e Analog run automatically
at a certain time every day, you can use the "cron" command. This might not
work properly at first, because of file permissions, but give it a try.
Solo analogico genera output quando si esegue esso. Per avere analogico
eseguito automaticamente in un
a good idea what you want to get from your log
files, and Analog delivers on those needs, then it's going to keep delivering.
Aengus
+
| TO UNSUBSCRIBE from this list:
|http://lists.meer.net/mailman/listinf
a,
but the discussion forum indicates that it's a bit more usable at this point.
If I had the time (and a pressing need), I'd invest an afternoon in trying to
get it working, but I think I'll leave it on the to-do list for now :-)
Aengus
+---
.
What am I doing wrong?
http://analog.cx/docs/faq.html#faq101
Aengus
+
| TO UNSUBSCRIBE from this list:
|http://lists.meer.net/mailman/listinfo/analog-help
|
| Analog Documentation: http://analog.cx/docs/Readme.html
%s - %u [%d/%M/%Y:%h:%n:%j %j] "%j %r %j" %c %b "%f" "%A"
> "%j" "%j" "-"
Almost right. The Logformat string has to be delimited (usually with () ) and
the Browser string is usually indicated with %B, but %A seem
Leung, Michael <[EMAIL PROTECTED]> wrote:
> Aengus,
>
> The below is what we see for the Domain Report, but it is not what we
> are expecting.
>
> Listing domains, sorted by the amount of traffic.
>
> reqs %bytes domain
> 655193 100% [unresolved numerical ad
, using Analogs built-in lookups
wouldn't be the best idea. For learning about DNS lookups, a sample from
the logfile of a few hundred lines would be a better idea. For DNS
lookups on anything larger than that, you really need to use one of the
the DNS helper apps.
A
On 12/1/2008 6:55 PM, Leung, Michael wrote:
Based on my LOGFORMAT, my Referrer field shouldn't be empty. Right?
The sample logfile entry that you provided had a referrer field
(https://www.networksolutions.com/manage-it/private-registration-splash.jsp)
A
h something like
146-115-44-11.c3-0.sbo-ubr1.sbo.ma.cable.rcn.com. It makes sense to someone at
rcn.com.
Aengus
+
| TO UNSUBSCRIBE from this list:
|http://lists.meer.net/mailman/listinfo/analog-help
|
| Analog Docume
e last 7 days, you'd use
REQFLOOR -20q
http://analog.cx/docs/othreps.html#FLOOR
Aengus
+
| TO UNSUBSCRIBE from this list:
|http://lists.meer.net/mailman/listinfo/analog-help
|
| Analog Documentation: http://analog.cx/docs/Re
hich is not turned on by
Default). Turn it on with
HOST ON
The full list of reports that Analog can produce is listed here:
http://analog.cx/docs/reports.html#repoth
The list of commands for turning these different reports on and off is here:
http://analog.cx/docs/out
Leung, Michael <[EMAIL PROTECTED]> wrote:
> Aengus
>
>
> When I use the REQFLOOR -20r, I got the following:
>
>
> Request Report
> --
> This report lists the files on the site.
>
> Listing the top 20 files by the number of requests
Leung, Michael <[EMAIL PROTECTED]> wrote:
> REQARGFLOOR 100%r
That should be
REQARGSFLOOR 100%r
Aengus
+
| TO UNSUBSCRIBE from this list:
|http://lists.meer.net/mailman/listinfo/analog-help
|
| Analog Docu
string to "/Search.aspx?keyword=Analog6" to match the
INtsearch entries you listed above.
I modified your referrer string to "http://www.google.com/search?q=analog+6.0";
because Google is one of the searchengines listed in sample analog.cfg file:
SEARCHENGINE http:
ory of
the customer that needs it. You'll get a warning that Ananlog couldn't find the
custom.cfg file for the other customers, but Analog will still create the
reports.
Aengus
+
| TO UNSUBSCRIBE from this li
;.So is it possible to get the report as Vista under the
OS report and how it can be done?
http://lists.meer.net/pipermail/analog-help/2008-October/021339.html
Aengus
+
| TO UNSUBSCRIBE from this list:
|http://lists.meer.n
of people have posted modified binaries that you can download
from their own websites. None of the binaries available from
www.analog.cx have this support.
