFORMAT that Analog should use. You need to
specify 2 LOGFORMATs, one for the normal lines, and one for the lines that
your webserver is adding a newline to.
These lines in my analog.cfg allow me to parse your sample logfile (on
Windows).
LOGFORMAT (%S - %u [%d/%M/%Y:%h:%n:%j %j] "%j %r %j" %c %b)
LOGFORMAT (%S - %u\n [%d/%M/%Y:%h:%n:%j %j] "%j %r %j" %c %b)
logfile \temp\analog_bug.sample.log
The second LOGFORMAT tells Analog that some of the lines it needs to parse
will have an extraneous newline character after the Username field.
Aengus
+------------------------------------------------------------------------
| TO UNSUBSCRIBE from this list:
| http://lists.meer.net/mailman/listinfo/analog-help
|
| Analog Documentation: http://analog.cx/docs/Readme.html
| List archives: http://www.analog.cx/docs/mailing.html#listarchives
| Usenet version: news://news.gmane.org/gmane.comp.web.analog.general
+------------------------------------------------------------------------
