On Tuesday, August 08, 2006 3:24 PM [EDT],
Jeff Wilkinson <[EMAIL PROTECTED]> wrote:
Hello fellow analogers,
I'm an experienced analog user and I've been through
the help files, but perhaps one of you has a suggestion
here:
I have a server that is periodically hanging on .ASP
files, still serving .htm, etc, but ASP execution
hangs. I've been trying to use analog to find out
more about the problem since it's not clear from
direct looks at the logs what is causing the problem.
Anyway, one lead I was following was the processing
time report. With the idea that the hung files would
show up as long processing times (if they are even
logged, which they might not be), I was trying to get
analog to give me more detail than the summary it
gives by default for the processing time report.
Is there any way to add a column for the filename
to that report?
No. That's one of the FAQ 128 situations
http://analog.cx/docs/faq.html#faq128
Can I find out which files each referrer pointed to?
or Can I find out which files each host has read?
or Can I find out which hosts have read each file?
or Can I find out the number of hosts visiting on each day?
or lots of similar questions.
There are lots of questions like this. They all want analog to
cross-reference two sorts of item (e.g. files and referrers in the first
example above, or hosts and dates in the last).
The solution is to use the *INCLUDE commands. For example, to find out
which files a particular referrer pointed to, restrict the analysis to
just the referrer you're interested in with the REFINCLUDE command. The
Request Report will then just list the files reached from that referrer.
Similarly, if you're interested in a particular time period, you can
focus on just that time by using the FROM and TO commands.
You do have to run analog once for each report generated. So for the
example of referrers, you would have to run it once for each referrer
you're interested in. Of course, it would be useful to be able to
cross-reference all the files and referrers at once. But it is
fundamental to analog's speed and minimal memory requirement that it
only records statistics for each type of item individually, and doesn't
record enough information to cross-reference them afterwards.
Unfortunately, Analog does not have a PROCTIMEINCLUDE command to only
include log entries that took longer than a specified time. So you'll have
to extract log entries with long processing times to do the kind of analysis
you want.
The PROCTIMECOLS doesn't seem to have an arg for
the filename. Presumably the only reports that
show individual files do it without being told
to... and summary reports don't do it optionally,
right?
I suspect this is a case for grep or hand-looking
through the logfiles (ug), but thought it might be
worth a check first.
On Unix, I'm sure someone could give you a grep command that would do it
quickly. You can do it fairly easily in an Windows command prompt too, but
it's a little bit messy.
If the processing time field in your logfile is (for example) the 12th field
in the log, you can extract all logfile entries where the processing time is
greater than 5 seconds (which I think is recorded as 5000 milliseconds in
IIS) with this command (all on a single line):
FOR /F "tokens=1,2,3,4,5,6,7,8,9,10,11,12*" %a in (ABC.log) do
if %l GTR 5000 @echo %a %b %c %d %e %f %g %h %i %j %k %l %m >> LONG.log
If it's the 8th field, then you can trim back the list of letters and use
"if %h GTR" etc. The * at the end of the list of tokens catches the rest of
the line after the field you want to test. And you should probably get the
log headers (the lines starting with #) into LONG.log first.
It's not lightning fast, but I can crunch about a quarter of a million log
entries per minute with that command, so it may be good enough, depending on
how big your logfiles are.
Aengus
+------------------------------------------------------------------------
| TO UNSUBSCRIBE from this list:
| http://lists.meer.net/mailman/listinfo/analog-help
|
| Analog Documentation: http://analog.cx/docs/Readme.html
| List archives: http://www.analog.cx/docs/mailing.html#listarchives
| Usenet version: news://news.gmane.org/gmane.comp.web.analog.general
+------------------------------------------------------------------------
