Michael Summerfield <[EMAIL PROTECTED]> wrote: > > I'm guessing Analog isn't finding the %u variable in my logformat > statement > > This one includes the user, mhurley: > > 2007-12-10 20:40:37 W3SVC1 APOLLO 192.168.32.134 GET > /include/styles/author.css - 80 - 66.250.5.66 HTTP/1.1 > Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+SV1;+.NET+CLR+1.1.432 > 2;+.NET+CLR+2.0.50727;+.NET+CLR+3.0.04506.30) mhurley > http://www.riedthunberg.com/headlines/reload_headlines.aspx > www.riedthunberg.com 200 0 0 445 651 62 > > I've interpreted it as: > > LOGFORMAT (%Y-%m-%d %h:%n:%j %j %S %j %j - %j - %s %j %A %u %r %j %j > %j %j %j %j) That LOGFORMAT doesn't match the log entry. Your LOGFORMAT has 4 fields between the time and the first -, but the log entry has 5.
Changing the LOGFORMAT to LOGFORMAT (%Y-%m-%d %h:%n:%j %j %j %S %j %j - %j - %s %j %A %u %r %j %j %j %j %j %j) generates a User Report for your sample line. But I don't think that LOGFORMAT is correct - the first %S looks like your servers address, rather than the remote address. %s (lowercase) is only used if %S (uppercase) is blank. And I'm pretty sure that that particular entry is a request for /include/styles/author.css , and that http://www.riedthunberg.com/headlines/reload_headlines.aspx is actually the referrer (%f), not the request (%r) I'd try LOGFORMAT (%Y-%m-%d %h:%n:%j %j %j %j %j %r - %j - %S %j %A %u %f %j %c %j) instead (no need for trailing %js). This also gets the status code of the request, so that you can tell failures from successes. > There is a second log format I discovered while trying to figure out > how to get the User Report which I've ignored so far: > > 2007-12-10 13:51:30 W3SVC1 192.168.32.134 GET > /include/images/logo.gif - 80 - 204.179.96.51 > Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+.NET+CLR+1.1.4322) > 200 0 0 > > I can interpret this one as: > > LOGFORMAT (%Y-%m-%d %h:%n:%j %S %j %j - %j - %s %j %j %j) LOGFORMAT (%Y-%m-%d %h:%n:%j %j %j %j %r - %j - %S %A %c %j) > Should I list both formats? If you're using both logfiles, you'll need to list both logformats. Aengus +------------------------------------------------------------------------ | TO UNSUBSCRIBE from this list: | http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +------------------------------------------------------------------------
