"Laura Bucci" <[EMAIL PROTECTED]> wrote: > #LOGFORMAT (%S %j %j [%d/%M/%Y:%h:%n:%n %j %j] "%j%w%rHTTP%j" %c %b > "%B" "%f")
> This is a line from the raw log: > 211.117.39.40 - - [01/Jan/2002:00:04:23 -0800] "GET /services/services.html > HTTP/1.1" 200 15172 "Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; > Win 9x 4.90)" "http://www.altavista.com/sites/search/web?q=WOMEN+RAPE&pg=q&kl=XX"; > The logs are created by a unix server. I've downloaded them to my > windows machine to interpret them. Before I didn't have the logformat > line, but even with the line above I'm getting the same results, > meaning the report looks fine except for the browser, and search > word/phrase reports, I'm not sure if the referrer report is correct. > > Could it be that there are errors in my logformat as I've written it Your LOGFORMAT as posted starts with a comment indicator (#) - that means that analog ignores that line, and uses it's own internal logic to recognize the line. If you take the comment out, Analog will complain about the :%n:%n that you have in the time section, so if you change the time section of your logformat to [%d/%M/%Y:%h:%n:%j %j] then Analog will read the sample line you include above, and show a single search query of "women rape" and 2 search words of "women" and "rape", and the browser report has a single entry for "Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; Win 9x 4.90)", while the Browser Summary shows and entry for MSIE / MSIE/5. > or do I > need additional LOGFORMAT lines such as LOGFORMAT BROWSER and LOGFORMAT > REFERRER. Would these go above or below LOGFORMAT / APACHELOGFORMAT The standard Combined log is basically the same as the example that you posted, except that it has the referrer before the Browser. It looks as though Analog is trying to parse your Log as a Combined log, and ends up parsing the Referrer string as a Browser string, and can't find any query string in what it things is the Referrer (but is actually the Browser string). It looks as though you were on the right line above, but that you inadvertently commented out your LOGFORMAT line. Aengus +------------------------------------------------------------------------ | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to | http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at | http://www.mail-archive.com/analog-help@lists.isite.net/ | http://lists.isite.net/listgate/analog-help/archives/ | http://www.tallylist.com/archives/index.cfm/mlist.7 +------------------------------------------------------------------------
