That's what I was trying to get at - did I have the referrer / file / request string the right way around in the pattern ?
I'll change the filters around based on these points. -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Stephen Turner Sent: 18 April 2007 12:53 To: Support for analog web log analyzer Subject: Re: [analog-help] file format issue - parsing ? On 18/04/07, Brereton, Stephen <[EMAIL PROTECTED]> wrote: > > FILEINCLUDE /swr/swr_search.asp > FILEINCLUDE /mhp/* > FILEINCLUDE /phonebook/* > FILEINCLUDE /docsinf/* > FILEINCLUDE /news/* > FILEINCLUDE /pages/main.asp > FILEINCLUDE /webboard/*.dll?* > FILEINCLUDE /~* > FILEINCLUDE /webboard/* > > FILEINCLUDE /scripts/*.dll?* > FILEINCLUDE /object/*.asp?* > > 125.22.4.223 x.x.uk rfiexja [30/Apr/2002:14:57:08 ] "GET /empty > HTTP/1.0" 200 1101 "http://x.x.x.uk:8080/~exchange"; "Mozilla/4.0 > (compatible; MSIE 5.5; Windows NT 4.0)" > > Shows a good example - '/~exchange' should be picked up by the '~*' > filter? > /~exchange is the referrer, not the requested file. The requested file is /empty, which doesn't match any of the FILEINCLUDEs, so this is an "unwanted" line. -- Stephen Turner +----------------------------------------------------------------------- +- | TO UNSUBSCRIBE from this list: | http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +----------------------------------------------------------------------- +- * * * * * * * * * * * * This communication is from City of York Council. The information contained within, and in any attachment(s), is confidential and legally privileged. It is for the exclusive use of the intended recipient(s). If you are not the intended recipient(s), please note that any form of distribution, copying or use of this communication, or the information within, is strictly prohibited and may be unlawful. Equally, you must not disclose all, or part, of its contents to any other person. If you have received this communication in error, please return it immediately to the sender, then delete and destroy any copies of it. City of York Council disclaims any liability for action taken in reliance on the content of this communication. +------------------------------------------------------------------------ | TO UNSUBSCRIBE from this list: | http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +------------------------------------------------------------------------