Aengus
+
| TO UNSUBSCRIBE from this list:
|http://lists.meer.n
BROWALIAS "Windows NT 6.0 " "Windows Vista" will it work?
I don't think that's ever come up on the list - have you tried it? It
should only take a couple of seconds.
Aengus
+
| TO UNSUBSCRIBE fr
reation of the patches mentioned earlier. You can download a copy of
the modified executable for Windows here:
http://www.xs4all.nl/~jfeelder/downloads/analog.exe
Aengus
+
| TO UNSUBSCRIBE from this list:
|http://list
XP 64 bit and
32bit uniquely.
Windows XP 32-bit is Windows NT 5.1
According to Wikipedia, "Windows XP 64-bit Edition 2003" is based on the
Windows NT 5.2 codebase, and is therefore identified as the same OS as
Windows Server 2003.
Microsoft define
) doesn’t match SUBSORTBY
(bytes)
I have commented out any sorts using bytes and cant see to work out why
this is occurring.
Have you tried adding SUBDIRSORTBY PAGES?
Aengus
+
| TO UNSUBSCRIBE from this list:
|http
On 1/7/2009 7:42 PM, Casual Account wrote:
Thanks Aengus
That sorted the problem. Does that command also apply to the browser
> report? (ie when I added it I got a mismatch on bytes and pages
> again, but could fix this by changing BROWREPSORTBY REQUESTS and
> BROWSUMSORTBY REQUESTS
behaved spiders identify themselves.
You can also do a Full Browser report on requests for /robots.txt and
then use that to create a list of BROWEXCLUDE commands so that you can
see if the human-driven traffic patterns make more sense.
Aengus
+-
rt that doesn't match.
You might want to use the ERRFILE command to send the output to a file,
rather than to the screen.
http://analog.cx/docs/debug.html#ERRFILE
Aengus
+
| TO UNSUBSCRIBE from this list:
|http://li
setup. (Note that Analog
doesn't know or care what is set up in your apache configuration files -
it will only use the LOGFORMAT or APACHELOGFORMAT commands in
analog.cfg, or autodetection, if you don't have a LOGFORMAT).
Aengus
+
s. But that won't tell you why
your web server is using two different logformats, (or whether it's
recording the same request twice).
Aengus
+
| TO UNSUBSCRIBE from this list:
|http://lists.meer.net/mailman/li
%M/%Y:%h:%n:%j] "%j %r" %c %b)
http://analog.cx/docs/logfmt.html
But you don't want to add those requests to your current Analog report.
If you do create a new report to count these lines, you'll need to look
at the Failure Reports, because the Response code is 400.
Aengus
+
As Klaus said, - is not a wildcard, it's a specific string, and 7296 doesn't
match -, and neither does http://axx.uk/
If you don't care about the byte count, or the referrer, use %j instead of
those particular - characters, or use %b for the byte-count field, and %f for
the r
On 3/10/2009 9:31 AM, Nanu Kalmanovitz wrote:
Can Analog be configured to ignore the IPv6 like records ( ::1 - - [26/Feb/2009:11:13:58
+0200] "GET /" 400 991) in the access_log file?
LOGFORMAT (::%j)
Aengus
+
can specify several LOGFORMAT commands in a row, and they will all apply
to the next logfile. This is also useful if the format of your logfile
changes half way through."
Aengus
+
| TO UNSUBSCRIBE from this list:
, and the report time
>> frame appears to be frozen at March 10.
>>
>> What can be done to force it to refresh the data?
If it's a service set up and managed by GoDaddy, then you'd have to ask GoD
that list to see if
this issues has been discussed more extensively there.
http://lists.meer.net/pipermail/analog-help/2002-July/012919.html
http://www.jp.analog.cx/ml/archive/
Aengus
+
| TO UNSUBSCRIBE from this list:
|
uests without
arguments, but one way is to use FILEALIAS so that the ? separating the
arguments isn't recognized - in that case all of the ocsportal.portal
requests will be listed seperately
FILEALIAS /web/oscportal.portal?
mes a particular file was
requested, but you don't have a record of every request for that file any more,
therefore you can't find out how many requests occurred between two points in
time.
