Re: [analog-help] Separating Virtual Server logs.

2004-08-04 Thread analog-help 
On Wednesday, August 04, 2004 2:50 AM [GMT],
Raji Arulambalam <[EMAIL PROTECTED]> wrote:

> If I was to search for  virtual host   the log file file that also contains other hosts, what include
> commands would I enter. I tried VHOSTINCLUDE
> http://web.ebop.int:8030/ but got nothing.

That's because Analog isn't recognizing either of those strings as
VHosts. If you enable the VHost reports, as Duke suggested, you'd see
what strings Analog will recognize in the VHOSTINCLUDE command.

But I think you have a more serious problem before that will work. The
Browser string (c-agent) isn't delineated in any way, so that there's no
way for Analog to parse the rest of the line, so it isn't going to get
as far as recognizing VHOSTS in the first place.

Aengus

+
|  TO UNSUBSCRIBE from this list:
|http://lists.isite.net/listgate/analog-help/unsubscribe.html
|
|  Digest version: http://lists.isite.net/listgate/analog-help-digest/
|  Usenet version: news://news.gmane.org/gmane.comp.web.analog.general
|  List archives:  http://www.analog.cx/docs/mailing.html#listarchives
+

RE: [analog-help] Separating Virtual Server logs.

2004-08-03 Thread analog-help 
Thanks.

If I was to search for  virtual host  <http://web.ebop.in:8030/ in the log file file 
that also contains other hosts, what include commands would I enter. I tried 
VHOSTINCLUDE http://web.ebop.int:8030/ but got nothing.

 
RajiA
--




-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] Behalf Of Duke Hillard
Sent: Wednesday, August 04, 2004 10:27 AM
To: [EMAIL PROTECTED]
Subject: Re: [analog-help] Separating Virtual Server logs.


By default, the Virtual Host Report, Virtual Host Redirection Report,
and Virtual Host Failure Report are off.  To turn each one on, use
VHOST ON
REDIRVHOST ON
FAILVHOST ON
See "http://www.analog.cx/docs/output.html#replist"; for more info.

Other useful commands for analyzing virtual hosts are
VHOSTINCLUDE and VHOSTEXCLUDE
VHOSTREPINCLUDE and VHOSTREPEXCLUDE
REDIRVHOSTREPINCLUDE and REDIRVHOSTREPEXCLUDE
FAILVHOSTREPINCLUDE and FAILVHOSTREPEXCLUDE
See "http://www.analog.cx/docs/include.html"; for more info.

HTH,

-- Duke


Raji Arulambalam wrote:

>
> 210.55.30.52 anonymous Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1;
> .NET CLR 1.1.4322) N 2004-07-30 00:02:04 W3ReverseProxy CELERIS -
> www.easternboprecovery.org.nz 172.16.0.9 8030 - 333 3866 http TCP GET
> http://web.ebop.int:8030/ text/html Inet 200 0x4080 EBOPRecovery -
Email disclaimer: This email and any attachments are confidential. If you are not the 
intended recipient, do not copy, disclose or use the contents in any way. If you 
receive this message in error, please let us know by return email and then destroy the 
message. Environment Bay of Plenty is not responsible for any changes made to this 
message and/or any attachments after sending.
**
This e-mail has been checked for viruses and no viruses were detected.
+
|  TO UNSUBSCRIBE from this list:
|http://lists.isite.net/listgate/analog-help/unsubscribe.html
|
|  Digest version: http://lists.isite.net/listgate/analog-help-digest/
|  Usenet version: news://news.gmane.org/gmane.comp.web.analog.general
|  List archives:  http://www.analog.cx/docs/mailing.html#listarchives
+

Re: [analog-help] Separating Virtual Server logs.

2004-08-03 Thread analog-help 
By default, the Virtual Host Report, Virtual Host Redirection Report,
and Virtual Host Failure Report are off.  To turn each one on, use
VHOST ON
REDIRVHOST ON
FAILVHOST ON
See "http://www.analog.cx/docs/output.html#replist"; for more info.
Other useful commands for analyzing virtual hosts are
VHOSTINCLUDE and VHOSTEXCLUDE
VHOSTREPINCLUDE and VHOSTREPEXCLUDE
REDIRVHOSTREPINCLUDE and REDIRVHOSTREPEXCLUDE
FAILVHOSTREPINCLUDE and FAILVHOSTREPEXCLUDE
See "http://www.analog.cx/docs/include.html"; for more info.
HTH,
-- Duke
Raji Arulambalam wrote:
Hi
I have multiple Virtual Servers logging to the same log file. How do I
separate them out and report on each. I have tried 'REFINCLUDE
http://web.ebop.in:8030/*'  and also 
'FILEINCLUDE http://web.ebop.in:8030/*' .
But I do not get any pages being reported.

