As always, this has been a BIG help. So, let me try to put my foot in
it again. (yes, I'm a glutton for punishment) If I can manage to at least
not say something false, I'll feel redeemed.
1. Analog essentially maintains a list of logfiles it expects to see,
and for each of these it keeps a list of formats it might use. This
allows multiple files/formats to be processed with a minimum of
(relatively slow) string processing to determine the format.
2. When you add a logfile its format list will contain the "current"
list of formats- which is usally ALL previous declarations of
LOGFORMAT, plus the default. (I assume there is a way to remove
formats from the current list- but it escapes me right now)
3. If analog encounters a logfile not in its list, it uses the default
format. If it encounters a logfile that it doesn't think is in the
"right" format the file is skipped.
4. If you try to add a logformat without a logfile it complains
(LOGFORMAT specified without LOGFILE)
5. The default format happens to be "examine and guess" - but it can be
overridden with DEFAULTLOGFORMAT. (maybe?)
I think that the description of how logfile and logformat works in the
docs probably could use some improvement- but the info *is* there. Sorry
about being too dense to get it right away. Now it seems a lot simpler
than I'm trying to make it. (a recurring theme I'm afraid)
-=Jim=-
P.S. Just a note about analog's speed- I ran 22000+ reports using
analog on compressed log files totallying about 400MB (uncompressed
they'd be around 3 to 5 GB) and the entire process took less than 5
minutes w/o numlookups. (we're still working on a good way to speed
up reverse DNS for our situation)
------------------------------------------------------------------------
This is the analog-help mailing list. To unsubscribe from this
mailing list, send mail to [EMAIL PROTECTED]
with "unsubscribe analog-help" in the main BODY OF THE MESSAGE.
List archived at http://www.mail-archive.com/analog-help@lists.isite.net/
------------------------------------------------------------------------
