[analog-help] Error in script or dumb newbie?
Hi all. I am quite a newbie with this. I have gotten all setup perfectly so far but I have one problem. When I go and try to run the script ./fwanalog it fails with an error “./fwanalog.sh[828]: [: analog:: unexpected operator/operand”. It fails with this 3 times. I checked the directory and see that the fwanalog.all.log is created from my ipflog in /var/log/ . What gives? I have even run it as root as well to see if this would correct the issue. I get the same over and over any help would be appreciated. Further info below: ERROR: bash# ./fwanalog.sh ./fwanalog.sh[828]: [: analog:: unexpected operator/operand ./fwanalog.sh[828]: [: analog:: unexpected operator/operand ./fwanalog.sh[828]: [: analog:: unexpected operator/operand bash# ENVIRONMENT: OpenBSD Thanks, Chris
[analog-help] from older to newer version
Its the first time that I myself have to replace an older version to a newer version. After installing subdir 5.22, is there some docs where it says what I should copy/keep/move from my older subdir (5.21) to my newer subdir (5.22), to have it working same way in 5.22 as I had it working in 5.21? Greets, Henk Schrik + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help@lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 +
Re: [analog-help] Can Analog handle Redirects as Requests?
Did you read the FAQ item that I linked to? That's the double counting I'm talking about. -- Jeremy Wadsack Wadsack-Allen Digital Group Michael Rabe ([EMAIL PROTECTED]): > Thanks for the feedback - could you elaborate on the "double counting"? > What is that potential? A lot of the redirects I see correspond to POSTS > to a servlet (which appears like a directory in the Url field of the log) > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED]]On Behalf Of Jeremy Wadsack > Sent: Friday, March 22, 2002 2:22 PM > To: [EMAIL PROTECTED] > Subject: Re: [analog-help] Can Analog handle Redirects as Requests? > Michael Rabe ([EMAIL PROTECTED]): >> Is there any way to break down Analog's Redirects report into the Monthly, >> Daily, >> and Hourly summaries as it does for the Requests? >> I would like to filter on log entries using FILEINCLUDE and REFINCLUDE >> config >> entries, but it seems that analog does not include a redirect as a > request. >> Ideally, if every entry was treated as a request, I would be fine. But, > to >> my >> knowledge, Analog is too smart and treats all the entries with HTTP 300 >> status codes as redirects. >> My current workaround is to use "sed" to change all the "300" status codes >> into 200s, then run the appropriate Analog reports. >> Any thoughts on this? > http://www.analog.cx/docs/faq.html#faq181 > If you are ok with the potential double counting on directories, then > your sed approach is probably the best. > -- > Jeremy Wadsack > Wadsack-Allen Digital Group + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help@lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 +
Re: [analog-help] analog-announce working
Works for me... > Someone has just told me that although he's subscribed to > analog- announce, he didn't receive the recent security warning. Could > other people who are subscribed to a-a kindly confirm or deny whether > they got it? Thanks. > > -- > Stephen Turner, Cambridge, UK > http://homepage.ntlworld.com/adelie/stephen/ "This is Henman's 8th > Wimbledon, and he's only lost 7 matches." BBC, 2/Jul/01 > > + > | This is the analog-help mailing list. To unsubscribe from this > | mailing list, go to > | http://lists.isite.net/listgate/analog-help/unsubscribe.html > | > | List archives are available at > |http://www.mail-archive.com/analog- [EMAIL PROTECTED]/ > |http://lists.isite.net/listgate/analog- help/archives/ > |http://www.tallylist.com/archives/index.cfm/mlist.7 > + + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help@lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 +
RE: [analog-help] analog-announce working
I didn't read the email closely enough. I am only subscribed to [analog-help]. I am guessing that might be the case with others. --mat + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help@lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 +
RE: [analog-help] analog-announce working
On Fri, 22 Mar 2002, Charles Palmer wrote: > > I never received an annoucement either. > And Mathew Miles wrote: > I didn't get it, but was out on the site yesterday and downloaded the > latest version. Err, as far as I can tell neither of you is subscribed to analog-announce. Unless you're subscribed under a different address? -- Stephen Turner, Cambridge, UKhttp://homepage.ntlworld.com/adelie/stephen/ "This is Henman's 8th Wimbledon, and he's only lost 7 matches." BBC, 2/Jul/01 + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help@lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 +
RE: [analog-help] Can Analog handle Redirects as Requests?