I am using Microsofts ISA server logs
Example below..
#Software: Microsoft(R) Internet Security and Acceleration Server 2000
#Version: 1.0
#Date: 2004-07-30 00:00:13
#Fields: c-ip cs-username c-agent sc-authenticated date time s-svcname
s-computername cs-referred r-host r-ip r-port time-taken cs-bytes 
sc-bytes
cs-protocol cs-transport s-operation cs-uri cs-mime-type s-object-source
sc-status s-cache-info rule#1 rule#2
172.16.0.11 celeris\marshal Mozilla/4.0 (compatible; MSIE 6.0; Windows NT
5.0; .NET CLR 1.0.3705) Y 2004-07-30 00:00:13 w3proxy CELERIS -
www.oldfriends.co.nz 202.21.128.3 80 296 732 25974 http TCP GET
http://www.oldfriends.co.nz/oldfriends/member_profile.asp?oldfriends_member_id=112852 

text/html Inet 200 0x42020001 Web Marshal Proxy Web Marshal Proxy
203.99.66.6 anonymous Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 
5.0) N
2004-07-30 00:02:02 W3ReverseProxy CELERIS - www.envbop.govt.nz 
172.16.0.9
8008 - 414 163 http TCP GET
http://web.ebop.int:8008/images/Pollution-Busters800x600.jpg - Inet 304
0x40001002 EnvBOP -
203.99.66.6 anonymous Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 
5.0) N
2004-07-30 00:02:02 W3ReverseProxy CELERIS - www.envbop.govt.nz 
172.16.0.9
8008 - 400 162 http TCP GET
http://web.ebop.int:8008/menu/printer_plain.gif - Inet 304 0x40001002
EnvBOP -
203.99.66.6 anonymous Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 
5.0) N
2004-07-30 00:02:03 W3ReverseProxy CELERIS - www.envbop.govt.nz 
172.16.0.9
8008 16 394 164 http TCP GET http://web.ebop.int:8008/menu/alpha.gif - 
Inet
304 0x40001002 EnvBOP -
203.99.66.6 anonymous Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 
5.0) N
2004-07-30 00:02:03 W3ReverseProxy CELERIS - www.envbop.govt.nz 
172.16.0.9
8008 - 394 164 http TCP GET http://web.ebop.int:8008/images/Fav.gif - 
Inet
304 0x40001002 EnvBOP -
203.99.66.6 anonymous Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 
5.0) N
2004-07-30 00:02:03 W3ReverseProxy CELERIS - www.envbop.govt.nz 
172.16.0.9
8008 - 394 163 http TCP GET http://web.ebop.int:8008/images/shim.gif - 
Inet
304 0x40001002 EnvBOP -
203.99.66.6 anonymous Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 
5.0) N
2004-07-30 00:02:03 W3ReverseProxy CELERIS - www.envbop.govt.nz 
172.16.0.9
8008 - 399 164 http TCP GET 
http://web.ebop.int:8008/images/tukutuku.gif -
Inet 304 0x40001002 EnvBOP -
210.55.30.52 anonymous Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1;
.NET CLR 1.1.4322) N 2004-07-30 00:02:04 W3ReverseProxy CELERIS -
www.easternboprecovery.org.nz 172.16.0.9 8030 - 333 3866 http TCP GET
http://web.ebop.int:8030/ text/html Inet 200 0x4080 EBOPRecovery -
210.55.30.52 anonymous Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1;
.NET CLR 1.1.4322) N 2004-07-30 00:02:05 W3ReverseProxy CELERIS -
www.easternboprecovery.org.nz 172.16.0.9 8030 - 266 13623 http TCP GET
http://web.ebop.int:8030/images/recovery.jpg image/jpeg Inet 200 
0x4080
EBOPRecovery -
210.55.30.52 anonymous Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1;
.NET CLR 1.1.4322) N 2004-07-30 00:02:05 W3ReverseProxy CELERIS -
www.easternboprecovery.org.nz 172.16.0.9 8030 16 261 6500 http TCP GET
http://web.ebop.int:8030/Images/wdc.gif image/gif Inet 200 0x4080
EBOPRecovery -
210.55.30.52 anonymous Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1;
.NET CLR 1.1.4322) N 2004-07-30 00:02:05 W3ReverseProxy CELERIS -
www.easternboprecovery.org.nz 172.16.0.9 8030 16 264 7116 http TCP GET
http://web.ebop.int:8030/Images/envbop.gif image/gif Inet 200 0x4080
EBOPRecovery -
210.55.30.52 anonymous Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1;
.NET CLR 1.1.4322) N 2004-07-30 00:02:05 W3ReverseProxy CELERIS -
www.easternboprecovery.org.nz 172.16.0.9 8030 16 261 5068 http TCP GET
http://web.ebop.int:8030/Images/odc.gif image/gif Inet 200 0x4080
EBOPRecovery -
1
203.97.51.49 anonymous Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1;
.NET CLR 1.1.4322) N 2004-07-30 00:02:33 W3ReverseProxy CELERIS -
www.odc.govt.nz 172.16.0.9 8006 - 356 163 http TCP GET
http://web.ebop.int:8006/images/v5_news.jpg - Inet 304 0x40001002 ODC -
203.97.51.49 anonymous Mozilla/4.0 (compatible; MSIE 6.0;