On Monday, September 24, 2007 8:14 AM [EDT],
Hunter John <[EMAIL PROTECTED]> wrote:
I'm trying to analyze Apache logs with the following format:
APACHELOGFORMAT (%h %l %u %t \"%r\" %>s %b \"%{Referer}i\"
\"%{User-Agent}i\"
\"%{SSL_PROTOCOL}x:%{SSL_CIPHER}x:%{SSL_SESSION_ID}x\" %D %T
\"%{Cookie}i\" %v)
Analog's debug tells me that one item occurs twice in the translated
format of:
LOGFORMAT (%S %j %u [%d/%M/%Y:%h:%n:%j] "%j%w%r%wHTTP%j" %c %b "%f"
"%B" "%j:%j:%j" %D %t "%j" %v)
The only thing that seemed to be duplicated were the %D and %t fields
so I replaced %t with %j and re-ran with the new LOGFORMAT. Analog
now runs but the error file soon starts to fill up and every single
line of the log is marked as corrupt. No matter what I try I don't
seem to be able to read these logs.
Can anyone tell me what I'm doing wrong please?
If you set DEBUG ON, Analog will print a line with an asterisk under the
first element of the logfile entry that it can't match to the LOGFORMAT.
Or you can post 2 or 3 sample lines here.
Aengus
+------------------------------------------------------------------------
| TO UNSUBSCRIBE from this list:
| http://lists.meer.net/mailman/listinfo/analog-help
|
| Analog Documentation: http://analog.cx/docs/Readme.html
| List archives: http://www.analog.cx/docs/mailing.html#listarchives
| Usenet version: news://news.gmane.org/gmane.comp.web.analog.general
+------------------------------------------------------------------------