Aengus
+
| TO UNSUBSCRIB
ose out.
I'm afraid you're probably going to have to make this mod yourself - Analog
hasn't had an official update in almost 4 years. A quick look at the source
suggests that you might be able to get away
Robin Lee Powell wrote:
> On Mon, May 04, 2009 at 05:52:52PM -0400, Aengus wrote:
>> Robin Lee Powell wrote:
>>>> If there's no other way to solve this problem, please consider
>>>> this a feature request to split those out.
>>
>> I'
Robin Lee Powell wrote:
> On Tue, May 05, 2009 at 12:53:33PM -0400, Aengus wrote:
>> Robin Lee Powell wrote:
>>> On Mon, May 04, 2009 at 05:52:52PM -0400, Aengus wrote:
>>>> Robin Lee Powell wrote:
>>>>>> If there's no other way to solv
tes later you should
have a new copy of analog.exe with your modifications. Note that it won't have
the Analog icon, but other than that it should work fine.
Aengus
+
| TO UNSUBSCRIBE from this list:
|http://lists.m
Aengus wrote:
> If there aren't any errors in your code, then a few minutes later you
> should have a new copy of analog.exe with your modifications. Note
> that it won't have the Analog icon, but other than that it should
> work fine.
It turns out that adding the ico
ent from
> /docsinf/search
> And
> /yabb
>
> (examples)
>
> Why?
If you run
analog -settings
there'll be a section near the top that will detail what Analog is including
and excluding. If there are any conflicting requests, it should be obvious from
there.
Aengus
Rogers, Steve I. wrote:
> In a previous thread, user Aengus mentioned that "
>
> you can get a list of all the Users (IP addresses or UserIDs) that
> accessed a single page"
>
> How would I get that report from Analog? I turned on the User report
> but I only get
On 6/23/2009 8:37 AM, Rogers, Steve I. wrote:
Aengus,
Thanks very much for your prompt response. However, what I am looking
for is the "bigger trends". I have a PDF directory and I my customer
wants to know which users are accessing those PDF documents. The
information is in th
whether it's a tab or a space (or multiple
spaces). It makes it harder to read the LOGFORMAT, but it should work for you.
for example: %S%w[%d/%M/%Y:%h:%n:%j]%w"%j%w%r%w%j"
Aengus
+
| TO UNSUBSCRIBE from this li
/pipermail/analog-help/2008-June/021101.html
Aengus
+
| TO UNSUBSCRIBE from this list:
|http://lists.meer.net/mailman/listinfo/analog-help
|
| Analog Documentation: http://analog.cx/docs/Readme.html
| List archives: http
t;%r" %>s %b "%{Accept}i" "%{Referer}i"
> "%{User-Agent}i")
Analog is able to parse out the escape "quotes", and the APACHELOGFORMAT line
works with the sample line that Dan posted, with or without the \'s.
I just copied the sample line into a file, added
s - it all depends on how the server was set up.
I don't want to discourage you - it's not actually as complicated as it might
sound, it's just that "local knowledge" is needed to answer the question.
Aengus
+--
recompile it to identify
Chrome as a seperate browser, I think, but I don't have a copy of the
source to hand to see what would be involved.
Aengus
+
| TO UNSUBSCRIBE from this list:
|http://lists.meer.net/mailman/
Dave Sergeant wrote:
> On 20 Jul 2009 at 10:59, Aengus wrote:
>
>> According to Google's own documentation, the Useragent for Chrome
>> looks like: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US)
>> AppleWebKit/525.13 (KHTML, like Gecko) Chrome/0.X.Y.Z Safari/525.13.
Dave Sergeant wrote:
> On 20 Jul 2009 at 12:58, Aengus wrote:
>
>> If "real" Safari browsers are identified as 5.something, and Chrome
>> browsers as 530, then
>>
>> BROWSUMALIAS Safari/530 Chrome/530
>>
>> Will still list the Chrome Brows
Barak Kalai wrote:
> I would like pick multiple log files in windows. The file location is
> drive_letter:\directory\*static_name.zip
LOGFILE drive_letter:\directory\*static_name.zip
http://analog.cx/docs/logfile.html
r log file, including some PDF requests?
