> A good way to test might be to log all IP addresses for now In an earlier reply I reported the logformat I used. Just changed %h to %a to see if it would make a difference. (presumably the same when hostname lookup is already off but maybe %a is more straight.) After kill and start the server again, it is still the same. Some more clues: in the following, the first hit from "134" is from the same client of the next couple of hits (134.121.91.116) by comparing the clickstream entries at the same time stamps:
access_log: 134 - - [21/May/1998:17:47:11 -0700] "GET /HXWZ/ HTTP/1.0" 200 7306 198.177.146.150 - - [21/May/1998:17:47:11 -0700] "GET / HTTP/1.0" 200 8404 134.121.91.116 - - [21/May/1998:17:47:11 -0700] "GET /images/hxwz6.gif HTTP/1.0" 200 13764 134.121.91.116 - - [21/May/1998:17:47:11 -0700] "GET /images/no-ch-btt.gif HTTP/1.0" 200 3226 134.121.91.116 - - [21/May/1998:17:47:12 -0700] "GET /images/footer1.gif HTTP/1.0" 200 6736 134.121.91.116 - - [21/May/1998:17:47:12 -0700] "GET /images/cm-line.gif HTTP/1.0" 200 1625 130 - - [21/May/1998:17:47:12 -0700] "GET / HTTP/1.0" 200 8433 clickstream: 134515895798031584 GET /HXWZ/ HTTP/1.0 [21/May/1998:17:47:11 -0700] 19819645895287923988 GET / HTTP/1.0 [21/May/1998:17:47:11 -0700] 134515895798031584 GET /images/hxwz6.gif HTTP/1.0 [21/May/1998:17:47:11 -0700] 134515895798031584 GET /images/no-ch-btt.gif HTTP/1.0 [21/May/1998:17:47:11 -070 0] 134515895798031584 GET /images/footer1.gif HTTP/1.0 [21/May/1998:17:47:12 -0700] 134515895798031584 GET /images/cm-line.gif HTTP/1.0 [21/May/1998:17:47:12 -0700] 130519895798032529 GET / HTTP/1.0 [21/May/1998:17:47:12 -0700] Thanks, Wei Lin
