Ulf Hofemeier <[EMAIL PROTECTED]> wrote: > I inherited the ancient analog.cfg configuration file and the scripts > that trigger analog every month so my answer is that the > DEFAULTLOGFORMAT lines are supposed to cover every Apache access_log > version there was going back to 2003. As I learned from you that > DEFAULTLOGFORMAT is what analog uses for log files that are handed > over as a parameter on the command line they should work fine. Analog > did run without reporting corrupt log file lines until I changed the > Apache logformat output to something else at least.
I just checked the documentation, and the correct directive is APACHEDEFAULTLOGFORMAT, rather than DEFAULTAPACHELOGFORMAT. APACHELOGFORMAT is meant to be a convenience for those who have Apache configured with custom logformats - instead of translating the Apache configuration into Analog syntax, Analog will do it for you (most of the time - some complex Apache statements won't translate). It's probably worth taking a few minutes to look at the LOGFORMAT documentation to see how the LOGFORMAT is created - it's a fairly straightforward substitution of letter codes for fields (%S for IP address, %b for bytes, %B for Browser, %c for status code, etc), so 1.2.3.4 - "-" [17/Sep/2008:13:12:52 -0600] "GET /images/sandiamountains.jpg HTTP/1.1" 200 61671 "http://ladb.unm.edu/"; "Mozilla/5.0 ..." 1.2.3.4 is %S. "GET /images/sandiamountains.jpg HTTP/1.1" is "%j %r %j" (I don't care about the GET or the HTTP/1.1, so they are coded as %j for junk). The timestamp has a day (%d), Month, (%M), 4-digit Year (%Y), hour (%h), minutes (%n) and more junk (seconds and GMT offset), so [17/Sep/2008:13:12:52 -0600] is coded as [%d/%M/%Y:%h:%n:%j] Note that case and spacing is important. Put it all together, and you end up with a LOGFORMAT like this: %S %j "%u" [%d/%M/%Y:%h:%n:%j] "%j %r %j" %c %b "%f" "%B" Your existing .cfg file uses "analog syntax", not Apache syntax, so when you added two extra fields to your logfile (referrer and User Agent), so you could have just copied the existing entries and add "%f" "%b" to the end (though there's a lot of redundancy in your existing setup - you really only need the first 1 of the 4 DEFAULTLOGFORMAT lines). Or you could copy the modified logformat command from your http.conf file and add it to the analog.cfg file with APACHEDEFAULTLOGFORMAT (%h %l \"%u\" %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\") Based on what you've posted, you only need # If you need a LOGFORMAT command (most people don't -- try it without first!), # it must go here, above the LOGFILE commands. DEFAULTLOGFORMAT (%S %j "%u" [%d/%M/%Y:%h:%n:%j] "%j %r %j" %c %b) DEFAULTLOGFORMAT (%S %j "%u" [%d/%M/%Y:%h:%n:%j] "%j %r %j" %c %b "%f" "%B") DEBUG ON You should be able to delete the other 12 lines from your .cfg file, as they don't appear to be doing anything useful (I'd be particularly concerned about that LOGFILE line - are you counting access_log.????-??.gz and log-????-??.gz? Aengus +------------------------------------------------------------------------ | TO UNSUBSCRIBE from this list: | http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +------------------------------------------------------------------------