Thanks for the feedback - could you elaborate on the "double counting"? What is that potential? A lot of the redirects I see correspond to POSTS to a servlet (which appears like a directory in the Url field of the log) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Jeremy Wadsack Sent: Friday, March 22, 2002 2:22 PM To: [EMAIL PROTECTED] Subject: Re: [analog-help] Can Analog handle Redirects as Requests? Michael Rabe ([EMAIL PROTECTED]): > Is there any way to break down Analog's Redirects report into the Monthly, > Daily, > and Hourly summaries as it does for the Requests? > I would like to filter on log entries using FILEINCLUDE and REFINCLUDE > config > entries, but it seems that analog does not include a redirect as a request. > Ideally, if every entry was treated as a request, I would be fine. But, to > my > knowledge, Analog is too smart and treats all the entries with HTTP 300 > status codes as redirects. > My current workaround is to use "sed" to change all the "300" status codes > into 200s, then run the appropriate Analog reports. > Any thoughts on this? http://www.analog.cx/docs/faq.html#faq181 If you are ok with the potential double counting on directories, then your sed approach is probably the best. -- Jeremy Wadsack Wadsack-Allen Digital Group + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help@lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 + + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help@lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 +
[analog-help] Automate Output log format
Running IIS5 and trying out Analog to generate logs for users viewing. How do I designate the CFG file to pull the logfile EX<2-digit_current_year<2-digit_current_month.log? It doesn't appear to like ex%y%M.log format. I would like to automate generating a new report for every month. Thank you, Susanne + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help@lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 +
Re: [analog-help] Can Analog handle Redirects as Requests?
Michael Rabe ([EMAIL PROTECTED]): > Is there any way to break down Analog's Redirects report into the Monthly, > Daily, > and Hourly summaries as it does for the Requests? > I would like to filter on log entries using FILEINCLUDE and REFINCLUDE > config > entries, but it seems that analog does not include a redirect as a request. > Ideally, if every entry was treated as a request, I would be fine. But, to > my > knowledge, Analog is too smart and treats all the entries with HTTP 300 > status codes as redirects. > My current workaround is to use "sed" to change all the "300" status codes > into 200s, then run the appropriate Analog reports. > Any thoughts on this? http://www.analog.cx/docs/faq.html#faq181 If you are ok with the potential double counting on directories, then your sed approach is probably the best. -- Jeremy Wadsack Wadsack-Allen Digital Group + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help@lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 +
Re: [analog-help] Counting multiple fields
Isn't that what you want to do? Count the total number of unique cookies for the period or log files? -- Jeremy Wadsack Wadsack-Allen Digital Group [EMAIL PROTECTED] ([EMAIL PROTECTED]): > I thought something like this would be the solution - but I can't seem to > get it to work. I've made a specific logfile (W3C format): >LOGFORMAT >%Y-%m-%d\t%h:%n%:%j\t%s\t%j\t%r\t%c\t%b\t%t\t%f\t%B\t%jidl_visitor=%u;%j > but it just gives me the total number of cookies during the period. Any > more suggestions? > I haven't attempted hijacking another variable yet, but the FLOOR setting > works fine. > thanks, Adam > Jeremy Wadsack wrote: >> So, two questions: >> 1. How can I count the number of instances of a cookie? > You'll need a more specific LOGFORMAT, if that's possible. The > LOGFORMAT needs to look for the cookie name that you want to track and > dumb the rest of the cookies. Something like this (within the cookie > field) might do the trick: > %jidl_visitor=%u;%j >> 2. How can I run Analog once and get the same report twice with two >> different *INCLUDE values? > You can't. You can hijack another variable, such as the virtual host > one, if you don't need it, and use the Virtual Host Report to track > the other field. Perhaps something like this in your LOGFORMAT: > %jidl_visitor=%u;%jidl_visit=%v;%j > Also, you can set the FLOOR for the User (and VHost) reports to > something very large to get all the values totaled in the [not listed] > section. In your report above USERFLOOR 2000r would do the trick. + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help@lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 +
