Re: [analog-help] IIS 6.0 Analog
Shiring, Nancy [EMAIL PROTECTED] wrote: I think it's working. I turned on the Bytes Sent but still get the warning. Your old logfiles, and any entries in todays logfile before you changed the server configuration, are still missing the byte information, so Analog will still give that warning if you include any of those logs in your analysis. It's just a warning, though, so as long as you are aware of the circumstances, and expect there to be missing byte information, that's ok. If you tried to do an analysis of a logfile next week, and you still got the warning, that would give you an indication that you might be inadvertantly including log files that you didn't intend to, which is why Analog puts out the warning. So my stats are accurate?? Presumably, and within the limit's that any log analysis has. (http://www.analog.cx/docs/webworks.html) Aengus + | TO UNSUBSCRIBE from this list: |http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +
Re: [analog-help] IE not running Perl
Rajamanickam S. [EMAIL PROTECTED] wrote: It works fine with firefox as the server understands perl being called and runs them to show the output. But, it is not working with Internet Explorer as it pops the save/download window. That sounds like a problem with MIME types. I'd suggest using a command line tool line like wget or curl to see the full headers being returned by the web server - the web browser uses that information to decide how to handle the response. Aengus + | TO UNSUBSCRIBE from this list: |http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +
Re: [analog-help] corrupt files
On Tuesday, July 31, 2007 7:33 AM [EDT], Aimee Mandeville [EMAIL PROTECTED] wrote: Thanks for the clarification on that. Do you have any thoughts as to why Analog is having difficulty parsing these lines? I've attached a sample of the CORRUPT lines. The log file I am analyzing has 69,989 lines and 65,634 of them are corrupt. I am using the following format: LOGFORMAT (#%j) LOGFORMAT (%S\t%u\t%B\t%Y-%m-%d\t%h:%n:%j\t%j\t%j\t%j\t%j\t%j\t%j\t%j\t%b\t%j\t%j\ t%r\t%j\t%c\twww.usawaterquality.org\t%j) You haven't provided any examples of the lines that Analog considers corrupt, but at a guess, they don't have www.usawaterquality.org in them. If you enable debugging (DEBUG ON), Analog will generate output that will indicate where the line stops matching th LOGFORMAT Analog expected to find. Aengus + | TO UNSUBSCRIBE from this list: |http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +
Re: [analog-help] Entity 'nbsp' not defined
On Friday, August 03, 2007 8:38 AM [EDT], Walter Ian Kaye [EMAIL PROTECTED] wrote: Um... what causes this? A buggy browser? Aengus + | TO UNSUBSCRIBE from this list: |http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +
Re: [analog-help] Re: Entity 'nbsp' not defined
Walter Ian Kaye [EMAIL PROTECTED] wrote: The xhtml emperor is naked. I hereby request real HTML output. http://www.analog.cx/docs/output.html#outstyle Aengus + | TO UNSUBSCRIBE from this list: |http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +
Re: [analog-help] Re: Entity 'nbsp' not defined
Paul Wade [EMAIL PROTECTED] wrote: Hey Jeremy, Thanks for the tutorial. However, I must take issue since I think that nbsp; IS a named entity in both the HTML 4.0 and XHTML 1.0 standards. I can certainly validate it via the usual suspects, without resorting to the numeric entity and using XHTML 1.0 Transitional. However, I WAS also wondering whether this might work better with a more forgiving browser, such as IE. Also I was wondering whether somewhere this is all being delivered as application/xhtml+xml instead of text/xml and maybe this accounts for something? Which is why it's important to know who or what is generating the actual error message. If the data that is received at the client includes the error text, then the problem is occurring on the web server. If the browser is generating the error message, and a different browser doesn't, then you're into angels on a pinhead territory. Aengus + | TO UNSUBSCRIBE from this list: |http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +
Re: [analog-help] Re: Entity 'nbsp' not defined
Walter Ian Kaye [EMAIL PROTECTED] wrote: At 12:14 p -0400 08/03/2007, Aengus didst inscribe upon an electronic papyrus: Walter Ian Kaye [EMAIL PROTECTED] wrote: The xhtml emperor is naked. I hereby request real HTML output. http://www.analog.cx/docs/output.html#outstyle HTML 2.0? No tables/styles? Why no 3.2 or 4.0? I would like the same output as the XHTML version, but in HTML. There are no tables in an Analog report. The XHTML output generated by Analog validates with This Page Is Valid XHTML 1.0 Strict! at http://validator.w3.org/. If your browser won't render the output, it's a problem with your browser, not with Analogs output. After a day of back and forth on this, you still haven't told us what web server you're using, or whether you see the same errors when you use a different browser. As anlgform.pl just calls Analog itself to generate the output, and it seems unlikely that you're suddenly stumbling on an issue with displaying the output from Analog, it seems much more likely that your web server is modifying the response from Analog before it delivers it to your browser. But if you can't be bothered providing the basic information that other people need to do your troubleshooting for you, there isn't much point in any of us wasting our time guessing at what the problem might be. Aengus + | TO UNSUBSCRIBE from this list: |http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +
Re: [analog-help] using cache files, REQUEST report too big
kevin creason [EMAIL PROTECTED] wrote: FILEALIAS *?* $1 ARGSEXCLUDE * but also notice that it is showing me a different query_string option from January and it shouldn't due to the FLOOR setting above. FAILARGSFLOOR 10r will show any argument that has more than 10 requests, even if the last one was in January. Aengus + | TO UNSUBSCRIBE from this list: |http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +
Re: [analog-help] Having a problem with analog on Aolserver
On Saturday, August 18, 2007 5:54 PM [EDT], Bill Millikin [EMAIL PROTECTED] wrote: LOGFORMAT (%S %j %u %j [%d/%M/%Y:%j:%j:%j] %j%w%r%wHTTP%j %c %b %f %B) LOGFORMAT (%S %j %u %j [%d/%M/%Y:%j:%j:%j] %j%w%r %c %b %f %B) LOGFORMAT (%S %j %u %j [%d/%M/%Y:%h:%n:%j] %j %c %b %f %B) All 3 of these LOGFORMATs end wth %B. Sample log line items: 65.40.137.57 - - [18/Aug/2007:17:44:13 -0400] GET /log/traffic.html HTTP/1.1 200 2589 Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.4) Gecko/20061201 Firefox/2.0.0.4 (Ubuntu-feisty) 0.348170 zenid=a97cfe3c133234f2d1e1128af0cdef91; ad_user_login=496%2c1187446621%2c066E5456E+%7b420+0+601F1A48C04E96D75B2419E0369B2DFAD842B01A%7d; user_session_id=526; ad_session_id=2170105%2c496%2c1+%7b972+1187474317+D9372F9AB742CF6DCFBAB7BA05BAF4C6C6E67E30%7d 65.40.137.57 - - [18/Aug/2007:17:44:14 -0400] GET /log/images/analogo.png HTTP/1.1 304 0 http://www.justunderthings.com/log/traffic.html; Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.4) Gecko/20061201 Firefox/2.0.0.4 (Ubuntu-feisty) 0.340890 zenid=a97cfe3c133234f2d1e1128af0cdef91; ad_user_login=496%2c1187446621%2c066E5456E+%7b420+0+601F1A48C04E96D75B2419E0369B2DFAD842B01A%7d; user_session_id=526; ad_session_id=2170105%2c496%2c1+%7b971+1187474653+EF6587D6CD3D448F659F7F52E3929E330951D134%7d 208.109.211.150 - - [18/Aug/2007:17:44:47 -0400] POST /blog/wp-trackback.php?p=17 HTTP/1.0 400 4873 TrackBack/1.02 0.700180 All 3 of these sample lines have stuff after the %B field - time taken and a cookie, probably. If you don't care about these fields, just add %j to the end of each of your LOGFORMAT lines, so that Analog will ignore them too. Aengus + | TO UNSUBSCRIBE from this list: |http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +
Re: [analog-help] changing user.png file name
On Tuesday, August 21, 2007 9:02 AM [EDT], Jeanne Ilchuk [EMAIL PROTECTED] wrote: Because I run a report every month and it's linked on a web site as a monthly report. At the end of the month, it's called (ie) 20070731.html and 20070731.png. I have a huge shell script that runs the report, gunzips the access*logs* and the LOGFILE I create. I use a perl script to get names into the user field in the log file. Everything was working but I had to manually change user.png to date.png inside the date.html file. If it's not broke, you don't need to fix it, but it sounds like you're doing a bunch of work that you don't need to do. Unless you need the usernames in the logfile for some other purpose, you could just use a list of USERALIAS commands, and then you wouldn't need to unzip the logs either, because Analog can handle compressed logfiles. I'm still not entirely sure that I understand what you were trying to do - I would have thought that LOCALCHARTDIR would have sufficed. It's main purpose is to allow you to add a prefix to the .png files, so that you can have multiple reports, but uniquely label the associated charts. Aengus + | TO UNSUBSCRIBE from this list: |http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +
Re: [analog-help] Date ranges in Analog
On Friday, August 24, 2007 8:34 AM [EDT], Martin O\\\'Shea [EMAIL PROTECTED] wrote: Hello I want to use Analog to process a range of dates where there is one log file for each date. The only way I can see to do this at at moment is to write each log file name to analog.cfg like this: LOGFILE C:\Program Files\Analog\analog 6.0 \Monolith2Test\monolith2_access_log.2007-08-08.txt LOGFILE C:\Program Files\Analog\analog 6.0 \Monolith2Test\monolith2_access_log.2007-08-09.txt and so on. Is there another way to do this at all? You could do LOGFILE *.txt use the FROM and TO commands to tell Analog to ignore data that falls outside the specified date range (Analog would read all of the logfiles), or you could write the necessary logic into the batch file that calls Analog. Unless your log files are etremely large (gigabytes each), I'd just go for the first method. If you're doing lots of reports, zipping the logfiles first will speed things up. Aengus + | TO UNSUBSCRIBE from this list: |http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +
Re: [analog-help] Unix time stamp (%U) has 13 characters
On Friday, August 24, 2007 8:23 AM [EDT], Sebastian Fromme [EMAIL PROTECTED] wrote: Hi Klaus, thanks for quick reply. Where I can do the customizing and how? It looks like parseunixtime() in input.c is where Analog parses %U. Aengus + | TO UNSUBSCRIBE from this list: |http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +
Re: [analog-help] Date ranges
Martin O'Shea [EMAIL PROTECTED] wrote: FROM 070808 TO 080809 As 080809 is still quite some time in the future, Analog will include all the logfiles after the FROM date until the 9th of August, 2008 (080809). Aengus + | TO UNSUBSCRIBE from this list: |http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +
Re: [analog-help] Request Report
On Thursday, August 30, 2007 8:53 AM [EDT], Han Dao [EMAIL PROTECTED] wrote: Please show me how can I display the Request Report at the end of the report. E.g. displays after General Summary, Daily report, File Type, etc... I tried to put the function at the end of the list of the but it did not work, it still display in the middle of the report. By default, the Request Report is the last report in analogs output. You can change the order that the reports appears by specifying the REPORTORDER command: http://analog.cx/docs/output.html#REPORTORDER If you're not getting a Request Report, it may be because of other conflicting commands that you've specified (eg REQFLOOR may be higher than the number of requests for any given item, or you may have specied only P in the REQCOLS, and not defined any PAGEs) Aengus + | TO UNSUBSCRIBE from this list: |http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +
Re: [analog-help] The next 'best' analyzer...?