Aengus
+
| TO UNSUBSCRIBE from this list:
|http://lists.meer.net/mailman/listinfo/analog-help
|
| Analog Documentation: http://analog.cx/docs/Readme.html
| List archives: http://www.anal
Christoph Kukulies wrote:
> Aengus schrieb:
>> On 8/12/2009 10:47 AM, Christoph Kukulies wrote:
>>
>> Can you post 3 or 4 lines from your log file, including some PDF
>> requests?
> 87.79.34.253 - - [11/Aug/2009:17:58:38 +0200] "GET
> /export/download
d it useful to use the ERRFILE command to capture the
output to a file.
http://analog.cx/docs/debug.html#ERRFILE
Aengus
+
| TO UNSUBSCRIBE from this list:
|http://lists.meer.net/mailman/listinfo/analog-help
|
| Analog Docume
reports, and your logfile are just names sequentially, (log001.log, log002.log,
etc), then there's no way withing Analog itself to have Analog create the Jan07
report, then the Feb07 report, then the Mar07 report, etc.
Aengus
+--
Zourarakis, Demetrio (COT) wrote:
> Thanks. Aengus.
> It would have created 1012 reports...
> I concatenated the logfiles using MS DOS command line into one BIG
> logfile...
No, LOGFILE *.LOG will creat ONE report containing the data from all the
logfiles.
Analog has always al
tual hosts, password
> protect each report, even though I have log data that is on one single
> access_log?
Yes.
> Are DNS lookups cached?
Yes. It is strongly recommended that you use a different tool to generate the
DNS cache, though - Analog is not optimised for DNS lookups.
http://analo
t attention, or only sporadic
attention to their logs, others may spend a lot of time delving in to them).
Analog is extremely flexible, and is often used in large hosted
environments. But there isn't one "right" way to deploy it - it really
does depend on what you want to achieve.
forbidden set in anlgform.pl, but
that's where to look when you're testing this.
Aengus
+
| TO UNSUBSCRIBE from this list:
|http://lists.meer.net/mailman/listinfo/analog-help
|
| Analog Documentation: h
(used to indicate
where requests are coming from ), the Virtual Host Report (used to show
how much traffic went to the Virtual Hosts abc.com and xyz.com) or the
Request Report?
Aengus
+
| TO UNSUBSCRIBE from this list
E *.mydivision.abc.com
For just the requests abc.com:
HOSTINCLUDE *.abc.com
HOSTEXCLUDE *.mydivision.abc.com
and from the internet:
HOSTEXCLUDE *.abc.com
Aengus
+
| TO UNSUBSCRIBE from this list:
|http://lists
, but
you can also find the Internal Search Report useful.
http://analog.cx/docs/args.html#SEARCHENGINE
Aengus
+
| TO UNSUBSCRIBE from this list:
|http://lists.meer.net/mailman/listinfo/analog-help
|
| An
mes part of the referrer string, and none of the
SEARCHENEGINE entries start with ". You have the same problem with the Browser
field.
Try this LOGFORMAT instead:
LOGFORMAT (%s - %u [%d/%M/%Y:%h:%n:%j %j] "%j %r %j" %c %b %v "%f" "%B" %j)
Aengus
+---
975E-7040A72105801B36
then case isn't an isue, but you will probably also want
REQFLOOR 1r
REQARGFLOOR 1r
if you're doing your tests with one-line logfiles, and
DIRSUFFIX index.cfm
PAGEINCLUDE *.cfm
might also be useful.
Aengus
+--
filename - something like this:
FILEALIAS /?objectid=* /*
FILEALIAS /index.cfm?objectid=* /*
Aengus
+
| TO UNSUBSCRIBE from this list:
|http://lists.meer.net/mailman/listinfo/analog-help
|
| Analog Documentation: http
, REQARGFLOOR ir,
for example), you can use a log file with 3 or 4 entries and see how the
reports change as you modify different settings in the config file, or
modify different elements of the log file entries.
Aengus
+
| TO
http://www.google.com/search?hl=en&site=&q=site%3Alists.meer.net+analog-help&btnG=Search
Aengus
+
| TO UNSUBSCRIBE from this list:
|http://lists.meer.net/mailman/listinfo/analog-help
|
| Analog Documen
ve to have stars (*) on both sides of the question mark?