Re: [analog-help] Organization Report -> incomplete IPs
On Fri, 22 Mar 2002, Aengus wrote: > "Ana Paula" <[EMAIL PROTECTED]> wrote: > > > Im using Analog (5.22) and Report Magic (2.13), and in my Organization > > Report the IP adresses they are being shown incomplete: > > > > Organization > > > > 200.123 > > 200.109 > > etc > > > > That's the way the Organization report is supposed to look if you haven't > enabled DNS resolution. Right. If you want the full IP addresses, use the Host Report. -- Stephen Turner, Cambridge, UKhttp://homepage.ntlworld.com/adelie/stephen/ "This is Henman's 8th Wimbledon, and he's only lost 7 matches." BBC, 2/Jul/01 + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help@lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 +
Re: [analog-help] OK I've got it running but...
"Frank Conte" <[EMAIL PROTECTED]> wrote: > OK I've got analog running on two platforms but I notice that report.html > is only analyzing hits on one day. > The top of the report says something like: start date > analyzing file from day1 to day1 > > How can I get it analyze the whole log file from the very first date the > log was generated? By default, Analog will analyse and report on all the data in your logfile. If it's only reporting on part of the data, it's because you've added some sort of restriction to the configuration file. The FROM and TO directives allow you to specify a specific period that Analog should include. Check you Analog.cfg file for any FROM directives. If you don't find anything, try running Analog with SETTINGS ON in the config file, and see if it provides any clues. Aengus + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help@lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 +
[analog-help] OK I've got it running but...
OK I've got analog running on two platforms but I notice that report.html is only analyzing hits on one day. The top of the report says something like: start date analyzing file from day1 to day1 How can I get it analyze the whole log file from the very first date the log was generated? Thanks Frank Conte Director, Communications & Information Systems Beacon Hill Institute at Suffolk University [EMAIL PROTECTED] (617)573-8050 + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help@lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 +
Re: [analog-help] Organization Report -> incomplete IPs
"Ana Paula" <[EMAIL PROTECTED]> wrote: > Im using Analog (5.22) and Report Magic (2.13), and in my Organization > Report the IP adresses they are being shown incomplete: > > Organization > > 200.123 > 200.109 > etc > > I already researched in Google, but I didn't find any solution. That's the way the Organization report is supposed to look if you haven't enabled DNS resolution. If you have DNS resolution enabled, then Analog will convert the IP numbers in your log to hostnames, and then all the connections from AOL.com will be counted together. But if an IP address doesn't resolve, Analog considers connections from the same range of IP addresses to be an Organization, and reports on the total connections from a particular range. If you don't have DNS enabled, follow the instructions at www.analog.cx/docs/dns.html but be aware that, even with DNS lookups enabled, you may still have significant numbers of unresolved addresses showing up. Aengus + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help@lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 +
[analog-help] FW: analog: SECURITY WARNING: upgrade to 5.22