On Friday, August 31, 2007 6:49 AM [EDT], Per Jessen [EMAIL PROTECTED] wrote: Eric Gorr wrote: Since Analog 6.0 is the last version, I was wondering if people had any opinion on what the next 'best' analyzer is or will be? I find it difficult to believe that no-one has picked up where Stephen left off - are there no developers on this list? I did some work (XML output) on analog myself about three years ago, but right now I just haven't got the time to get involved. There isn't really much of a learning curve - the package is just the source code and a Makefile. There's no SVN or autoconf to make things complicated :-) Even if an updated version couldn't be published at www.analog.cx, someone could still create a fork and publish that. Which comes first, the chicken or the egg? Do you start with a fork, or do you start with unmet needs? Most forks occur because someone needs an application to do something that it currently can't do. Analog has been user modified to meet minor needs, but the occasional calls for functionality that isn't in Analog (path tracking, or exit page reporting) aren't things that would necessarily fall out of the processing that Analog already does. Aengus + | TO UNSUBSCRIBE from this list: |http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +
Re: [analog-help] The next 'best' analyzer...?
Per Jessen [EMAIL PROTECTED] wrote: Per Jessen wrote: User-modifications are the first signs of a beginning fork. Why not a 6.01 release instead? Has anyone collected these user-mods into a combined patch? Found one: http://iddl.vt.edu/~jackie/analog/analog-6.01beta1.patch http://www.mail-archive.com/analog-help@lists.meer.net/msg03230.html Aengus + | TO UNSUBSCRIBE from this list: |http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +
Re: [analog-help] The next 'best' analyzer...?
Per Jessen [EMAIL PROTECTED] wrote: Aengus wrote: Analog has been user modified to meet minor needs, User-modifications are the first signs of a beginning fork. Why not a 6.01 release instead? Has anyone collected these user-mods into a combined patch? One of the core concepts behind Analog is it's cross platform funxtionality. Most of the user modifications that I recall coming up on this list are platform specific tweaks - to be honest, there haven't been many of them. The only other cross-platform modification that I recall is the one to add Windows Vista to the list of recognizes Windows variants. You already found a copy, and I've pointed to the list archives where I documented the process for Windows users to compile the change for themselves. but the occasional calls for functionality that isn't in Analog (path tracking, or exit page reporting) aren't things that would necessarily fall out of the processing that Analog already does. How about reporting on compression ratios, browser language settings and perhaps ssl settings? Maybe introducing autoconf into the build? (I think I did some work on that already). Improved default config with common browsers and robots preconfigured. (personally I also think the config syntax and semantics could do with an upgrade). There are a couple of syntactic quirks that, with hindsight, might be usefully reworked, but I'm not sure that the benefits of making FILEINCLUDE robots work the same way as FILEINCLUDE pages is enough to provide the momentum for a fork. A fork is not necessary, but as Stephen never did invite other maintainers/developers, it seems to be only way forward. I don't think Stephen was exactly beating down requests to join the development team! Analog is a pretty mature application, and most of the people with the skills to help focussed on helper apps, that enhance the functionality of Analog, without modifying Analog itself (Report Magic is probably the biggest, though the various DNS resolver tools are the other obvious area where potential functionality within Analog was sacrificed to maintain the maximum cross-platform compatibility. The very structure of Analog makes helper apps a good method to add functionality, without modifying Analog. This was Stephens response to why he didn't release an official patch to include Vista: http://lists.meer.net/pipermail/analog-help/2006-November/020028.html I certainly have no objection to a fork - I doubt that Stephen has. I'm just not sure that there's sufficient demand for a fork to maintain the necessary momentum. Aengus + | TO UNSUBSCRIBE from this list: |http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +
Re: [analog-help] Re: analog autoconf'ed ? (was: The next 'best'analyzer...?)
Per Jessen [EMAIL PROTECTED] wrote: Dimitri Maziuk wrote: Alright, then perhaps not autoconf itself, but the general edit the header file configuration method is a little dated, so some kind of assisted config tool would come in handy. My take on it, if one can't edit the defines in Makefile/header file, then one probably won't be able to create a usable analog config file either. Or apache config file -- so that person probably shouldn't try to run a webserver anyway. autoconf is used by 99.9% of the software I use. That alone seems to be a strong indication of its distinct advantages over hand-editing a pile of header files. If it was up to me, analog-7.0 would be autoconf'ed. What exactly is it that you need to edit in Analog header files? Describing anlghead.h as a pile of header files sounds like sophistry to me. Aengus + | TO UNSUBSCRIBE from this list: |http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +
Re: [analog-help] Dates Out Of Range In Request Report Generated FromCache File
On Monday, September 03, 2007 10:43 AM [EDT], [EMAIL PROTECTED] [EMAIL PROTECTED] wrote: However, after a month I spotted the following (mis)behaviour: Dates out of the specified range (defined by FROM and TO) appeared in the requests of the monthly HTML output, e.g. an entry for Aug-27 in the 2007- 09.html file. The header of the file, however, shows the correct date range, e.g. Analysed requests from Sat-01-Sep-2007 00:00 to Mon-03-Sep-2007 04:02 (2.17 days). Did I miss anything to make the request report respect the given date range or is this result intentional? I would be very happy to receive some help in this issue since I really don't have any clue how to proceed. You can't apply a FROM/TO filter to a cache file after you create it - the whole point of a cache file is that you've discarded a bunch of infomation, such as the time that each individual request was made, so the information that you need to filter out requests that occur between the FROM and TO times isn't in the cache file. The documentation for cache files mentions this at both the start and the end of the page: If you are going to use the cache file feature, it is also very important that you understand what is and what is not recorded. The summary is that all INCLUDE and EXCLUDE commands, including FROM and TO, and any ALIASes and LOGTIMEOFFSETs, must be applied when you create the cache file, not when you read it later. As explained above, all INCLUDE and EXCLUDE commands, including FROM and TO, and any ALIASes and LOGTIMEOFFSETs, must be applied when you create the cache file, not when you read it later. http://analog.cx/docs/cache.html Personally, my recommendation is that if your report layout and design hasn't been 100% static for at least 6 months, stay away from cache files. And even if your layout has been static for that long, unless you're dealing with gigabytes per day of log files, cache files are more trouble than they're worth. + | TO UNSUBSCRIBE from this list: |http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +
Re: [analog-help] Dates Out Of Range In Request ReportGeneratedFromCache File
On Monday, September 03, 2007 11:41 AM [EDT], [EMAIL PROTECTED] [EMAIL PROTECTED] wrote: Not wanting to say you are not right here, too; just wondering where the date information might come from. Is it still in the cache file, at least partially? Analog does record some time information - how many requests occurred in every 5 minute period, for example. But it doesn't record which requests occurred within any given 5 minute (or any other) period. So you can use your cache file for September to find out that X number of requests occurred on the 17th of September, for example. But you can't tell how many of those requests were for a specific file. Any Request Report that you generate from a cache file, using parameters that don't exactly match the parameters used to create the cache file will probably contain incorrect and or misleading information. A Gig of logfiles per day will easly compress to 20Gig per year. That's a decades worth of log files on a $100 hard drive. There rally isn't much point in discarding logfiles, unless they are so large that you encounter computational bounds. Aengus + | TO UNSUBSCRIBE from this list: |http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +
Re: [analog-help] LogFormat nightmare.
