[analog-help] help with extracting browser data
Can someone suggest a working logformat to identify the browser correctly? Following are examples of typical log entries in a log file (monthly log circa 200 mb). I am showing only the end part of each line, the part that is problematic: 200 3456 ScoutAbout - 200 657151 Mozilla/3.01 (compatible;) - 200 9010 Mozilla/4.7 [de] (WinNT; I) 200 8502 Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0) Fetch API Request - 200 13722 Mozilla/4.7 [de] (WinNT; I) http://www/ 200 11635 Mozilla/4.0 (compatible; MSIE 6.0; Windows 98) http://www/zeigen.html?seite=212 200 0 Mozilla/4.0+(compatible;+MSIE+5.5;+Windows+98) http://www.dfn.de/links/schule.html 200 27139 Mozilla/4.0 (compatible; MSIE 5.0; Windows 98; DigExt) 200 13435 FAST-WebCrawler/3.3 ([EMAIL PROTECTED]; 200 29811 FAST-WebCrawler/3.3 ([EMAIL PROTECTED]; http://fast.no/support.php?c=faqs/crawler) - The number of words identifying browser varies and there are no tabs separating the browser info from referred data. I try %c %b %B %f %c %b %A %f %c %b - %c - - but this takes only word 1 of the browser info as browser data and uses the rest as referrer. I tried %c %b %B http://%f but that results in most entries reported as corrupted. The docs are somewhat skimpy about dealing with varying information. Using the AUTO logformat does not work, in case someone wonders. I tried. Robert + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help@lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 +
Re: [analog-help] help with extracting browser data
On Mon, 28 Jan 2002, Robert Brenstein wrote: Can someone suggest a working logformat to identify the browser correctly? Following are examples of typical log entries in a log file (monthly log circa 200 mb). I am showing only the end part of each line, the part that is problematic: 200 3456 ScoutAbout - 200 657151 Mozilla/3.01 (compatible;) - 200 9010 Mozilla/4.7 [de] (WinNT; I) 200 8502 Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0) Fetch API Request - 200 13722 Mozilla/4.7 [de] (WinNT; I) http://www/ 200 11635 Mozilla/4.0 (compatible; MSIE 6.0; Windows 98) http://www/zeigen.html?seite=212 200 0 Mozilla/4.0+(compatible;+MSIE+5.5;+Windows+98) http://www.dfn.de/links/schule.html 200 27139 Mozilla/4.0 (compatible; MSIE 5.0; Windows 98; DigExt) 200 13435 FAST-WebCrawler/3.3 ([EMAIL PROTECTED]; 200 29811 FAST-WebCrawler/3.3 ([EMAIL PROTECTED]; http://fast.no/support.php?c=faqs/crawler) - You can't, because there is no way for analog to know where the browser ends and the referrer begins. You will have to tell your web server to log in a more sensible format (delimit the browser with quotes, for example); and if you need to analyse these logs, you will have to write a preprocessor to put them in a better format. -- Stephen Turner, Cambridge, UKhttp://homepage.ntlworld.com/adelie/stephen/ This is Henman's 8th Wimbledon, and he's only lost 7 matches. BBC, 2/Jul/01 + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help@lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 +
Re: [analog-help] pulling the logformat from apache
I have three logs. the error log is irrelavent though. so i have an access
log and a ssl_engine_log. but my httpd file calls for only one log file to
be created.
Is my format being broken up into two files is that what is ocurring?
the apache conf file for the logformat is as follows
LogFormat %h %l %u %t \%r\ %s %b \%{Referer}i\ \%
{User-Agent}i\
combined
LogFormat %h %l %u %t \%r\ %s %b common
LogFormat %{Referer}i - %U referer
LogFormat %{User-agent}i agent
LogFormat %h %l %u %t \%r\ %s %b \%{Referer}i\ \%
{User-Agent}i\
%{SSL_PROTOCOL}x %{SSL_CIPHER}x ssl-combined
#CustomLog /usr/local/apache/logs/access_log common
#CustomLog /usr/local/apache/logs/referer_log referer
#CustomLog /usr/local/apache/logs/agent_log agent
#CustomLog /usr/local/apache/logs/ssl_request_log %t %
h %{SSL_PROTOCOL}x
%{SSL_CIPHER}x \%r\ %b
#CustomLog /usr/local/apache/logs/access_log combined
CustomLog /usr/local/apache/logs/access_log ssl-combined
+
| This is the analog-help mailing list. To unsubscribe from this
| mailing list, go to
|http://lists.isite.net/listgate/analog-help/unsubscribe.html
|
| List archives are available at
|http://www.mail-archive.com/analog-help@lists.isite.net/
|http://lists.isite.net/listgate/analog-help/archives/
|http://www.tallylist.com/archives/index.cfm/mlist.7
+