I received the email on analog-announce. > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED]]On Behalf Of Stephen Turner > Sent: Friday, March 22, 2002 12:47 PM > To: analog-help > Subject: [analog-help] analog-announce working > > > Someone has just told me that although he's subscribed to analog-announce, > he didn't receive the recent security warning. Could other people who are > subscribed to a-a kindly confirm or deny whether they got it? Thanks. -Original Message- From: Stephen Turner [mailto:[EMAIL PROTECTED]]On Behalf Of Stephen Turner Sent: Wednesday, March 20, 2002 7:20 AM To: [EMAIL PROTECTED]; [EMAIL PROTECTED]; [EMAIL PROTECTED] Subject: analog: SECURITY WARNING: upgrade to 5.22 SECURITY ADVISORY 20th March 2002 -- Program: analog Versions: all versions prior to 5.22 Operating systems: all -- Yuji Takahashi discovered a bug in analog which allows a cross-site scripting type attack. It is easy for an attacker to insert arbitrary strings into any web server logfile. If these strings are then analysed by analog, they can appear in the report. By this means an attacker can introduce arbitrary Javascript code, for example, into an analog report produced by someone else and read by a third person. Analog already attempted to encode unsafe characters to avoid this type of attack, but the conversion was incomplete. Although it is not known that this bug has been exploited, it is easy to exploit, and all users are advised to upgrade to version 5.22 of analog immediately. The URL for analog is http://www.analog.cx/ I apologise for the inconvenience. Thank you to Yuji Takahashi, Motonobu Takahashi and Takayuki Matsuki for their help with this bug. Stephen Turner [EMAIL PROTECTED] + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help@lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 +
[analog-help] Organization Report -> incomplete IPs
Im using Analog (5.22) and Report Magic (2.13), and in my Organization Report the IP adresses they are being shown incomplete: Organization 200.194 200.193 200.123 200.109 etc I already researched in Google, but I didn't find any solution. Thanks -- Ana Paula <[EMAIL PROTECTED]> + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help@lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 +
Re: [analog-help] Counting multiple fields
I thought something like this would be the solution - but I can't seem to get it to work. I've made a specific logfile (W3C format): LOGFORMAT %Y-%m-%d\t%h:%n%:%j\t%s\t%j\t%r\t%c\t%b\t%t\t%f\t%B\t%jidl_visitor=%u;%j but it just gives me the total number of cookies during the period. Any more suggestions? I haven't attempted hijacking another variable yet, but the FLOOR setting works fine. thanks, Adam Jeremy Wadsack wrote: > So, two questions: > 1. How can I count the number of instances of a cookie? You'll need a more specific LOGFORMAT, if that's possible. The LOGFORMAT needs to look for the cookie name that you want to track and dumb the rest of the cookies. Something like this (within the cookie field) might do the trick: %jidl_visitor=%u;%j > 2. How can I run Analog once and get the same report twice with two > different *INCLUDE values? You can't. You can hijack another variable, such as the virtual host one, if you don't need it, and use the Virtual Host Report to track the other field. Perhaps something like this in your LOGFORMAT: %jidl_visitor=%u;%jidl_visit=%v;%j Also, you can set the FLOOR for the User (and VHost) reports to something very large to get all the values totaled in the [not listed] section. In your report above USERFLOOR 2000r would do the trick. This email has been scanned for all viruses by the MessageLabs SkyScan service. For more information on a proactive anti-virus service working around the clock, around the globe, visit http://www.messagelabs.com + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help@lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 +
RE: [analog-help] analog-announce working
I never received an annoucement either. > -Original Message- > From: Stephen Turner [SMTP:[EMAIL PROTECTED]] > Sent: Friday, March 22, 2002 12:47 PM > To: analog-help > Subject: [analog-help] analog-announce working > > Someone has just told me that although he's subscribed to analog-announce, > he didn't receive the recent security warning. Could other people who are > subscribed to a-a kindly confirm or deny whether they got it? Thanks. > > -- > Stephen Turner, Cambridge, UK > http://homepage.ntlworld.com/adelie/stephen/ > "This is Henman's 8th Wimbledon, and he's only lost 7 matches." BBC, > 2/Jul/01 > > + > | This is the analog-help mailing list. To unsubscribe from this > | mailing list, go to > |http://lists.isite.net/listgate/analog-help/unsubscribe.html > | > | List archives are available at > |http://www.mail-archive.com/analog-help@lists.isite.net/ > |http://lists.isite.net/listgate/analog-help/archives/ > |http://www.tallylist.com/archives/index.cfm/mlist.7 > + + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help@lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 +