On Tuesday, September 04, 2007 7:16 AM [EDT],
Kevin Band [EMAIL PROTECTED] wrote:
I have also tried
APACHELOGFORMAT (%h %l %u %t \%r\ %s %b \%{Referer}i\
\%{User-Agent}i\ (%T))
You're using () as a delimiter within the string, as well as around it. Try
APACHELOGFORMAT '%h %l %u %t \%r\ %s %b \%{Referer}i\
\%{User-Agent}i\ (%T)'
instead.
Aengus
+
| TO UNSUBSCRIBE from this list:
|http://lists.meer.net/mailman/listinfo/analog-help
|
| Analog Documentation: http://analog.cx/docs/Readme.html
| List archives: http://www.analog.cx/docs/mailing.html#listarchives
| Usenet version: news://news.gmane.org/gmane.comp.web.analog.general
+
Re: [analog-help] RE: LogFormat nightmare.
On Tuesday, September 04, 2007 7:47 AM [EDT], Kevin Band [EMAIL PROTECTED] wrote: Discovered that there isn't actually anything wrong with the LogFormat commands that I'm specifying, the problem is that I'm trying to specify the LogFormat within a config file, but specify the log-file from the command line. If the config file doesn't contain a LogFile entry, then the LogFormat entry is ignored, even though the log file is provided in the command line. Is there any way around this ? DEFAULTLOGFORMAT or APACHEDEFAULTLOGFORMAT. http://analog.cx/docs/logfmt.html#DEFAULTLOGFORMAT. Aengus + | TO UNSUBSCRIBE from this list: |http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +
Re: [analog-help] Need Help w/ Apache Log
On Thursday, September 06, 2007 8:36 PM [EDT],
Raj Hungund [EMAIL PROTECTED] wrote:
Hey guys...I can't get even the most simplest of log analysis working
for Apache/Analog
Here's my logformat:
LogFormat %h %v %u %t \%r\ %s %b \%{Referer}i\
\%{User-Agent}i\ %{EOL_GEO_COUNTRY}n %{EOL_GEO_REGION}n
%{EOLUSERID}n combined
75.32.62.215 forums..com - [04/Sep/2007:00:00:39 -0700] GET
/style/style.jsp HTTP/1.1 200 49170
http://forums..com/thread.jspa?messageID=12791910#12791910;
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; YPC 3.0.3)
US TX CTL4D9B11078F08418A7ADF39A5524ACB46
75.32.62.215 forums..com - [04/Sep/2007:00:00:42 -0700] GET
/recent-history.jspa?messageID=12791910 HTTP/1.1 200 1763
http://forums..com/thread.jspa?messageID=12791910#12791910;
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; YPC 3.0.3)
- - -
75.32.62.215 forums..com - [04/Sep/2007:00:00:42 -0700] GET
/resources/scripts/prototype/prototype.js HTTP/1.1 200 14503
http://forums..com/recent-history.jspa?messageID=12791910;
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; YPC 3.0.3)
- - -
I've tried to cut it down to just:
75.32.62.215
APACHELOGFORMAT (%s)
Is %s a valid marker in a httpd.conf LogFormat command? Shouldn't it be %h
in apache?
When I try:
75.32.62.215 forums..com
APACHELOGFORMAT (%h %v)
It kind of works.
Unless the logformat in your httpd.conf works out of the box you're better
off ignoring the APACHELOGFORMAT command, and just build an analog LOGFORMAT
from scratch.
LOGFORMAT (%s %v %j [%d/%M/%Y:%h:%n:%j] %j %r %j %c %b %f %B %j %j
%u)
matches your sample logfile lines, and treats the last field (%{EOLUSERID}n)
as the UserID field - the Geo fields are ignored.
Aengus
+
| TO UNSUBSCRIBE from this list:
|http://lists.meer.net/mailman/listinfo/analog-help
|
| Analog Documentation: http://analog.cx/docs/Readme.html
| List archives: http://www.analog.cx/docs/mailing.html#listarchives
| Usenet version: news://news.gmane.org/gmane.comp.web.analog.general
+
Re: [analog-help] need help
On Friday, September 07, 2007 8:27 AM [EDT], EMMA EMONET [EMAIL PROTECTED] wrote: kindly pls. help me. i have some computers which i link together in LAN for networking to gain access to the internet. i use analog proxy to share network on the computers but sometimes the other computers become slow or not even receiving network from the server. meanwhile the server computer has got network to access the web. pls put me through on what to do. Sorry, wrong list. The Analog proxy (AnalogX proxy?) is nothing to do with the Analog logfile analyser. Aengus + | TO UNSUBSCRIBE from this list: |http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +
Re: [analog-help] Excluding url parameters from results
On Friday, September 07, 2007 8:24 AM [EDT], Jenny Mitcham [EMAIL PROTECTED] wrote: Hi there, I am hoping someone can help me. I have looked long and hard at the documentation and can't find an answer to this question. In my request report I get lots of versions of the same page with different parameters attached to the url - for example: /catalogue/search/keyres.cfm?sn=21 /catalogue/search/keyres.cfm?sn=26 /catalogue/search/keyres.cfm?sn=31 /catalogue/search/keyres.cfm?sn=101 /catalogue/search/keyres.cfm?sn=41 /catalogue/search/keyres.cfm?sn=76 What I would like is to just have one entry in the stats for the page /catalogue/search/keyres.cfm. Is this possible? There are many more pages where we need to be able miss off the parameters - too many to list individually in the config file so I am hoping there is a command which will enable me to globally sort out this issue. ARGSEXCLUDE * will tell Analog to ignore the arguments for all pages. You can also set the REQARGSFLOOR high enough to exclude all but the busiest requests. http://analog.cx/docs/args.html Aengus + | TO UNSUBSCRIBE from this list: |http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +
Re: [analog-help] Combine IIS and Apache Logs
Raj Hungund [EMAIL PROTECTED] wrote: Hi all. We have a web report that analyzes IIS logs and we would like to include Apache logs into it. Analog will happily report on multiple logfiles in multiple formats. Is this possible or do I need to create a separate report? Currently we specify the logfile in the command line. If your logfiles are self documenting, (the logfiles contain header lines that define each of the fields, such as the W3C Extended logs produced by IIS6), then you shouldn't have any problems. If your logfiles aren't self documenting, but use a standard logformat that Analog recognizes automatically, then you probably won't have any problems either. If your logfiles require a custom LOGFORMAT, then you'll need to specify that before you tell Analog to use the Logfile. That can be a bit tricky on the command line. You might get away with adding a DEFAULTLOGFORMAT to the analog.cfg file, but you'll just have to try it and see whether errors it throws up if it doesn't work. Aengus + | TO UNSUBSCRIBE from this list: |http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +
Re: [analog-help] Analyze CSV File
Raj Hungund [EMAIL PROTECTED] wrote: I haven't tried it yet...just wondering if it could be done =) Should I just research custom logformatting? You could post an example of the actual data. But just at a wild guess LOGFORMAT (%j %y:%m:d %h:%n:%j %u %r %f %j %B) might work (though I have no idea how your PLAY_DATE and PLAY_TIME fields are laid out, so they probably won't match, and Analog might spit out the referrer and Borwser fields because they aren't formatted properly). Logformats are documented at http://analog.cx/docs/logfmt.html Aengus + | TO UNSUBSCRIBE from this list: |http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +
Re: [analog-help] Analyze CSV File
