jason at summary
Feb 26, 1999, 10:53 PM
Post #4 of 6
(167 views)
Permalink
|
I have some suggested improvements. I don't have enough examples of
FileMaker Pro logs to be sure of anything, but I can improve on your
attempts. Try:
LOGFORMAT (%m/%d/%y %h:%n:%j %a %S %r\n%j/%j/%j %j:%j:%j %j %j\n%j/%j/%j
%j:%j:%j %jElapsed%j)
LOGFORMAT (%m/%d/%y %h:%n:%j %a %S %r\n%j/%j/%j %j:%j:%j %jGot
search%j\n%j/%j/%j %j:%j:%j %j %q\n%j/%j/%j %j:%j:%j %jSending reply%j)
Changes:
In the second format, the request (%r) is still on the first line, it is
the query string (%q) on the third line.
You can have %j match more that just one token. A %j will continue until
it gets to the character immediately following it. So %j) will match
anything to the end of the line. I tried to reduce the amount of literal
matching and let the %j's eat a little more. You want enough literal
matching to be sure of the format but not so much that minor changes or
mistyping ruin everything.
When debugging formats you need to be careful of the case where you don't
match anything. You don't make it clear if all of the lines were corrupt
or if only some of them were and there just wasn't anything in the
report. The formats could be just plain wrong and not matching anything.
Also keep in mind that you may need to duplicate each format for a
DEFAULTLOGFORMAT command in addition to the LOGFORMAT command to support
command line (drag and drop on the Mac) log files.
If every line is corrupt, it may be that we are missing some important
field. I believe Analog requires a status code field be present. Did you
look closely at your Analog error messages? It would say if it was
ignoring these LOGFORMAT lines for some reason. I wonder where we can get
a status code out of this?
Good Luck
Jason
On 2/25/99 4:18 AM Ruth Rinehart (rinehart [at] brb) wrote:
>Back on the Filemaker Pro multi-line log format: Using the following
>LOGFORMAT, Analog processes with no errors except corrupt lines, with no
>output in the report. These logformat lines are long, because FMP produces
>either 3 or 4 lines of log to each hit.
>
>Is there too much %j here for Analog to handle?
>
>Another possibility: I am naming the database search argument as a file,
>because it contains all the pertinent data that we want to capture. Does
>Analog have a hard time recognizing this long query string as a file? I
>thought about using %q for query, but there is no "?" in the string.
>
>Any help on this matter would benefit the Filemaker Pro Web Development
>community greatly!
>
>LOGFORMAT (%m/%d/%y %h:%n:%j %a %S %r\n%j/%j/%j %j:%j:%j %j %j\n%j/%j/%j
>%j:%j:%j %j Sending reply. %w Elapsed time: %j millisec.)
>LOGFORMAT (%m/%d/%y %h:%n:%j %a %S %j\n%j/%j/%j %j:%j:%j %j Got search
>argument.\n%j/%j/%j %j:%j:%j %j %r\n%j/%j/%j %j:%j:%j %j Sending reply. %w
>Elapsed time: %j millisec.)
>
>----------
>>From: Jason Linhart <jason [at] summary>
>
>>On 2/17/99 10:00 AM Ruth Rinehart (rinehart [at] brb) wrote:
>>
>>>Two sample hits from the FMP log look like this:
>>>
>>>2/1/99 11:01:48 AM 204.65.5.15 /schools/searchschool.htm
>>>2/1/99 11:01:48 AM /schools/searchschool.htm
>>>2/1/99 11:01:48 AM Sending reply. Elapsed time: 48 millisec.
>>>
>>>2/1/99 11:01:59 AM 204.65.5.15 /schools/FMPro
>>>2/1/99 11:01:59 AM Got search argument.
>>>2/1/99 11:01:59 AM
>>>-db=MainSchool.fp3&-lay=DebtRatios&-error=errors.htm&-op=contains&ISD_Name
>=a
>>>bilene&-op=equals&County=&-max=10&-format=formats.htm&-find=Start+Search
>>>2/1/99 11:01:59 AM Sending reply. Elapsed time: 77 millisec.
>>>
>>>Each hit starts out with the line including the host IP address, and ends
>>>with the line including Sending Reply and Elapsed time.
>>>
>>>The log formats I've tried using include:
>>>LOGFORMAT (%m/%d/%y %h:%n:%j %a %S %r)
>>>LOGFORMAT (%m/%d/%y %h:%n:%j %a %r)
>>>LOGFORMAT (%m/%d/%y %h:%n:%j %a %j %j %j)
>>>LOGFORMAT (%m/%d/%y %h:%n:%j %a %r)
>>>LOGFORMAT (%m/%d/%y %h:%n:%j %a )
>>>LOGFORMAT (%m/%d/%y %h:%n:%j %a %j %j %w %j %j %j %j)
>>
>>I can give you a hint but not the complete solution. You need to use \n's
>>in the LOGFORMAT command so that the entire multi-line entity is read by
>>a single LOGFORMAT. They might go something like:
>>
>>LOGFORMAT (%m/%d/%y %h:%n:%j %a %S %r\n%j/%j/%j %j:%j:%j %j %r\n%jElapsed
>>%j)
>>
>>You will need a line like that for every possible configuration of lines
>>in the log file. Putting the "Elapsed " in makes sure it only is used if
>>it can match the end of transaction exactly, too many %j's and you can
>>get out of sync.
-----------------
Jason [at] Summary
-----------------
Dr. Seuss books . . . can be read and enjoyed on several levels. For
example, 'One Fish Two Fish, Red Fish Blue Fish' can be deconstructed
as a searing indictment of the narrow-minded binary counting system.
-- Peter van der Linden, Expert C Programming, Deep C Secrets
--------------------------------------------------------------------
This is the analog-help mailing list. To unsubscribe from this
mailing list, send mail to analog-help-request [at] lists
with "unsubscribe analog-help" in the main BODY OF THE MESSAGE.
--------------------------------------------------------------------
|
