OK. I sent the wrong copy of the format line - I'd been fiddling with it at the time. (%S %v %u [%d/%M/%Y:%h:%n:%j ] "%j %q %j" %c %b "%r" "%B") Is the correct version. This gives me: "Closing logfile M:\logs\webboard\Logs\Exchange2006.log S: Successful requests: 0 S: Redirected requests: 0 S: Failed requests: 0 S: Requests returning informational status code: 0 S: Status code not given: 0 S: Unwanted lines: 305025 S: Corrupt lines: 65"
Now, the issue here put better is: I've combined this log into a routine report I do, using IIS logs in extended format, and I get "F: Opening M:\logs\councilnet\W3SVC5\ex060104.log as logfile F: Detect that it's in Microsoft's version of extended format C: C: * C: C: * F: Closing logfile M:\logs\councilnet\W3SVC5\ex060104.log S: Successful requests: 9161 S: Redirected requests: 0 S: Failed requests: 5 S: Requests returning informational status code: 0 S: Status code not given: 0 S: Unwanted lines: 144869 S: Corrupt lines: 2 S: Earliest entry in logfile: 4/Jan/06:0017 S: Latest entry in logfile: 4/Jan/06:2351" As a fairly standard output. The includes part of the config file is ## for general site stats #FILEINCLUDE /* FILEINCLUDE /swr/swr_search.asp FILEINCLUDE /mhp/* FILEINCLUDE /phonebook/* FILEINCLUDE /docsinf/* FILEINCLUDE /news/* FILEINCLUDE /pages/main.asp FILEINCLUDE /webboard/*.dll?* FILEINCLUDE /~* FILEINCLUDE /webboard/* FILEINCLUDE /scripts/*.dll?* FILEINCLUDE /object/*.asp?* Which , far as I can see, should pick up the lines from the propriety file format. I have run a report based on the above, and this has produced plenty of output, but nothing I can attribute to this one file. 125.22.4.223 x.x.uk rfiexja [30/Apr/2002:14:57:08 ] "GET /empty HTTP/1.0" 200 1101 "http://x.x.x.uk:8080/~exchange"; "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 4.0)" Shows a good example - '/~exchange' should be picked up by the '~*' filter? -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Aengus Sent: 17 April 2007 14:20 To: Support for analog web log analyzer Subject: Re: [analog-help] file format issue - parsing ? On Tuesday, April 17, 2007 9:07 AM [EDT], Brereton, Stephen <[EMAIL PROTECTED]> wrote: > I'm trying to parse this log format: > > ... [20/Oct/2006:11:50:32 ] ... > ... %d/%M/%Y:%h:%n:%j ... Your logfile has [] around the date/time, but your LOGFORMAT doesn't. > S: Unwanted lines: 305025 Unwanted lines are lines that you have excluded. Remember that an if you have a FILEINCLUDE, analog assumes a FILEEXCLUDE *. Aengus +----------------------------------------------------------------------- +- | TO UNSUBSCRIBE from this list: | http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +----------------------------------------------------------------------- +- * * * * * * * * * * * * This communication is from City of York Council. The information contained within, and in any attachment(s), is confidential and legally privileged. It is for the exclusive use of the intended recipient(s). If you are not the intended recipient(s), please note that any form of distribution, copying or use of this communication, or the information within, is strictly prohibited and may be unlawful. Equally, you must not disclose all, or part, of its contents to any other person. If you have received this communication in error, please return it immediately to the sender, then delete and destroy any copies of it. City of York Council disclaims any liability for action taken in reliance on the content of this communication. +------------------------------------------------------------------------ | TO UNSUBSCRIBE from this list: | http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +------------------------------------------------------------------------