Raj Hungund [EMAIL PROTECTED] wrote: Here's the full string: REGION PLAY_DATE PLAY_TIME ACCOUNT_NUMBER MAC_ADDRESS PRODUCT PROVIDER ASSET_KEY TITLE AUSTIN 1-Jul-07 0:00:23 XX XXX ProductName X Some Title Which fields do you actually care about? Do you care about the Region? Do you need both Account Number and MAC address? What's the different between Product and Title? If I throw away the Region field, and use the Account number as the User field, the Product as the Virtual Host field, and the Title field as the Request field, I get something like this: Region: %j Play_Date: %d-%M-%y Play_Time: %h:%n:%j Account Number: %u MAC Address: %j Product: %v Provider: %j Asset_Key: %j Product Name: %r Your data is Tab delimited, which can make for a cluttered LOGFORMAT string, like this: LOGFORMAT (%j\t%d-%M-%y\t%h:%n:%j\t%u\t%j\t%v\t%j\t%j\t%r) If you turn on the User Report (USER ON) and the Virtual Host Report (VHOST ON), and set the appropriate floors, then you'll get something useful in the report. Add these commands USER ON VHOST ON VHOSTFLOOR 1r VHOSTSORTBY R REQFLOOR 1r Aengus Thanks! -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Aengus Sent: Monday, September 17, 2007 12:26 PM To: Support for analog web log analyzer Subject: Re: [analog-help] Analyze CSV File Raj Hungund wrote: I haven't tried it yet...just wondering if it could be done =) Should I just research custom logformatting? You could post an example of the actual data. But just at a wild guess LOGFORMAT (%j %y:%m:d %h:%n:%j %u %r %f %j %B) might work (though I have no idea how your PLAY_DATE and PLAY_TIME fields are laid out, so they probably won't match, and Analog might spit out the referrer and Borwser fields because they aren't formatted properly). Logformats are documented at http://analog.cx/docs/logfmt.html Aengus +--- +- TO UNSUBSCRIBE from this list: http://lists.meer.net/mailman/listinfo/analog-help Analog Documentation: http://analog.cx/docs/Readme.html List archives: http://www.analog.cx/docs/mailing.html#listarchives Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +--- +- + TO UNSUBSCRIBE from this list: http://lists.meer.net/mailman/listinfo/analog-help Analog Documentation: http://analog.cx/docs/Readme.html List archives: http://www.analog.cx/docs/mailing.html#listarchives Usenet version: news://news.gmane.org/gmane.comp.web.analog.general + + | TO UNSUBSCRIBE from this list: |http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +
Re: [analog-help] Analyze CSV File
Aengus [EMAIL PROTECTED] wrote: Raj Hungund [EMAIL PROTECTED] wrote: Here's the full string: REGION PLAY_DATE PLAY_TIME ACCOUNT_NUMBER MAC_ADDRESS PRODUCT PROVIDER ASSET_KEY TITLE AUSTIN 1-Jul-07 0:00:23 XX XXX ProductName X Some Title Which fields do you actually care about? Do you care about the Region? Do you need both Account Number and MAC address? What's the different between Product and Title? If I throw away the Region field, and use the Account number as the User field, the Product as the Virtual Host field, and the Title field as the Request field, I get something like this: Region: %j You can report on the Regions as well by using the Browser report. Use %B instead of %j Play_Date: %d-%M-%y Play_Time: %h:%n:%j Account Number: %u MAC Address: %j Product: %v Provider: %j Asset_Key: %j Product Name: %r Add these lines to your analog.cfg: LOGFORMAT (REGION%j) LOGFORMAT (%B\t%d-%M-%y\t%h:%n:%j\t%u\t%j\t%v\t%j\t%j\t%r) LOGFILE cvs.log REQFLOOR 1r USER ON VHOST ON VHOSTFLOOR 1r VHOSTSORTBY requests ( I had this wrong in the original message) FULLBROWSER ON FULLBROWFLOOR 1r FULLBROWSORTBY requests You can turn off any reports that aren't useful. Analog.cx/docs/hierreps.html Analog.cx/docs/timereps.html Analog.cx/docs/othreps.html Aengus + | TO UNSUBSCRIBE from this list: |http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +
Re: [analog-help] How to include ProcTimeCols with weekly reports
On Saturday, September 22, 2007 4:45 AM [EDT], Gorgie.Melorgie [EMAIL PROTECTED] wrote: Hello all, I'm trying to figure out, how I can Analog 6.0 make me show weekly processing time stats. As I understand the documentation this can be done by adding PROCTIMECOLS to the WEEKCOLS line. So I tried WEEKCOLS BPRPROCTIMECOLS (the first 3 letters BPR for traffic, pages requests), but it doesn't work. I also tried several attributes with the Proctimecols line itself, only ending up with extra data shown for the last 7 days at best (this by adding SUM, so the line now is PROCTIMECOLS prsum). That should have thrown an unknown columns warning - u and m are not valid values for PROCTIMECOLS http://analog.cx/docs/othreps.html The Time reports (Yearly, Quarterly, Monthly, Weekly, Daily, Hourly and 5 Minutes) show periodic counts - the number of Requests, Page Requests or Bytes, or the percentage that those counts represent of the total counts. The Processing Time report is a non-Time report, because it's just keeping a count of the number of requests that match certain criteria - how many take between x and y milliseconds, how many between y and z milliseconds, etc. Non Time reports can show the totals for the last 7 days, as well as for the whole period, but Analog doesn't keep seperate totals for all of the intervening periods. How can I go on? If you want to get a Processing Time report for a specific eek, you'll have to have Analog rerun against just that weeks log files, and if you want the Processing Time Report for a series of weeks, you'll have to run Analog multiple times and create a series of separate reports. http://analog.cx/docs/faq.html#faq128 Aengus + | TO UNSUBSCRIBE from this list: |http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +
Re: [analog-help] Trouble locating duplicate fields
On Monday, September 24, 2007 8:14 AM [EDT],
Hunter John [EMAIL PROTECTED] wrote:
I'm trying to analyze Apache logs with the following format:
APACHELOGFORMAT (%h %l %u %t \%r\ %s %b \%{Referer}i\
\%{User-Agent}i\
\%{SSL_PROTOCOL}x:%{SSL_CIPHER}x:%{SSL_SESSION_ID}x\ %D %T
\%{Cookie}i\ %v)
Analog's debug tells me that one item occurs twice in the translated
format of:
LOGFORMAT (%S %j %u [%d/%M/%Y:%h:%n:%j] %j%w%r%wHTTP%j %c %b %f
%B %j:%j:%j %D %t %j %v)
The only thing that seemed to be duplicated were the %D and %t fields
so I replaced %t with %j and re-ran with the new LOGFORMAT. Analog
now runs but the error file soon starts to fill up and every single
line of the log is marked as corrupt. No matter what I try I don't
seem to be able to read these logs.
Can anyone tell me what I'm doing wrong please?
If you set DEBUG ON, Analog will print a line with an asterisk under the
first element of the logfile entry that it can't match to the LOGFORMAT.
Or you can post 2 or 3 sample lines here.
Aengus
+
| TO UNSUBSCRIBE from this list:
|http://lists.meer.net/mailman/listinfo/analog-help
|
| Analog Documentation: http://analog.cx/docs/Readme.html
| List archives: http://www.analog.cx/docs/mailing.html#listarchives
| Usenet version: news://news.gmane.org/gmane.comp.web.analog.general
+
Re: [analog-help] Problem with Apache 2 logfile?
Charlie Clark [EMAIL PROTECTED] wrote:
Hi,
I've got a couple of sites running with apache's combined logformat:
LogFormat %h %l %u %t \%r\ %s %b \%{Referer}i\
\%{User-Agent}i\
Analog is complaining about these at the referrer:
C: 66.249.66.76 - - [04/Jul/2007:21:10:50 +0200] GET /robots.txt
HTTP/1.1 404 3871 - Mozilla/5.0 (compatible; Googlebot/2.1;
+http://www.google.com/bot.html)
C:
*
The lines look to have the identical format to ones from another
server which doesn't raise the error:
74.6.66.46 - - [03/Aug/2007:17:35:19 +0200] GET /robots.txt HTTP/
1.0 200 123 - Mozilla/5.0 (compatible; Yahoo! Slurp; http://
help.yahoo.com/help/us/ysearch/slurp)
It may just be my eyes but can anyone see what's wrong?
I can't replicate your error. Using this APACHELOGFORMAT string:
APACHELogFormat (%h %l %u %t \%r\ %s %b \%{Referer}i\
\%{User-Agent}i\)
I get this result:
S: Successful requests: 1
S: Redirected requests: 0
S: Failed requests: 1
S: Requests returning informational status code: 0
S: Status code not given: 0
S: Unwanted lines: 0
How come Googlebot gets a 404 when it requests robots.txt, but Yahoo!
Slurp gets a 200?
Aengus
+
| TO UNSUBSCRIBE from this list:
|http://lists.meer.net/mailman/listinfo/analog-help
|
| Analog Documentation: http://analog.cx/docs/Readme.html
| List archives: http://www.analog.cx/docs/mailing.html#listarchives
| Usenet version: news://news.gmane.org/gmane.comp.web.analog.general
+
Re: [analog-help] Problem with Apache 2 logfile?
Charlie Clark [EMAIL PROTECTED] wrote:
Am 26.09.2007 um 23:33 schrieb Aengus:
I can't replicate your error. Using this APACHELOGFORMAT string:
APACHELogFormat (%h %l %u %t \%r\ %s %b \%{Referer}i\
\%{User-Agent}i\)
I get this result:
S: Successful requests: 1
S: Redirected requests: 0
S: Failed requests: 1
S: Requests returning informational status code: 0
S: Status code not given: 0
S: Unwanted lines: 0
Weird. I'm getting the same errors with logfiles from three different
virtual servers on two different machines!
S: Corrupt lines: 14757
Have you tried it with an explicit LOGFORMAT?
LOGFORMAT (%S %j %u [%d/%M/%Y:%h:%n:%j] %j %r %j %c %b %f %B)
(Or even with no LOGFORMAT specified - it's a bog standard layout that
Analog will recognize anyway).