Because 0847DDA0-F261-59BF-FAA04EB1EC032B61 is not a file name, it's an
argument to index.cfm.
Aengus
+
| TO UNSUBSCRIBE from this list:
|http://lists.meer.n
der described in http://analog.cx/docs/alias.html
("After analog has read each logfile entry, it then applies aliases to each of
the items") and http://analog.cx/docs/include.html ("After aliasing each item,
analog decides whether that item is wanted or not.")
Aengus
+-
otice"
(Note that the REGEXPI isn't necessary - you haven't specified a Regular
expression). Your Request Report would then show the number of requests for
Blue Widgets, the Shopping Cart, etc, and, if you used the PAGEINCLUDE comamnd
above, the entries should be clickable (you m
ou _might_ be able to do something like that with some
FILEALIAS commands.
FILEALIAS /search?*client=*&*&site=*&* /$4?$2
would give you a Request Report that showed how many requests were made by each
client type to each site.
Aengus
+-
Terry Chambers wrote:
>
> Hi Aengus - using the INTSEARCHENGINE and INTSEARCHQUERY options, the
> report came through correctly. Thanks!
>
> Using the FILEALIAS also works to break down the data, which is also
> great!
>
> If I wanted to have BOTH the Internal Sear
Troy S wrote:
> I need to included a summary attributed to all html table tags?
?? Can you expand on that? I have absolutely no idea what html table tags have
to do with an Analog report?
Aengus
+
| TO UNSUBSCRIBE f
d, but the sample reports on that
website do include Summary tags in the Tables.
Aengus
+
| TO UNSUBSCRIBE from this list:
|http://lists.meer.net/mailman/listinfo/analog-help
|
| Analog Documentation: http://analog.cx/
/scripts/intro.php
> HTTP/1.1" 200 3653
>
> I get /scripts/ counts in my directory report but don't get the
> page count for intro.php in my request report.
> What am I missing?
Have you set the FLOOR for the request report low enough to show the
entry that you want to see?
or some people,
and not for others. You might be better off trying rdnslogs instead.
You can read previous posts about QDNS on the list here:
http://www.mail-archive.com/cgi-bin/htsearch?config=analog-help_lists_isite_net&words=qdns
Aengus
>
> -Original Message-
> From: [EMAIL
at file as a
logfile, and it didn't, because it couldn't find it.
What did you tell Analog to do? What arguments did you pass to it when
you ran it.
Aengus
+
| TO UNSUBSCRIBE from this list:
|http://lists.me
that something is preventing Anlgform.exe from calling Analog properly.
Make sure that Ananlog is working properly before calling it from
Anlgform.
Aengus
+
| TO UNSUBSCRIBE from this list:
|http://lists.meer.net/mai
ror.log: ignoring it
Analog won't usually parse error logs, so this is to be expected if you
tell it to parse *.log.
Aengus
+
| TO UNSUBSCRIBE from this list:
|http://lists.meer.net/mailman/list
and BROWSUMEXCLUDE just exclude those requests from the
Browser report and the Browser Summary reports.
Aengus
+
| TO UNSUBSCRIBE from this list:
|http://lists.meer.net/mailman/listinfo/analog-help
|
| Usenet version: new
On Friday, September 17, 2004 3:28 PM [GMT],
J M <[EMAIL PROTECTED]> wrote:
> Thank you for responses to previous questions. I have anlgform
> working and am off to configure further. Extra thank you to Aengus
> for not only offering help but creating the Windows "helper&q
ing Sites.
The Referrer Report reports on Referrers. Try
REFERRER ON
Aengus
Aengus
+
| TO UNSUBSCRIBE from this list:
|http://lists.meer.net/mailman/listinfo/analog-help
|
| Usenet version: news:/
Is all.cfg in the same directory as Analog?
Aengus
+
| TO UNSUBSCRIBE from this list:
|http://lists.meer.net/mailman/listinfo/analog-help
|
| Usenet version: news://news.gmane.org/gmane.comp.web.analog.general
|
On Tuesday, September 21, 2004 3:43 PM [GMT],
Jane Hermanson <[EMAIL PROTECTED]> wrote:
> Aengus thanksof course they were not in the same
> directory.changed the path to be reflective of the files...ran my
> script...and got separtate stats for my hosts.
