I'm sorry corrupt line errors... Here is a sample from the log files with a field name translation from the ISA log book.
c-ip (Client IP Address) 10.X.X.X cs-username (Client user account name) anonymous c-agent (Client Agent) Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; Win 9x 4.90) date 2002-01-12 time 00:00:00 s-computername (Computer Name) FIREWALL02 cs-referred (referring Server Name) - r-host (Destination host name) www.streamingfaith.com r-ip (Destination IP) 10.X.X.X r-port (Destination port) 80 time-taken (Processing time) - cs-bytes (Number of bytes sent) sc-bytes (Number of bytes received) 733 cs-protocol (protocol name) http s-operation Operation) GET cs-uri (Object name) http://10.X.X.X/images/radiotab.gif s-object-source (Object source) Inet sc-status (Result code) 304 I have set up the string based as you have on the variables being just as you are showing them. Why I keep getting the corrupt lines is beyond me. Is there any way to diagnose the string one variable at a time? Thank you, Rodney > "Rodney Knott" <[EMAIL PROTECTED]> wrote: > >> Thank you all for your help in this matter. I really appreciate >> it. I have tried the strings that have been suggested and I am >> still getting the corrupt file errors. I am not sure where to >> go from here... > > Corrupt file errors or corrupt line errors? > > Here's the sample line you posted, parsed on a "best guess" basis (you > haven't told us what each entry is supposed to be). > > %s 10.X.X.X > %u anonymous > %B Mozilla/4.0 (Compatible;MSIE 6.0; Windows NT 5.0;Q312461) > %Y-%m-%d 2002-01-12 > %h:%n:%j 00:00:35 > %j FIREWALL02 > %j - > %v www.streamingfaith.com > %j 10.X.X.X > %j 80 > %b 733 > %T 140 > %j http > %j Get > %r http://10.X.X.X/images/radiotab.gif > %j inet > %c 304 > > Each field is seperated by a tab (\t). The sample line you provided is > parsed by the the LOGFORMATs suggested here. If you're getting corrupt > line errors on other lines, with a different format, we can't suggest > much if you don't provide an example. > > Aengus > > +------------------------------------------------------------------------ > | This is the analog-help mailing list. To unsubscribe from this > | mailing list, go to > | http://lists.isite.net/listgate/analog-help/unsubscribe.html > | > | List archives are available at > | http://www.mail-archive.com/analog-help@lists.isite.net/ > | http://lists.isite.net/listgate/analog-help/archives/ > | http://www.tallylist.com/archives/index.cfm/mlist.7 > +------------------------------------------------------------------------ +------------------------------------------------------------------------ | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to | http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at | http://www.mail-archive.com/analog-help@lists.isite.net/ | http://lists.isite.net/listgate/analog-help/archives/ | http://www.tallylist.com/archives/index.cfm/mlist.7 +------------------------------------------------------------------------