Aengus
+
| TO UNSUBSCRIBE from this list:
|http://lists.meer.net/mailman/listinfo/analog-help
|
| Analog Documentation: http://analog.cx/docs/Readme.html
| List archives: http://www.analog.cx/docs/mailing.html#listarchives
| Usenet version: news://news.gmane.org/gmane.comp.web.analog.general
+
Re: [analog-help] LOGFORMAT Command - Help
Dan Agnew [EMAIL PROTECTED] wrote: LOGFORMAT (%S : [%d/%M/%Y:%h:%n:%j %j] %s - - %j %r %j %c %b %f %b) LOGFILE C:\user\logfiles\ex070926.log OUTFILE C:\user\analog\reports\Report.html HOSTNAME [MyHost] When analog runs I get the following warning – “Warning F: Can't auto-detect format of logfile C:\user\logfiles\ex070926.log: ignoring it” een though I’ve tried to specifiy a logformt command. I also get the following warning - analog: Warning C: Bad argument in configuration command: ignoring it: LOGFORMAT (%S : [%d/%M/%Y:%h:%n:%j %j] %s - - %j %r %j %c %b %f %b) analog: ...cont..: (reason: one item occurs twice in format) You have %b twice in your logfile - that last field should be %B, not %b. You also have some extraneous spaces in your LOGFORMAT - try this instead: LOGFORMAT (%S: [%d/%M/%Y:%h:%n:%j %j] %s - - %j %r %j %c %b %f %B) I'd also guess that the first %S should really be %v. Aengus + | TO UNSUBSCRIBE from this list: |http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +
Re: [analog-help] robots and requests
Aimee Mandeville [EMAIL PROTECTED] wrote: I have run Analog on my log files and in looking at the data I have noticed that many of my requests are coming from Robots, spiders, crawlers etc. I have figured out how to exclude these from the various reports using the HOSTREPEXCLUDE, DOMEXCLUDE and ORGEXCLUDE. I would like to know if these are still getting counted and reported as REQUESTS in my request report. HOSTREPEXCLUDE means that the requests are just excluded from the Host Report, and they are included in all the other reports. Use HOSTEXCLUDE if you want to exclude a Host entirely. DOMEXCLUDE and ORGEXCLUDE will exclude any matching requests completely. If you are logging Browser strings, then you should be able to use the ROBOTINCLUDE command to define any browser strings as Robots, so that you can get a count of them in the OS Report. Then you can tell whether you're excluding them all or not by checking the number of Unwanted logfile entries listed in the General Summary. Better yet, if you are logging Browser Strings anyway, use the list at http://www.wadsack.com/robot-list.html to get a list on known robots. Search/Replace ROBOTINCLUDE with BROWEXCLUDE to exclude all of those requests completely from your logfile analysis. Aengus + | TO UNSUBSCRIBE from this list: |http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +
Re: [analog-help] how to insert a new line
On Thursday, September 27, 2007 8:16 PM [EDT], Aengus [EMAIL PROTECTED] wrote: On Thursday, September 27, 2007 7:36 PM [EDT], linda x [EMAIL PROTECTED] wrote: Hi, I would like to insert a new line between the LOGO and Web Server Statistics for I wonder how I can do that. Edit your Language file (by default it's lang\uk.lng) and insert br at the start of the line that says Web Server Statistics for. I just noticed that that wil also display the br in the title bar of your web browser. Aengus + | TO UNSUBSCRIBE from this list: |http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +
Re: [analog-help] how to insert a new line
On Thursday, September 27, 2007 7:36 PM [EDT], linda x [EMAIL PROTECTED] wrote: Hi, I would like to insert a new line between the LOGO and Web Server Statistics for I wonder how I can do that. Edit your Language file (by default it's lang\uk.lng) and insert br at the start of the line that says Web Server Statistics for. Aengus + | TO UNSUBSCRIBE from this list: |http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +
Re: [analog-help] how to insert a new line
On Monday, October 01, 2007 5:32 PM [EDT], linda x [EMAIL PROTECTED] wrote: Hi Aengus, Adding in front of Web Server Statistics.. works. Thank you so much! I also wonder how I can take out the last line This analysis was produced by analog 6.0. I just want to keep the web page as simple as possible. That line comes from the same file Aengus + | TO UNSUBSCRIBE from this list: |http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +
Re: [analog-help] how to insert a new line
linda x [EMAIL PROTECTED] wrote: Yes, I noticed that line in the same file. I tried to comment it out by adding ## in front of it. But I got an error when running analog. And it still shows in the web browser. The .lng files are lists of language specific strings. Analog is always going to put a string in at the end of the report. You can change the text of the string to anything you want, but you can't delete the line (or comment it out). So just take the text out, but leave the empty line there. Note that the line in the .lng file is This analysis was produced by. The word analog is hard coded - the least you can do is acknowledge the free software that you're using. Aengus + | TO UNSUBSCRIBE from this list: |http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +
Re: [analog-help] how to insert a new line
linda x [EMAIL PROTECTED] wrote: Hi Agenus, Thanks for the reply. I have another question, Hope this is the last one. In my Host Report part, I have all the IPs listed, from which my web site is accesses. I would like to use DNS name instead of IPs. Do you know how to do that? If the number of hosts is fairly small (up to a few hundred), you can just add these two lines to you analog.cfg file: DNSFILE dnscache DNS WRITE If you have any more than that, then you should use one of the DNS helper apps to generate the DNS cache file first. (Analog on its own can take 5-10 seconds per host to DNS lookups. A logfile with 100 addresses that takes a second or two to analyse with DNS off might take 3 or 4 minutes with Analog doing DNS lookups. A good DNS helpder can probably generate the DNS cache file in a couple of seconds). http://analog.cx/docs/dns.html http://www.analog.cx/helpers/#dns Aengus + | TO UNSUBSCRIBE from this list: |http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +
Re: [analog-help] log format conundrum
edward rikard-bell [EMAIL PROTECTED] wrote: I've configured the format for analog.cfg: (%v: [%d/%M/%y:%h:%n:%j %j] %s - - %j %r %j %c %b %f %B) C: whackmybush.com: [03/Oct/2007:16:18:32 +0100] 66.214.232.81 - - GET /rss.xml HTTP/1.1 200 19245 - iTunes/7.4.2 (Macintosh; N; Intel) C:* The * is under 2007. You have defind that field as %y (lowercase), which the documenattion says is year, last two digits. But your logfile has a 4 digit year, which is %Y (uppercase). LOGFORMAT (%v: [%d/%M/%Y:%h:%n:%j %j] %s - - %j %r %j %c %b %f %B) should do the job. http://analog.cx/docs/logfmt.html Aengus + | TO UNSUBSCRIBE from this list: |http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +
Re: [analog-help] Re: Ann: 6.0.3 Release
Paul Wade [EMAIL PROTECTED] wrote:
The data you've included looks like downloads of the updated Analog
from your site. As you'll see I didn't download using Vista x64, but
am running it on such as I said. I downloaded using a 32-bit OS on a
processor using the AMD64 architecture and you're correct there is no
record of this. However, I wonder what would happen if I were to
download again using a 64-bit OS? Since you might post details of my
IP and software environment I'm a little nervous about doing so,
despite my connection being proxied anyhow. As I say I have seen
other log analysers record the difference between x86 and x64
operating systems and I'd be surprised if Analog can't. That would be
a reason to switch if you're right!
A quick google for {compatible; MSIE 7.0; x64} suggests that IE 7
running on 64-bit Windows does indeed identify itself as a 64 bit client
Similar searches throw up log entries from IE6 on 64-bit Windows:
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; Win64; x64; SV1; .NET
CLR 2.0 Win64; x64; ...
And from Firefox:
Mozilla/5.0 (Windows; U; Windows NT 5.2 x64; en-US; rv:1.9a1)
Gecko/20060214 Firefox...
From a quick perusal of tree.c, the part of the Analog source code that
identifies the Windows version from the Browser string, you could
probably modify it to identify Windows XP and Windows XP64 as 2
different Operating systems:
if (*c == '5') {
if (*(c + 1) == '.' (*(c + 2) == '0'))
*name = Windows:Windows 2000;
else if (*(c + 1) == '.' (*(c + 2) == '1')) {
if (strstr(whole, x64) != NULL)
*name = Windows:Windows XP64;
else
*name = Windows:Windows XP;
}
etc, etc. (I don't have time to test this at the moment).
I just saw your other post as I was about to send this - MSIE 7.0;
Windows NT 6.0; WOW64; actually indicates that you're running the 32
bit version of IE7 in the 64 bit version of Windows Vista. WOW is the
Windows-on-Windows subsystem for running 32 bit applications on a 64 bit
platform. I think that Vista64 includes a 32 bit version of IE so that
32-bit ActiveX controls will work. There should be a link to launch the
64 bit version somewhere in the Start menu.
Aengus
+
| TO UNSUBSCRIBE from this list:
|http://lists.meer.net/mailman/listinfo/analog-help
|
| Analog Documentation: http://analog.cx/docs/Readme.html
| List archives: http://www.analog.cx/docs/mailing.html#listarchives
| Usenet version: news://news.gmane.org/gmane.comp.web.analog.general
+
Re: [analog-help] Re: Ann: 6.0.3 Release
Paul Wade [EMAIL PROTECTED] wrote: While Firefox and Opera (both 32-bit) are as you suggest, much less helpful. That depends on what you are looking for - does win32/win64 really matter if it's a 32-bit browser anyway. Or to put it another way, if you modified Analog to list Windows XP32 and Windows XP64 as seperate Operating systems (for example), which bucket would you put a 32 bit client running on XP64 into? Your web server is only communicating with the 32-bit part of the system, so it would make more sense to me to count that as a Win32 client. There is a 64-bit version of Firefox available - http://www.mozilla-x86-64.com/download.html. I'm not sure why the Mozilla team aren't producing their own 64-bit builds. Aengus + | TO UNSUBSCRIBE from this list: |http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +
Re: [analog-help] what's the command to set the starting time
On Tuesday, October 09, 2007 6:29 PM [EDT], linda x [EMAIL PROTECTED] wrote: Hello, I seem to remember there is a command to set the starting time for the report. I used from Tue-09-Oct-2007 14:00 but it doesn't work. Does anyone know the exact syntax? The FROM command is listed in the index to the documentation: http://analog.cx/docs/indx.html#F Aengus + | TO UNSUBSCRIBE from this list: |http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +
Re: [analog-help] need help creating report top 20 most visited pageson site
[EMAIL PROTECTED] wrote: We have the basic reports running. My client would like to see a report that shows the top 20 most visited pages on the site. How would I configure analog to show that output? Most visited pages is the Request Report. You only want to show the top 20, so set the floor to -20r (see http://analog.cx/docs/othreps.html#FLOOR) to get an Analog report that just shows the top 20 most visited pages, add these lines to your analog.cfg ALL OFF REQUEST ON REQSORTBY REQUESTS REQFLOOR -20r Aengus + | TO UNSUBSCRIBE from this list: |http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +
Re: [analog-help] need help creating report top 20 most visited pageson site
Aengus [EMAIL PROTECTED] wrote: [EMAIL PROTECTED] wrote: We have the basic reports running. My client would like to see a report that shows the top 20 most visited pages on the site. How would I configure analog to show that output? Most visited pages is the Request Report. You only want to show the top 20, so set the floor to -20r (see http://analog.cx/docs/othreps.html#FLOOR) to get an Analog report that just shows the top 20 most visited pages, add these lines to your analog.cfg ALL OFF REQUEST ON REQSORTBY REQUESTS REQFLOOR -20r Sorry - I should also have pointed out that this will actually report on whatever is most requested - probably images or stylesheets, unless you have excluded them from the report. This might be a better solution (change the PAGEINCLUDE line to include whatever you define as pages on your website ALL OFF PAGEINCLUDE *.htm,*.asp REQSORTBY PAGES REQCOLS NPp REQFLOOR -20p Aengus + | TO UNSUBSCRIBE from this list: |http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +
Re: [analog-help] Re: Ann: 6.0.3 Release
On Tuesday, October 09, 2007 3:53 PM [EDT],
Aengus [EMAIL PROTECTED] wrote:
if (*c == '5') {
if (*(c + 1) == '.' (*(c + 2) == '0'))
*name = Windows:Windows 2000;
else if (*(c + 1) == '.' (*(c + 2) == '1')) {
if (strstr(whole, x64) != NULL)
*name = Windows:Windows XP64;
else
*name = Windows:Windows XP;
}
etc, etc. (I don't have time to test this at the moment).
