analog07 at eircom
Dec 1, 2008, 9:48 AM
Views: 406
Permalink
|
|
Re: Need help to retrieve (and correct) all reports fromthis log (Maybe I need the LOGFORMAT)
|
|
Leung, Michael <Michael.Leung[at]networksolutions.com> wrote:
> Dear Analog experts,
>
> The following is an example of the log along with the description:
>
> format=%Ses->client.ip% - %Req->vars.auth-user% [%SYSDATE%]
> "%Req->reqpb.clf-request%" %Req->srvhdrs.clf-status%
> %Req->srvhdrs.content-length% "%Req->headers.referer%"
> "%Req->headers.user-agent%" "%Req->headers.cookie.vrsnsf%"
> "%Req->headers.cookie.JSESSIONID%" "%Req->headers.cookie.landing%"
>
> 205.178.191.170 - - [23/Nov/2008:00:01:01 -0500] "GET
> /manage-it/hosting-overview.jsp HTTP/1.1" 200 55065
> "https://www.networksolutions.com/manage-it/private-registration-splash.
> jsp" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.18)
> Gecko/20081029 Firefox/2.0.0.18" "4b31b171ac7c472da07cff3748a69"
> "c7b881bcf1fcfffffffffe5edf3cd514469c" "-"
>
>
> If I don't specify a LOGFORMAT, it won't complaint, but some of the
> reports don't seem to giving any meaning data. For example, Domain
> report doesn't seem right.
What didn't look right? Analog won't convert IP addresses into Hostnames automatically, so the Domain Report will be based purely on IP numbers, unless you set up DNS lookups. The reports also have certain "floors", and they don't show information that falls below those "floors", so for a report on a small logfile, you might not see entries for addresses that you expect to see.
> Based on what I read, I tried to use the following LOGFORMAT
> statement, but it complaints something wrong about it.
>
> LOGFORMAT %s - %u [%d/%M/%Y:%h:%n:%j %j] "%j %r %j" %c %b "%f" "%A"
> "%j" "%j" "-"
Almost right. The Logformat string has to be delimited (usually with () ) and the Browser string is usually indicated with %B, but %A seems to work too.
LOGFORMAT (%s - %u [%d/%M/%Y:%h:%n:%j %j] "%j %r %j" %c %b "%f" "%B" "%j" "%j" "-")
> Can someone give me some suggestion? First, what wrong with my
> LOGFORMAT statement? Why some of the reports didn't give meaningful
> information?
Can you describe the problem that you are having with the reports in greater detail?
Aengus
+------------------------------------------------------------------------
| TO UNSUBSCRIBE from this list:
| http://lists.meer.net/mailman/listinfo/analog-help
|
| Analog Documentation: http://analog.cx/docs/Readme.html
| List archives: http://www.analog.cx/docs/mailing.html#listarchives
| Usenet version: news://news.gmane.org/gmane.comp.web.analog.general
+------------------------------------------------------------------------
|
Re: Need help to retrieve (and correct) all reports fromthis log (Maybe I need the LOGFORMAT)