[analog-help] analog-announce working
Someone has just told me that although he's subscribed to analog-announce, he didn't receive the recent security warning. Could other people who are subscribed to a-a kindly confirm or deny whether they got it? Thanks. -- Stephen Turner, Cambridge, UKhttp://homepage.ntlworld.com/adelie/stephen/ "This is Henman's 8th Wimbledon, and he's only lost 7 matches." BBC, 2/Jul/01 + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help@lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 +
Re: [analog-help] Counting multiple fields
[EMAIL PROTECTED] ([EMAIL PROTECTED]): > For each page served, our webserver creates two cookies with unique IDs. > One is persistent (to "identify" v***tors), and the other expires 30 > minutes after the end of the last page requested (to "identify" v***ts). I > need to count the number of individual instances for each cookie over a > given period. > By using the USERREPINCLUDE argument, I can get a Users report which tells > me how many pages/requests/bytes have been accessed by one or the other of > these, but that's not what I'm looking for. The only way I can do it at the > moment is to run Analog twice (once for each cookie) and refer to the [not > listed: XXX,XXX users] note at the end of each report. > The output (values abbreviated for clarity) is: >pages: user >-: > 1087: "idl_visitor=xxx; idl_visit=yyy" > 686: "idl_visitor=xxx; idl_visit=yyy" > 679: "idl_visitor=xxx; idl_visit=yyy" > 679: "idl_visitor=xxx; idl_visit=yyy" > 674: "idl_visitor=xxx; idl_visit=yyy" > 660: "idl_visitor=xxx; idl_visit=yyy" > 640: "idl_visitor=xxx; idl_visit=yyy" > 636: "idl_visitor=xxx; idl_visit=yyy" > 607: "idl_visitor=xxx; idl_visit=yyy" > 584: "idl_visitor=xxx; idl_visit=yyy" >69725: [not listed: 110,732 users] > What I'd like is something like: >instances: user >-: > 123087: idl_visitor > 834586: idl_visit > So, two questions: > 1. How can I count the number of instances of a cookie? You'll need a more specific LOGFORMAT, if that's possible. The LOGFORMAT needs to look for the cookie name that you want to track and dumb the rest of the cookies. Something like this (within the cookie field) might do the trick: %jidl_visitor=%u;%j > 2. How can I run Analog once and get the same report twice with two > different *INCLUDE values? You can't. You can hijack another variable, such as the virtual host one, if you don't need it, and use the Virtual Host Report to track the other field. Perhaps something like this in your LOGFORMAT: %jidl_visitor=%u;%jidl_visit=%v;%j Also, you can set the FLOOR for the User (and VHost) reports to something very large to get all the values totaled in the [not listed] section. In your report above USERFLOOR 2000r would do the trick. -- Jeremy Wadsack Wadsack-Allen Digital Group + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help@lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 +
Re: [analog-help] Analyzing multiple log files on Macintosh
On 3/22/02 5:57 AM Philippe ([EMAIL PROTECTED]) wrote: >I'm a beginner wih Analog. I'm trynig to configure Analog 5.22 to >analyze log files in a directory. >I'm on MacOs X.1.3. > >In the config file, I've wrote : >LOGFILE "Philippe B.:Analog:Logs:*" > >but when I run Analog, it says : >analog: Warning F: Cannot open directory Philippe B.:Analog:Logs:: won't > expand wildcards Philippe B.:Analog:Logs:* > >What does it means ?? Does I use another wildcard ?? That means that Analog can't find a folder named "Philippe B.:Analog:Logs:". That name speficifes a folder called "Logs" in a folder called "Analog" on a hard disk called "Philippe B.". You might have meant to add a leading ":", ie ":Philippe B.:Analog:Logs:*", that would mean a folder called "Logs" in a folder called "Analog" in a folder called "Philippe B." in the folder that contains the Analog application. Alternatively, if "Philippe B.:Analog:" is meant to be the folder that contains the Analog application, you could just use ":Logs:*", which is much simpler and less likely to cause problems. Good Luck Jason - [EMAIL PROTECTED] - Dr. Seuss books . . . can be read and enjoyed on several levels. For example, 'One Fish Two Fish, Red Fish Blue Fish' can be deconstructed as a searing indictment of the narrow-minded binary counting system. -- Peter van der Linden, Expert C Programming, Deep C Secrets + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help@lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 +
[analog-help] Counting multiple fields
For each page served, our webserver creates two cookies with unique IDs. One is persistent (to "identify" v***tors), and the other expires 30 minutes after the end of the last page requested (to "identify" v***ts). I need to count the number of individual instances for each cookie over a given period. By using the USERREPINCLUDE argument, I can get a Users report which tells me how many pages/requests/bytes have been accessed by one or the other of these, but that's not what I'm looking for. The only way I can do it at the moment is to run Analog twice (once for each cookie) and refer to the [not listed: XXX,XXX users] note at the end of each report. The output (values abbreviated for clarity) is: pages: user -: 1087: "idl_visitor=xxx; idl_visit=yyy" 686: "idl_visitor=xxx; idl_visit=yyy" 679: "idl_visitor=xxx; idl_visit=yyy" 679: "idl_visitor=xxx; idl_visit=yyy" 674: "idl_visitor=xxx; idl_visit=yyy" 660: "idl_visitor=xxx; idl_visit=yyy" 640: "idl_visitor=xxx; idl_visit=yyy" 636: "idl_visitor=xxx; idl_visit=yyy" 607: "idl_visitor=xxx; idl_visit=yyy" 584: "idl_visitor=xxx; idl_visit=yyy" 69725: [not listed: 110,732 users] What I'd like is something like: instances: user -: 123087: idl_visitor 834586: idl_visit So, two questions: 1. How can I count the number of instances of a cookie? 2. How can I run Analog once and get the same report twice with two different *INCLUDE values? many thanks, Adam This e-mail is confidential and is intended to be read by the addressee only. If you have received it in error, please notify us at once by return e-mail or by telephone on 020 7005 2000. You should then delete this e-mail and any copies of it from your computer system. Any reproduction, publication, copying, modification, distribution or other dissemination or use of this communication is strictly prohibited. The Company does not accept any liability for opinions, advice or views contained in this e-mail. Please note that Independent News & Media Group does not enter into any form of contract by email. No one is authorised to enter into contracts on behalf of the Company in this way. All contracts to which the Independent News & Media Group is a party to, are to be documented by other means. Any part of this e-mail, which is of a purely personal nature is unauthorised by the Company, and the Company specifically disclaims any liability for any e-mails which are defamatory, racist, offensive, or in breach of any person's rights. All e-mail passing through the Company's e-mail systems may be subject to monitoring. The Company accepts no liability for errors or viruses. This email has been scanned for all viruses by the MessageLabs SkyScan service. For more information on a proactive anti-virus service working around the clock, around the globe, visit http://www.messagelabs.com + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help@lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 +
[analog-help] Analyzing multiple log files on Macintosh
Hello, I'm a beginner wih Analog. I'm trynig to configure Analog 5.22 to analyze log files in a directory. I'm on MacOs X.1.3. In the config file, I've wrote : LOGFILE "Philippe B.:Analog:Logs:*" but when I run Analog, it says : analog: Warning F: Cannot open directory Philippe B.:Analog:Logs:: won't expand wildcards Philippe B.:Analog:Logs:* What does it means ?? Does I use another wildcard ?? Thanks for your response, Best regards. Philippe BARRIELLE Sce Informatique --- * S.A. Editions et Publicites - ABRITEL * 109, La Canebière - B.P 2033 - 13201 Marseille cedex 01 - France Tél : 33 (0)4 91 11 00 72 Wap : http://wap.abritel.fr Email: [EMAIL PROTECTED] Web : http://www.abritel.fr --- LOCATIONS VACANCES - FRANCE - SPAIN - DOM - PORTUGAL --- + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help@lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 +
