Re: [analog-help] Strange Logfile format

[analog-help]

System Administrator wrote:
I've added three lines from the start of my dubious logfile;
65.54.164.40 - - [08/jul/2004:03:07:39 -0600] "get /stanns/index.html
http/1.0" 404 211 404 211 - - 196 168 295 208 0 "" "msnbot/0.11
(+http://search.msn.com/msnbot.htm)"
66.194.6.83 - - [08/jul/2004:05:58:28 -0600] "get / http/1.1" 200 3549 > - -
- - 108 272 - - 0 "" "mozilla/4.0 (compatible; msie 6.0; windows nt 5.1;
q312467)" 
24.14.151.202 - - [08/jul/2004:13:29:04 -0600] "get / http/1.1" 200 3549 200
3549 - - 437 246 551 272 0 "" "mozilla/4.0  (compatible; msie 6.0; windows
nt 5.1; .net clr 1.0.3705; .net clr 1.1.4322; alexa toolbar)"
 

Looks like the server adds a lot of junk between the common log format 
fields and the browser and referrer information. Something like

LOGFORMAT (%S %j %j [%d/%M/%Y:%h:%n:%j] "%j%w%r%wHTTP%j" %c %b %j %j %j 
%j %j %j %j %j %j %j "%u" "%f" "%B")
LOGFORMAT (%S %j %j [%d/%M/%Y:%h:%n:%j] "%j%w%r" %c %b %j %j %j %j %j %j 
%j %j %j %j "%u" "%f" "%B")
LOGFORMAT (%S %j %j [%d/%M/%Y:%h:%n:%j] "%r" %c %b %j %j %j %j %j %j %j 
%j %j %j "%u" "%f" "%B")
LOGFORMAT (%S %j %u [%d/%M/%Y:%h:%n:%j] "%j%w%r%wHTTP%j" %c %b %j %j %j 
%j %j %j %j %j %j %j "%f" "%B")
LOGFORMAT (%S %j %u [%d/%M/%Y:%h:%n:%j] "%j%w%r" %c %b %j %j %j %j %j %j 
%j %j %j %j "%f" "%B")
LOGFORMAT (%S %j %u [%d/%M/%Y:%h:%n:%j] "%r" %c %b %j %j %j %j %j %j %j 
%j %j %j "%f" "%B")
LOGFORMAT (%S %j %u [%d/%M/%Y:%h:%n:%j] "%j%w%r%wHTTP%j" %c %b %j %j %j 
%j %j %j %j %j %j %j)
LOGFORMAT (%S %j %u [%d/%M/%Y:%h:%n:%j] "%j%w%r" %c %b %j %j %j %j %j %j 
%j %j %j %j)
LOGFORMAT (%S %j %u [%d/%M/%Y:%h:%n:%j] "%r" %c %b %j %j %j %j %j %j %j 
%j %j %j)

should work (basically one %j for each field you are NOT interested in). 
The sample gives no clue what the third field from the right might be, 
if this is a cookie field then "%u" is a good choice, otherwise use "%j" 
and change the leading %S %j %j to %S %j %u.

--
Klaus Johannes Rusch
[EMAIL PROTECTED]
http://www.atmedia.net/KlausRusch/
+------------------------------------------------------------------------
|  TO UNSUBSCRIBE from this list:
|    http://lists.isite.net/listgate/analog-help/unsubscribe.html
|
|  Digest version: http://lists.isite.net/listgate/analog-help-digest/
|  Usenet version: news://news.gmane.org/gmane.comp.web.analog.general
|  List archives:  http://www.analog.cx/docs/mailing.html#listarchives
+------------------------------------------------------------------------