I can confirm that this code works. I recompiled Analog, tweaked some of the
browser strings in an existing logfile, and generated this OS Report:
Operating System Report
---
This report lists the operating systems used by visitors.
Listing operating systems, sorted by the number of requests for pages.
no.: reqs: pages: OS
---: : -: --
1: 84:13: Windows
: 81:10: Windows XP
:1: 1: Windows Vista64
:1: 1: Windows XP64
:1: 1: Windows Vista
2:2: 2: Known robots
This is the code that I modified in tree.c - it's slightly different from
what I posted above, and I only checked for XP64 and Vista64. I presume
there's a 64 bit version of 2003 server that shoud be checked for too, and
there's probably a more efficient way to do the check too.
if (*c == '5') {
if (*(c + 1) == '.' (*(c + 2) == '0'))
*name = Windows:Windows 2000;
else if (*(c + 1) == '.' (*(c + 2) == '1')) {
if (strstr(whole, ; x64;) != NULL)
*name = Windows:Windows XP64;
else
*name = Windows:Windows XP;
}
else if (*(c + 1) == '.' (*(c + 2) == '2'))
*name = Windows:Windows Server 2003;
else
*name = Windows:Unknown Windows;
}
else if (*c =='6') {
if (strstr(whole, ; x64;) != NULL)
*name = Windows:Windows Vista64;
else
*name = Windows:Windows Vista;
}
else if (*c = '7' *c = '9')
*name = Windows:Unknown Windows;
else
*name = Windows:Windows NT;
}
Aengus
+
| TO UNSUBSCRIBE from this list:
|http://lists.meer.net/mailman/listinfo/analog-help
|
| Analog Documentation: http://analog.cx/docs/Readme.html
| List archives: http://www.analog.cx/docs/mailing.html#listarchives
| Usenet version: news://news.gmane.org/gmane.comp.web.analog.general
+
Re: [analog-help] Re: Ann: 6.0.3 Release
On Wednesday, October 10, 2007 9:24 PM [EDT],
Aengus [EMAIL PROTECTED] wrote:
if (*c == '5') {
if (*(c + 1) == '.' (*(c + 2) == '0'))
*name = Windows:Windows 2000;
else if (*(c + 1) == '.' (*(c + 2) == '1')) {
if (strstr(whole, ; x64;) != NULL)
*name = Windows:Windows XP64;
else
*name = Windows:Windows XP;
}
else if (*(c + 1) == '.' (*(c + 2) == '2'))
*name = Windows:Windows Server 2003;
else
*name = Windows:Unknown Windows;
}
else if (*c =='6') {
if (strstr(whole, ; x64;) != NULL)
*name = Windows:Windows Vista64;
else
*name = Windows:Windows Vista;
}
else if (*c = '7' *c = '9')
*name = Windows:Unknown Windows;
else
*name = Windows:Windows NT;
}
I forgot to link to the instructions for compiling this on a Windows machine
to create your own modified executabe.
http://lists.meer.net/pipermail/analog-help/2007-January/020117.html
Aengus
+
| TO UNSUBSCRIBE from this list:
|http://lists.meer.net/mailman/listinfo/analog-help
|
| Analog Documentation: http://analog.cx/docs/Readme.html
| List archives: http://www.analog.cx/docs/mailing.html#listarchives
| Usenet version: news://news.gmane.org/gmane.comp.web.analog.general
+
Re: [analog-help] Re: Ann: 6.0.3 Release
Paul Wade [EMAIL PROTECTED] wrote: Aengus, Okay. I've fought my way through the code update and have recompiled Analog. I see no evidence of 64-bit operating systems in my latest logfile, which I know can't be right. I did the same with updating Chris' code and had the same result. Is your update just for 64-bit BROWSERS or am I being dumb? As a useful debugging tool, to make sure that you're using your I didn't have any current log files available when I tested the update, so I just modified an existing one, adding x64; to the browser string on a few lines. (My interpretation of the posts earlier this week was that that was the main difference between the XP/XP64 and Vista/Vista64 browser strings). I'll try it against some real log files tonight. (I also just noticed that the 64-bit firefox browser string that I identified from a google search wouldn't have been picked up by a search for ; x64;). It's not my intention to post a modified version of Analog - I just wanted to confirm that the change that I suggested would indeed allow you to count x64 browsers seperately from 32-bit browsers. But as you yourself confirmed, the x64 version of IE is currently unusable, and the x64 version of Firefox isn't exactly mainstream, it's quite likely that you don't have any 64-bit browsers in your logs. Note that my code doesn't check for the WOW64 identifier that would identify the 32-bit version on IE running on Vista 64. Aengus + | TO UNSUBSCRIBE from this list: |http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +
Re: [analog-help] Re: Ann: 6.0.3 Release
Chris Tilley [EMAIL PROTECTED] wrote: So, what is it you specifically need? A CPU Report? orA 64-bit Browser use Report? or A 64-bit Operating System Report And if a log analysis tool puports to accurately report a breakdown between Win32 and Win64 users when that information simply doesn't exist in the logfiles, how much faith can you put in the rest of it's statistics? Aengus + | TO UNSUBSCRIBE from this list: |http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +
Re: [analog-help] Re: Ann: 6.0.3 Release
Paul Wade [EMAIL PROTECTED] wrote: Chris Tilley [EMAIL PROTECTED] writes: My principal reservation... Hi Chris, Whether something is necessary or not doesn't mean to say it isn't a great feature to have. As I say I have seen a 64-bit OS report in another log analyser and it would be enough to get me (personally) to switch. I think we've just demonstrated that any log analysis that purports to give you that information is either lying, or doesn't know what it's talking about. If you're saying that you'd rather have information that you know to be inaccurate, even though you don't actually have any obvious use for it, rather than information that you know to be correct, I hope you'll be in a small minority! Aengus + | TO UNSUBSCRIBE from this list: |http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +
Re: [analog-help] Re: Ann: 6.0.3 Release
Paul Wade [EMAIL PROTECTED] wrote: Dimitri Maziuk [EMAIL PROTECTED] writes: So what exactly are you going to learn from 64-bit Browser use Report? -- Erm, how many people use 64-bit browsers? Short of just satisfying your curiosity, what purpose is achieved by knowing how many people use 64-bit browsers? That's a serious question - is it actually useful information, or is it just extraneous data? Aengus + | TO UNSUBSCRIBE from this list: |http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +
Re: [analog-help] Re: Ann: 6.0.3 Release
Chris Tilley [EMAIL PROTECTED] wrote:
Aengus,Exactly as I said to begin with.
Anyway, As a challenge I have attempted to build this both last night
and tonight using said 'more efficient method', and it doesn't
work.Having said that, I just tried your method 5 minutes ago and it
doesn't work either! Seems to be that this line doesn't work: if
(strstr(whole, x64) != NULL) as everything is returning 32-bit.
FWIW I am using real log data, not stylised info.Just for fun I
dropped a catch all x64 into the 'other' OS section and ran that
(knowing that there is a 64-bit IRIX in there. Nada. Unless I'm
screwing up somewhere further up the chain, the parameter 'whole'
doesn't contain the data.Chrishttp://camie.dyndns.org/
The whole(!) section of tree.c that breaks down the browser string
relies on the variable whole - line 832, for example.