>
> Did get
ALIAS or REQALIAS to hide the actual page name.
One way might be to do something like this:
FILEALIAS *.asp?* /search.asp?$2
INTSEARCHENGINE /search.asp section
(The Internal Search report should show all values that were assigned to
the "section" argument).
n/library c
INTSEARCHQUERY on
Listing queries, sorted by the number of requests.
reqs: search term
: ---
3: deafbios
2: gasw
2: auhist
1: fenian
1: ftpp
1: gadpi
Is that what you are trying to measure?
Aengus
+
e them by specifying
INTSEARCHQUERY ON
INTSEARCHWORD ON
Aengus
+
| TO UNSUBSCRIBE from this list:
|http://lists.meer.net/mailman/listinfo/analog-help
|
| Usenet version: news://news.gmane.org/gmane.comp.web.analog.gene
your lofgiles are formatted, running analog is as
simple as opening a command prompt, changing to the Analog directory,
and typing
Analog x:\directory\logfile.log
The result will be in report.html in the same directory.
Please read the documentation available on the Analog website.
http://www.analog.c
ccess to the logs whereever they
are on the server, or extract the logs for your website and send them to
you.
Aengus
+
| TO UNSUBSCRIBE from this list:
|http://lists.meer.net/mailman/listinfo/analog-help
|
| Use
lower
the floor (by default, the referrer report only lists "referring URLs
with at least 20 requests".
REFFLOOR 1r
will show all referrers.
Aengus
+
| TO UNSUBSCRIBE from this list:
|http://lists.meer.net
the ...COLS
commands.
INTSEARCHQUERYCOLS
http://analog.cx/docs/othreps.html
Aengus
+
| TO UNSUBSCRIBE from this list:
|http://lists.meer.net/mailman/listinfo/analog-help
|
| Usenet version: news://ne
proxy servers that strip proxy
information.
You should probably do some reports of just those requests that don't
have any referrer information. Use
REFINCLUDE ""
and see if the Browser being used, or the Host report gives any insight
into who is generating these referrerless requests.
you tried running a report using BROWINCLUDE, to create a report on
just those NN4 requests? If they are coming from a small cluster of IP
addresses, or if they are only requesting pages, and not images, then a
spider would seem likely.
Aengus
+---
ate, but I
don't think I ever bothered doing it. Some of the logic required to
actually calculate yesterdays date is described in this post:
http://www.mail-archive.com/[EMAIL PROTECTED]/msg06580.html
Aengus
+
| TO UNSUBSC
te that every single request was made. When you told Analog to analyze
all cache files with SEP in the name, it included cachefiles from
September 2003, and because there are no dates associated with any
individual requests in cachefiles, the FROM/TO directives didn't exclude
the information from t
s counting all the index.html files as .htm, when
> using just a small sample log file.
Analog assumes that the default document in a directory is index.html.
You can use the DIRSUFFIX command to tell Analog what the default
document on yo
you expect them to be, and we can probably explain why they are
being interprted the way they are being interprted, and perhaps explain
how to erconfigure things to get the answer that you expect.
Aengus
+
| TO UNSUBSCRIBE
ve the GET method will be counted by Analog.
(You'll get a "Large number of corrupt log entries" warnings. You can
either ignore this, or just add a second LOGFORMAT entry - LOGFORMAT
(%j) should do it, I think).
Aengus
+-
t-Image/1.0"
If they're the entries in the logfile, then Analog isn't adding anything
to the beginning of the URLs, and you really should find out why your
web server is doing that.
Having said that, you can get Analog to take /advocates-for-an out of
the URL by using a FILEALIA
e two hypothetical log
entries as two "page views", but, as the FAQ
(http://www.analog.cx/docs/faq.html#faq181) says, that would really be
double counting.
Aengus
+
| TO UNSUBSCRIBE from this list:
|http://li
from the internet).
Have you looked at your failure report? Have you looked at the Host
report for those redirected requests to see if a large number of them
are coming from a broken client that can't do redirects properly, and
just constantly tries to reload the old homepage? (You'
501 - 600 of 1058 matches
Mail list logo
