A while back I wrote a script that will allow you to combine two logs
without any temporal inconsistancies. If you are just running analog on
the log, there is no real reason you need to do this. In fact I think
you could just use multiple LOGFILE entries. Analog will give overlap
errors but it will go ahead and generate the reports.
Tristan
#!/usr/local/bin/perl
#combine_log.pl
# Combines two overlapping CLF web logs to STDOUT
# Needs some efficiency improvements
# Tristan Lawrence 9/99
use Time::Local;
$log_one = "/usr/local/www/logs/new.log";
$log_two = "/usr/local/www/logs/99_07.log";
# offset to work with timelocal
%mon2no=("Jan"=>"0","Feb"=>"1","Mar"=>"2","Apr"=>"3","May"=>"4","Jun"=>"5",
"Jul"=>"6","Aug"=>"7","Sep"=>"8","Oct"=>"9","Nov"=>"10","Dec"=>"11");
open(ONE, "< $log_one") or die "couldn't open $log_one: $!";
open(TWO, "< $log_two") or die "couldn't open $log_two: $!";
$one_line = <ONE>;
$two_line = <TWO>;
$one_sec = &sec($one_line);
$two_sec = &sec($two_line);
while ( $one_line and $two_line ) {
if ( $one_sec <= $two_sec ) {
print $one_line;
$one_line = <ONE> and $one_sec = &sec($one_line);
}
else {
print $two_line;
$two_line = <TWO> and $two_sec = &sec($two_line);
}
}
# run out the remaining file
while ( $one_line or $two_line ) {
print $one_line if $one_line = <ONE>;
print $two_line if $two_line = <TWO>;
}
sub sec {
# converts dd/mmm/yyyy hh:mm:ss timestamp into epoch secs
# I guess it doesn't really matter if the boxes weren't synced
my ($line) = @_;
($timestamp) = $line =~ /.* \[([^ ]*).*$/;
($date,$hour,$min,$sec)=split /:/, $timestamp;
($day,$mon,$year) = split/\//, $date;
$mon_no = $mon2no{$mon};
return 0 unless $mon_no;
$yr = $year - 1900;
$epoch = timelocal($sec,$min,$hour,$day,$mon_no,$yr);
return $epoch;
}
"brian.hammons" wrote:
>
> I have four servers that I combine the seperate logs together to create a
> single log and report.
> cat logfile1 >> comb.logfile
> cat logfile2 >> comb.logfile
>
> I've searched the archives and other documentation for an answer to this
> question. Please pardon me if it has been asked previously.
>
> Will Analog, on either Unix or NT, properly handle combining logfiles
> created by clustered IIS web servers.
>
> Any and all insights would be greatly appreciated.
>
> Rich
>
> --
> --------------------------------------------------------------------
> "A point in every direction is the same as no point at all."
> --------------------------------------------------------------------
> Rich Irvine
> Webmaster, Agiliti.com / gofast.net
> email : [EMAIL PROTECTED]
> email : [EMAIL PROTECTED]
> voice : (651) 767-3152
> ------------------------------------------------------------------------
> This is the analog-help mailing list. To unsubscribe from this
> mailing list, send mail to [EMAIL PROTECTED]
> with "unsubscribe" in the main BODY OF THE MESSAGE.
> List archived at http://www.mail-archive.com/analog-help@lists.isite.net/
> ------------------------------------------------------------------------
>
> ------------------------------------------------------------------------
> This is the analog-help mailing list. To unsubscribe from this
> mailing list, send mail to [EMAIL PROTECTED]
> with "unsubscribe" in the main BODY OF THE MESSAGE.
> List archived at http://www.mail-archive.com/analog-help@lists.isite.net/
> ------------------------------------------------------------------------
------------------------------------------------------------------------
This is the analog-help mailing list. To unsubscribe from this
mailing list, send mail to [EMAIL PROTECTED]
with "unsubscribe" in the main BODY OF THE MESSAGE.
List archived at http://www.mail-archive.com/analog-help@lists.isite.net/
------------------------------------------------------------------------