The original piece that I posted off the top of my head, refered to
x64. The working code that I posted referred to ; x64;
If you replace lines 868-874 in trees.c with these lines:
if (strstr(whole, ; x64;) != NULL)
*name = Windows:Windows XP64;
else
*name = Windows:Windows XP;
}
else if (*(c + 1) == '.' (*(c + 2) == '2'))
*name = Windows:Windows Server 2003;
else
*name = Windows:Unknown Windows;
}
else if (*c =='6') {
if (strstr(whole, ; x64;) != NULL)
*name = Windows:Windows Vista64;
else
*name = Windows:Windows Vista;
}
else if (*c = '7' *c = '9')
and recompile, then your new copy of Analog should recognize browser
strings like these:
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; Win64; x64; .NET CLR
2.0.50727; SLCC1)
Aengus
+
| TO UNSUBSCRIBE from this list:
|http://lists.meer.net/mailman/listinfo/analog-help
|
| Analog Documentation: http://analog.cx/docs/Readme.html
| List archives: http://www.analog.cx/docs/mailing.html#listarchives
| Usenet version: news://news.gmane.org/gmane.comp.web.analog.general
+
Re: [analog-help] Re: Ann: 6.0.3 Release
Aengus [EMAIL PROTECTED] wrote:
If you replace lines 868-874 in trees.c with these lines:
if (strstr(whole, ; x64;) != NULL)
*name = Windows:Windows XP64;
else
*name = Windows:Windows XP;
}
else if (*(c + 1) == '.' (*(c + 2) == '2'))
*name = Windows:Windows Server 2003;
else
*name = Windows:Unknown Windows;
}
else if (*c =='6') {
if (strstr(whole, ; x64;) != NULL)
*name = Windows:Windows Vista64;
else
*name = Windows:Windows Vista;
}
else if (*c = '7' *c = '9')
and recompile, then your new copy of Analog should recognize browser
strings like these:
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; Win64; x64; .NET
CLR 2.0.50727; SLCC1)
Apparently, XP-64 identifies itself as NT 5.2, not 5.1, so the code
above wouldn't work for any real XP64 browser strings, but it should
work for Vista-64 browsers.
It's not imediately obvious whether to identify a 64-bit NT 5.2 browser
as Server 2003-64 or as XP-64!
These lines should replace lines 869-874 in the original tree.c:
else if (*(c + 1) == '.' (*(c + 2) == '2')) {
if (strstr(whole, ; x64;) != NULL)
*name = Windows:Windows XP64;
else
*name = Windows:Windows Server 2003;
}
else
*name = Windows:Unknown Windows;
}
else if (*c =='6') {
if (strstr(whole, ; x64;) != NULL)
*name = Windows:Windows Vista64;
else
*name = Windows:Windows Vista;
}
else if (*c = '7' *c = '9')
The next time someone wants changes made to the way browsers are
identified, I think he or she should provide the browser strings at
issue!
Aengus
+
| TO UNSUBSCRIBE from this list:
|http://lists.meer.net/mailman/listinfo/analog-help
|
| Analog Documentation: http://analog.cx/docs/Readme.html
| List archives: http://www.analog.cx/docs/mailing.html#listarchives
| Usenet version: news://news.gmane.org/gmane.comp.web.analog.general
+
Re: [analog-help] Re: Ann: 6.0.3 Release
On Friday, October 12, 2007 4:53 PM [EDT],
Aengus [EMAIL PROTECTED] wrote:
These lines should replace lines 869-874 in the original tree.c:
else if (*(c + 1) == '.' (*(c + 2) == '2')) {
if (strstr(whole, ; x64;) != NULL)
*name = Windows:Windows XP64;
else
*name = Windows:Windows Server 2003;
}
else
*name = Windows:Unknown Windows;
}
else if (*c =='6') {
if (strstr(whole, ; x64;) != NULL)
*name = Windows:Windows Vista64;
else
*name = Windows:Windows Vista;
}
else if (*c = '7' *c = '9')
Okay, I just downloaded the original source from analog.cx, replaced the
lines specified above, and compiled the changes.
Using this 3 line logfile:
1.2.3.4 - - [12/Oct/2007:01:25:02 +] GET / HTTP/1.1 200 16 -
Mozilla/5.0 (Windows; U; Windows NT 5.2 x64; en-US; rv:1.9a1)
Gecko/20060214 Firefox
1.2.3.4 - - [12/Oct/2007:01:25:02 +] GET / HTTP/1.1 200 16 -
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; Win64; x64; SV1; .NET
CLR 2.0.50727)
1.2.3.4 - - [12/Oct/2007:01:25:02 +] GET / HTTP/1.1 200 16 -
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; Win64; x64; .NET CLR
2.0.50727; SLCC1)
(I got these browser strings from google - I couldn't find any x64 users in
my own logs).
I got this OS Report:
no.: reqs: pages: OS
---: : -: --
1:3: 3: Windows
:1: 1: Windows Vista64
:1: 1: Windows Server 2003
:1: 1: Windows XP64
Note that I tested for the presence of ; x64; so the first string, from
the 64-bit version of Firefox, was not identified as running on an x64 OS,
but was identified as Windows Server 2003 (from the NT 5.2 part of the
string). As far as I know, there is no way to tell whether it was really
running on Windows Server 2003, or Windows XP64, and as far as I can tell,
it doesn't really make any difference.
I'm doing this as a purely academic exercise, and don't intend to distribute
the executable that I created.
Aengus
+
| TO UNSUBSCRIBE from this list:
|http://lists.meer.net/mailman/listinfo/analog-help
|
| Analog Documentation: http://analog.cx/docs/Readme.html
| List archives: http://www.analog.cx/docs/mailing.html#listarchives
| Usenet version: news://news.gmane.org/gmane.comp.web.analog.general
+
Re: [analog-help] IE not running Perl
On Monday, October 15, 2007 6:31 AM [EDT], Rajamanickam S. [EMAIL PROTECTED] wrote: Hi all I would like to raise this issue again but progressed a bit with a different approach. The problem that IE opens 'Unknown file type' dialog box to save/open the executed .pl file is (may be) because of the apache server returns with application/xhtml+xml content-type header. Have you tried adding OUTPUT HTML to your analog.cfg file, so that anlgform.pl doesn't produce XHTML output? Aengus + | TO UNSUBSCRIBE from this list: |http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +
Re: [analog-help] IE not running Perl
On Monday, October 15, 2007 6:43 AM [EDT], Charlie Clark [EMAIL PROTECTED] wrote: This has nothing to do with Analog. You should post to an Apache list. However, if I understand things correctly you shouldn't be using the rewrite module at all as you only need to set the mime type correctly to text/plain. The bigger question is why do you want .pl to display in the browser? Perl files are usually executable and handle their own headers. The problem is that a number of people have reported that when they set up the anlgform.pl script to allow the creation of on demand log analyses, when you click the Produce statistics button in IE, you are prompted to save the response, instead of it being displayed in the browser. Firefox dispays the output. Aengus + | TO UNSUBSCRIBE from this list: |http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +
Re: [analog-help] How does Analog count pdf file requests?
Dave Iltis [EMAIL PROTECTED] wrote: How does Analog count pdf file requests? Analog reports on what's in your log file. If a PDF reader makes multiple requests to your web server when reading a single document, then there will be multiple requests in your logfile, and Analog will reflect that. http://analog.cx/docs/faq.html#faq143 There's no surefire way to tell exactly how uses handled any given PDF file - some users will download the whole thing, generating a single request but only reading the first page, some will just read a couple of pages, generating a few different hits, some will read the whole thing, generating lots of requests in a single session. One thing that you can do is look at the Status Code report and see how many 206 status codes were recorded - these are Partial Content status codes, and in most cases are only seen on PDF requests (or more precisely, PDF files are the ones most likely to be associated with a 206 Status Code). That will give you some additional context for interpreting the numbers in your request report. Aengus + | TO UNSUBSCRIBE from this list: |http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +
Re: [analog-help] log file format
[EMAIL PROTECTED] wrote:
Hi,
I have looked for a solution on here but can't find anything tha
works. My log file looks like this below and I have added the format
from my httpd.conf file to the analog config but still it fails.
Can anyone help?
www.surrey.ac.uk 131.227.233.95 - - [07/Oct/2007:00:06:26
+0100] GET /SBMS/undergraduate/ HTTP/1.1 200
11252 http://www.surrey.ac.uk/SBMS/; Mozilla/4.0 (compatible; MSIE
7.0; Windows NT 6.0; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0;
.NET CLR 3.0.04506)
APACHELOGFORMAT (%v %h %l %u %t \%r\ %s %b \%{Referer}i\
\%{User-Agent}i\)
That APACHELOGFORMAT works with that sample logfile line for me:
S: Successful requests: 1
S: Redirected requests: 0
S: Failed requests: 0
S: Requests returning informational status code: 0
S: Status code not given: 0
S: Unwanted lines: 0
S: Corrupt lines: 0
S: Earliest entry in logfile: 7/Oct/07:0006
S: Latest entry in logfile: 7/Oct/07:0006
If you turn debugging on, what does Analog say about why it doesn't like
that line for you?
