Well to answer my own question... My Netscape/4.06 seems to be reported as a user-agent string of 'Mozilla/4.06' and so there is a 'transciption' being done by analog...but its results seem correct :-)
But just to show where log analysis can take you, looking at the requests I see they come from private address space and so it seems something on an internal network is generating these requests. Now the task is to find out what and why! As for page counts, my best rationalisation is that the high overnight count is spiders and so analog is correctly showing page requests that aren't being recorded by the page view 'bug'. Then over day proxies are causing the page bug to record higher page views than seen by the servers. It's the best rationalisation I've come up with so far! I've had analog dump out the log lines it sees as being corrupt and they do indeed seem to be truncated and account for about 5% of the log lines which seems high. Now to understand why the servers would be doing this! .../Iain -----Original Message----- Sent: 21 February 2009 14:03 To: 'Support for analog web log analyzer' Subject: RE: [analog-help] Problem with page counts Well Cygwin is a big help, thanks... Only it now raises more questions! One thing which is odd is that analog is reporting quite high usage of Netscape 4 which seemed odd and so caused me to look further. So analog says: 5 172430 2.00% Netscape 170370 1.98% Netscape/4 167023 1.94% Netscape/4.06 3281 0.04% Netscape/4.0 41 Netscape/4.77 3 Netscape/4.5 16 Netscape/4.76 2 Netscape/4.61 1 Netscape/4.05 3 Netscape/4.7 1645 0.02% Netscape/7 1643 0.02% Netscape/7.2 2 Netscape/7.1 414 Netscape/8 371 Netscape/8.1 43 Netscape/8.1.3 Most of it seems to be Netscape 4.06 which indeed would be old. So I tried: grep 'Netscape/' *.log > netscape.log I then used Excel to summarise netscape.log and come up with... user-agent Total Netscape/7.1 2 [matches analog] Netscape/7.2 1695 [analog says 1695] Netscape/8.0.4 5 [missing from analog] Netscape/8.1 387 [analog says 371] Netscape/8.1.3 43 [matches analog] Grand Total 2132 [way off as analog sees lots of Netscape/4 traffic] grep does not find any 'Netscape/4' strings at all. Note some counts correspond: Netscape/8.1.3 is 43 under both counts, Netscape/7.1 is 2 under both counts. Is there user-agent signature mapping going on within analog that is relating some string[s] other than 'Netscape/4' to be Netscape v4 user agents? These figures will be used to derive browser compatibility tests and so I'll be challenged on my Netscape 4 figures and so want to be certain :-) Thx.../Iain -----Original Message----- From: analog-help-boun...@lists.meer.net [mailto:analog-help-boun...@lists.meer.net] On Behalf Of Stephen Turner Sent: 20 February 2009 20:53 To: Support for analog web log analyzer Subject: Re: [analog-help] Problem with page counts 2009/2/20 Iain Hunneybell <i...@ipmarketing.co.uk>: > > Sadly I have no UNIX host to hand and these are Gig files and so I > can't head/tail/grep easily. Windows grep dies... I'll write something > to parse the files so I can have a real look at the records... > Can you install Cygwin? -- Stephen Turner +----------------------------------------------------------------------- +- | TO UNSUBSCRIBE from this list: | http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html List | archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +----------------------------------------------------------------------- +- +------------------------------------------------------------------------ | TO UNSUBSCRIBE from this list: | http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +------------------------------------------------------------------------
