On Thursday, September 06, 2007 8:36 PM [EDT],
Raj Hungund <[EMAIL PROTECTED]> wrote:
Hey guys...I can't get even the most simplest of log analysis working
for Apache/Analog
Here's my logformat:
LogFormat "%h %v %u %t \"%r\" %>s %b \"%{Referer}i\"
\"%{User-Agent}i\" %{EOL_GEO_COUNTRY}n %{EOL_GEO_REGION}n
%{EOLUSERID}n" combined
75.32.62.215 forums.####.com> - [04/Sep/2007:00:00:39 -0700] "GET
/style/style.jsp HTTP/1.1" 200 49170
"http://forums.####.com/thread.jspa?messageID=12791910�";
"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; YPC 3.0.3)"
US TX CTL4D9B11078F08418A7ADF39A5524ACB46
75.32.62.215 forums.####.com> - [04/Sep/2007:00:00:42 -0700] "GET
/recent-history.jspa?messageID=12791910 HTTP/1.1" 200 1763
"http://forums.####.com/thread.jspa?messageID=12791910�";
"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; YPC 3.0.3)"
- - -
75.32.62.215 forums.####.com> - [04/Sep/2007:00:00:42 -0700] "GET
/resources/scripts/prototype/prototype.js HTTP/1.1" 200 14503
"http://forums.####.com/recent-history.jspa?messageID=12791910";
"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; YPC 3.0.3)"
- - -
I've tried to cut it down to just:
75.32.62.215
APACHELOGFORMAT (%s)
Is %s a valid marker in a httpd.conf LogFormat command? Shouldn't it be %h
in "apache"?
When I try:
75.32.62.215 forums.####.com
APACHELOGFORMAT (%h %v)
It kind of works.
Unless the logformat in your httpd.conf works "out of the box" you're better
off ignoring the APACHELOGFORMAT command, and just build an analog LOGFORMAT
from scratch.
LOGFORMAT (%s %v> %j [%d/%M/%Y:%h:%n:%j] "%j %r %j" %c %b "%f" "%B" %j %j
%u)
matches your sample logfile lines, and treats the last field (%{EOLUSERID}n)
as the UserID field - the Geo fields are ignored.
Aengus
+------------------------------------------------------------------------
| TO UNSUBSCRIBE from this list:
| http://lists.meer.net/mailman/listinfo/analog-help
|
| Analog Documentation: http://analog.cx/docs/Readme.html
| List archives: http://www.analog.cx/docs/mailing.html#listarchives
| Usenet version: news://news.gmane.org/gmane.comp.web.analog.general
+------------------------------------------------------------------------
