I have been using Analog for years on our Apache servers and now have to deal with Microsoft log files for IIS. I have tried numerous logformat syntax (including some of the of those built in to analog) and have not gotten it to parse correctly. Below is the logformat command and some lines from one of the log files. Looking through the web archives and the readme it appears IIS is not as straightforward as Apache. Any guidance here is greatly appreciated. LOGFORMAT (%Y-%m-%d %h:%n%j %S %j %r %j %c %A %j %u) Sampling from log file #Software: Microsoft Internet Information Server 4.0 #Version: 1.0 #Date: 2001-08-05 00:06:19 #Fields: date time c-ip cs-method cs-uri-stem cs-uri-query sc-status cs(User-Agent) cs(Referer) 2001-08-05 00:25:07 129.105.37.66 GET /Assets/er_footer_01.gif - 304 Mozilla/4.7+(Macintosh;+I;+PPC) http://er.library.northwestern.edu/brief.asp?st=quick&bool=AND&quicksearch=condensed+matter&types=All&tl= 2001-08-05 00:25:07 129.105.37.66 GET /Assets/er_return.gif - 200 Mozilla/4.7+(Macintosh;+I;+PPC) http://er.library.northwestern.edu/brief.asp?st=quick&bool=AND&quicksearch=condensed+matter&types=All&tl= 2001-08-05 00:25:09 129.105.37.66 GET /Assets/d-form.gif - 304 Mozilla/4.7+(Macintosh;+I;+PPC) http://er.library.northwestern.edu/brief.asp?st=quick&bool=AND&quicksearch=condensed+matter&types=All&tl= 2001-08-05 00:27:35 129.105.16.68 GET /brief.asp st=quick&bool=AND&quicksearch=africa&search=Search&types=All&tl= 200 Mozilla/5.0+(Windows+98;+U)+Opera+5.11++[en] http://er.library.northwestern.edu/default.asp 2001-08-05 00:27:36 129.105.16.68 GET /css/er_nulweb-0.css - 304 Mozilla/5.0+(Windows+98;+U)+Opera+5.11++[en] http://er.library.northwestern.edu/brief.asp?st=quick&bool=AND&quicksearch=africa&search=Search&types=All&tl= 2001-08-05 00:27:36 129.105.16.68 GET /Assets/er_banner.gif - 304 Mozilla/5.0+(Windows+98;+U)+Opera+5.11++[en] http://er.library.northwestern.edu/brief.asp?st=quick&bool=AND&quicksearch=africa&search=Search&types=All&tl= 2001-08-05 00:27:36 129.105.16.68 GET /Assets/er_bullet.gif - 304 Mozilla/5.0+(Windows+98;+U)+Opera+5.11++[en] http://er.library.northwestern.edu/brief.asp?st=quick&bool=AND&quicksearch=africa&search=Search&types=All&tl= +------------------------------------------------------------------------ | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to | http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at | http://www.mail-archive.com/analog-help@lists.isite.net/ | http://lists.isite.net/listgate/analog-help/archives/ | http://www.tallylist.com/archives/index.cfm/mlist.7 +------------------------------------------------------------------------
