Joshua S. Freeman <[EMAIL PROTECTED]> wrote: > Hi analog folks, > > Here is my current logformat string and two example log lines: > > (%S - - [%d/%M/%Y:%h:%n:%j %j] %j %r %j %c %b %f %B %v) > > 24-247-100-8.dhcp.aldl.mi.charter.com - - [30/Dec/2007:00:00:07 > -0500] "(GET /kermit/postal-ca.html HTTP/1.1)" 200 9449 "(ref > http://search.yahoo.com/search;_ylt=A0geu_AQJXdHVYsAap1XNyoA?p=montreal%2C+q > uebec+postal+codes&fr=yfp-t-501&ei=UTF-8)" "(client Mozilla/4.0 > (compatible; MSIE 7.0; Windows NT 5.1; SU 3.005; .NET CLR 1.1.4322; > HbTools 4.8.4; InfoPath.2))" > > c01.ba.accelovation.com - - [30/Dec/2007:00:00:10 -0500] "(GET > /edit_entry.php?area=63&room=67&hour=16&minute=30&year=2007&month=12&day=06 > HTTP/1.0)" 302 2976 "(ref > http://meeting.cc.columbia.edu/day.php?year=2007&month=12&day=06&area=63)" > "(client Mozilla/5.0 (compatible; > heritrix/1.12.0+http://www.accelobot.com))" "vhost > meeting.cc.columbia.edu" >
Your referrer, browser and vhost fields are all preceded by an identifier and delimited by quotes. Your logformat delimits the fields by spaces, and there are lots of spaces in your Browser field, so you get chunks of the browser string in your reports. You need two LOGFORMAT strings to deal with the fact that only some of your entries have a VHost entry: LOGFORMAT (%S - - [%d/%M/%Y:%h:%n:%j %j] %j %r %j %c %b "%j %f" "%j %B") LOGFORMAT (%S - - [%d/%M/%Y:%h:%n:%j %j] %j %r %j %c %b "%j %f" "%j %B" "%j %v") Aengus +------------------------------------------------------------------------ | TO UNSUBSCRIBE from this list: | http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +------------------------------------------------------------------------