RE: [analog-help] Problem reading cookie information from IIS logs
Thanks for the reply - I have actually just downloaded v5.22, tweaked a few fields and everything seems to be working! :) Maff -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Aengus Sent: 22 March 2002 10:40 To: [EMAIL PROTECTED] Subject: Re: [analog-help] Problem reading cookie information from IIS logs "Maff Rigby" <[EMAIL PROTECTED]> wrote: > I am trying to read information stored in cookies from IIS5 logs. I > understand the best way to do this is to use a customised LOGFORMAT command > in the cfg file, feeding the cookie information into the USER alias. > > My problem is I can't seem to get the correct LOGFORMAT. > > A typical entry would be: > > 2002-03-05 00:30:40 66.98.79.27 - W3SVC3 SERVER1 000.000.00.000 80 GET > includes/myfile.js - 200 2994 488 734 > Mozilla/4.0+(compatible;+MSIE+5.0;+Windows+98;+DigExt) > Enabled=true;+fact=user=&language=&location=site&id=32&config=112;+clients et > tings=1=YES;+ASPSESSIONIDGCOU=JJJLABHEFONERDEWRIOD;+font=Pull=1&Push=7 > htp://od2.com/home/index.asp > > and the LOGFORMAT I am using is > > LOGFORMAT (%Y-%m-%d %h:%n:%j %s - %j %j %j %j %j %r - %c %b %j %j %j %u %f) That LOGFORMAT parses that sample line. What problems are you having with it? Aengus + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help@lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 + + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help@lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 +
Re: [analog-help] Problem reading cookie information from IIS logs
"Maff Rigby" <[EMAIL PROTECTED]> wrote: > I am trying to read information stored in cookies from IIS5 logs. I > understand the best way to do this is to use a customised LOGFORMAT command > in the cfg file, feeding the cookie information into the USER alias. > > My problem is I can't seem to get the correct LOGFORMAT. > > A typical entry would be: > > 2002-03-05 00:30:40 66.98.79.27 - W3SVC3 SERVER1 000.000.00.000 80 GET > includes/myfile.js - 200 2994 488 734 > Mozilla/4.0+(compatible;+MSIE+5.0;+Windows+98;+DigExt) > Enabled=true;+fact=user=&language=&location=site&id=32&config=112;+clients et > tings=1=YES;+ASPSESSIONIDGCOU=JJJLABHEFONERDEWRIOD;+font=Pull=1&Push=7 > htp://od2.com/home/index.asp > > and the LOGFORMAT I am using is > > LOGFORMAT (%Y-%m-%d %h:%n:%j %s - %j %j %j %j %j %r - %c %b %j %j %j %u %f) That LOGFORMAT parses that sample line. What problems are you having with it? Aengus + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help@lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 +
[analog-help] Problem reading cookie information from IIS logs
Hi, I am trying to read information stored in cookies from IIS5 logs. I understand the best way to do this is to use a customised LOGFORMAT command in the cfg file, feeding the cookie information into the USER alias. My problem is I can't seem to get the correct LOGFORMAT. A typical entry would be: 2002-03-05 00:30:40 66.98.79.27 - W3SVC3 SERVER1 000.000.00.000 80 GET includes/myfile.js - 200 2994 488 734 Mozilla/4.0+(compatible;+MSIE+5.0;+Windows+98;+DigExt) Enabled=true;+fact=user=&language=&location=site&id=32&config=112;+clientset tings=1=YES;+ASPSESSIONIDGCOU=JJJLABHEFONERDEWRIOD;+font=Pull=1&Push=7 htp://od2.com/home/index.asp and the LOGFORMAT I am using is LOGFORMAT (%Y-%m-%d %h:%n:%j %s - %j %j %j %j %j %r - %c %b %j %j %j %u %f) I understand there is alot of junk in this, but I have been trying to get only the cookie information. Thanks in advance, Maff + | This is the analog-help mailing list. To unsubscribe from this | mailing list, go to |http://lists.isite.net/listgate/analog-help/unsubscribe.html | | List archives are available at |http://www.mail-archive.com/analog-help@lists.isite.net/ |http://lists.isite.net/listgate/analog-help/archives/ |http://www.tallylist.com/archives/index.cfm/mlist.7 +