Aengus
+
| TO UNSUBSCRIBE from this list:
|http://lists.meer.net/mailman/listinfo/analog-help
|
| Analog Documentation: http://analog.cx/docs/Readme.html
| List archives: http://www.analog.cx/docs/mailing.html#listarchives
| Usenet version: news://news.gmane.org/gmane.comp.web.analog.general
+
Re: [analog-help] error_log files
Andrew Myers [EMAIL PROTECTED] wrote: I have a question about error_log files produced by my website host server. For some time now I've been seeing these files and downloading them along with the usual access_log files that Analog analyzes. Does Analog have the ability to analyze the server error_log files? If not Analog, is there some other application that does? Is it worth checking into? I'm not talking about Analog's errors.txt file produced each time I run Analog. Do these server error_log files have more useful information or should I just ignore them, as I have been doing for well over a year now. Open the files in a text editor and read them - they're usually more text than data, and don't necessarily lend themselves to automatic analysis. Aengus + | TO UNSUBSCRIBE from this list: |http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +
Re: [analog-help] Questions re stats
On Monday, October 22, 2007 1:15 AM [EDT], Lydia Valeriano [EMAIL PROTECTED] wrote: HI there I use your software for reading web stats through Net Registry. I have a client who is analyzing her stats but does not seem to the 'redirection' report? How would she find these details (I.e. see movement throughout her site)? Turn on the Redirection report by adding REDIR ON to the analog.cfg file. Aengus + | TO UNSUBSCRIBE from this list: |http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +
Re: [analog-help] IE not running Perl
Rajamanickam S. [EMAIL PROTECTED] wrote: Many thanks Aengus. After adding the line OUTPUT HTML as you said, in to the analog.cfg, the report page now opens in IE. I just tried running anlgform.pl at the command line, and, with default settings, this is what the ouput looks like: C:\Analoganlgform.pl Content-Type: application/xhtml+xml; charset=ISO-8859-1 ?xml version=1.0 encoding=ISO-8859-1? ?xml-stylesheet href=#internalStyle type=text/css? !DOCTYPE html PUBLIC -//W3C//DTD XHTML 1.0 Strict//EN http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd; html xmlns=http://www.w3.org/1999/xhtml; head. If I modify the analog.cfg file to specify OUTPUT HTML, then the Content-Type: header is different: C:\Analoganlgform.pl Content-Type: text/html; charset=ISO-8859-1 !DOCTYPE HTML PUBLIC -//IETF//DTD HTML 2.0//EN html head The Content-Type: header is generated by Analog if CGI ON is set. It appears that IE6 doesn't recognize the application/xhtml+xml Mime type, (this appears to be widely known but not not explicitly documented anywhere). As far as I can tell, IE7 doesn't recognize it either. IE will display the XHTML pages that Analog produces - if it didn't, the issue would have been addressed a long time ago! But because IE doesn't know to do when it receives Content-Type: application/xhtml+xml from the web server, it prompts the users to save the file instead of displaying it. According to http://analog.cx/docs/whatsnew.html, XHTML has been the default output for Analog since March 2003 :-). There are a couple of different ways to deal with this problem. The simplest is to set OUTPUT HTML in the analog.cfg, which changes the output for everyone. A slightly better solution might be to modify anlgform.pl to set OUTPUT HTML when it is called from IE. A better solution would be for anlgform.pl to return Content-Type: text/html for IE browsers, while still generating the XHTML output. It shouldn't be too hard to do, but I can barely read perl, never mind write the stuff! Aengus + | TO UNSUBSCRIBE from this list: |http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +
Re: [analog-help] IE not running Perl
On Wednesday, October 24, 2007 7:18 PM [EDT], Jeremy Wadsack [EMAIL PROTECTED] wrote: You can't make this change in anlgform.pl - it's encoded into analog under the 'CGI' behavior. In fact, all anlgform.pl does is put a protective wrapper around Analog (as well as the form parsing) for CGI use. Also, to clarify Aengus's statement, I don't believe that adding a Content-type header output in anlgform.pl will help as Analog will still output it's own and I'm pretty certain that if more than one of the same header is read, browsers generally take the last one. You'll have to hack to source code to change this, or get into the web server and override it. I can't recall for certain, but IIS may have some ability to override headers from CGI's. The Content-type: header is generated by outxhtml.c (or outhtml.c or outplain.c, etc) , and it only generates it if Analog is called with CGI ON. If you modify anlgform.pl so that it doesn't set CGI ON, then analog will generate the output without the header. You can then generate the header in anlgform.pl. CGI ON mode also does some other important stuff though - it assumes that parameters entered through a web form are untrusted, and escapes some characters before using them, so this is an unsafe way to tackle the problem. Overriding the header at the server level isn't really a satisfactory solution either - unless you have a module that is smart enough to only over-ride it for IE browsers. IIS definitely provides support for filters that can do that sort of thing, but it's beyond my abilities, though it's a generic enough problem that someone might have written such a filter already. Aengus + | TO UNSUBSCRIBE from this list: |http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +
Re: [analog-help] half hour stats
Morgen Nilsson [EMAIL PROTECTED] wrote: Hello, Can Analog track the following things? If it can, please show me how if possible. Thank you... How many people are listening to an audio stream? Analog analyses log files, so it's not really effective for what's happening right this second use. How long they've listened for? Probably not. If each stream has a sessionID then you could generate a log showing when each sessionID started and when it ended, but there isn't an option to show the difference between these two times. (Web servers are stateless, streaming media servers aren't, so web-server log analysis tools don't typically measure some of the things that make sense for a streaming media server). Give reports of these every 30 minutes? Or maybe once per day but break the report into 30 minute intervals? You can generate a report showing how many requests occurred during each 5, 15 or 60 minute period, or how many streams. (depending on what your server logs, a single stream may generate multiple requests). Can it track file (podcast) downloads and only count the requests that were at least 60% completely downloaded? No, unless that information is explicitly in the logfile. How would Analog know that any given request was 60% downloaded? Any and all information about these questions will be extremely helpful, so I thank you in advance for any help you can provide. Analog is a pretty flexible tool, but you need to have a pretty detailed understanding of what your server is logging before you can figure out whether you can make Analog extract useful information from that data. It's not going to work out of the box for analysing logs that are fundamentally different than web server logs. While the logfiles may look similiar, the difference between stateful and stateless connections makes the job less than straightforward. Aengus + | TO UNSUBSCRIBE from this list: |http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +
Re: [analog-help] excluding a timespan in the middle of FROM, TO
janet ward [EMAIL PROTECTED] wrote: I want to exclude a part of the day from my day calculations (this seems to be the only way to remove a unidentifiable robot that went through during the time to be excluded). If it's unidentifiable, what makes you think it's a robot? Does it's IP address not identify it? I want to exclude from 11:45 to 11:51. The FROM and TO parameters appear only to allow me to exclude *before* 11:45 and *after* 11:51, whereas I want to exclude *after* 11:45 and *before* 11:51. Please would you advise? You can only have one set of TO/FROM, and the FROM time has to be before the TO time. If it was for more than a 6 minute window, you could try createing cache files for the 2 periods and combining them, but it seems that simply editing out the 6 minutes would be the simplest way to do what you're trying to do. Personally, I'd take a much closer look at the data in that 6 minute window. Turn on the Host report (HOST ON), and see if there's a single IP address generating the anomalous data. Then look for that address in the whole log (HOST INCLUDE w.x.y.z) and see if it only occurs in your 6 minute window. If it does, then exclude it (HOSTEXCLUDE w.x.y.z) Aengus + | TO UNSUBSCRIBE from this list: |http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +
Re: [analog-help] Log file problem
Mo Awkati [EMAIL PROTECTED] wrote: Hi I am new to using Analog and to the list. I have been having problems getting the stats from our church website. The setup is as follows: The website is hosted on a Linux server running LAMP. Below is an example of a line from the log file in use: stpeterskinver.org: [21/Oct/2007:01:53:29 +0100] 72.36.115.74 - - GET /robots.txt HTTP/1.0 404 204 - CazoodleBot/CazoodleBot-0.1 (CazoodleBot Crawler; http://www.cazoodle.com/cazoodlebot; [EMAIL PROTECTED]) No matter what LOGFORMAT I use I keep getting error messages about corrupt lines. I checked with the website host and they said the log file format is plain text and it has a .log extension. The log file is a plain text file with a .log extension, but that's not what logfile format means, as you appear to know, but your service provider doesn't :-(. The problem is that you have a standard logformat with an additional field at the start - the stpeterskinver.org: that your ISP is using to separate your logentries from everyone elses, but in a location that can't be recognized automatically. This LOGFORMAT matches the line you provided: LOGFORMAT (%v: [%d/%M/%Y:%h:%n:%j] %S %j %j %j %r %j %c %b %f %B) I am copying the log files from the ftp server and then using the LOGFILE to point to a folder in my home directory. I would also like the output to go to the same folder. You can tell Analog where to put it's output with the OUTFILE command, or +O command line parameter. But if you put it in a different location, you may need to set the IMAGEDIR and CHARTDIR and LOCALCHARTDIR settings too. Aengus + | TO UNSUBSCRIBE from this list: |http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +
Re: [analog-help] Dynamic or semi-dynamic sites
Walter Ian Kaye [EMAIL PROTECTED] wrote: So let's say I have a site where the section pages are static, and get logged by Apache in the normal way, while the various content pages (articles, etc) are served dynamically by script. Is there a way to wholistically present logs of everything to Analog, or is it better to have the static pages served by the same CMS script and make it do all the logging, thus ignoring Apache's native logging services and placing more load on the server? (Plus I wonder what happens if Apache is restarted while a script is writing a log file) If the script is logging the information in a manner that Analog can parse, then just have Analog run against both logs, FILEEXCLUDEing the script entries in the Apache log if necessary. Aengus + | TO UNSUBSCRIBE from this list: |http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +
Re: [analog-help] Organization Report shows only for 10.x network
Shedi Shedi [EMAIL PROTECTED] wrote: Hi all, After generating report the organisation section shows a report grouped only by 10.x network. I would like this report to show 10.a.x 10.b.x etc.. Could someone please point me how to achieve this? You should probably use the Domain report, with SUBDOMAIN 10.*.* http://analog.cx/docs/faq.html#faq148 SUBORG 10.*.* or SUBORG 10.*.*.* might do the job too. Aengus + | TO UNSUBSCRIBE from this list: |http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +
Re: [analog-help] Supressing my domain from Referrer Report
Darren Munt [EMAIL PROTECTED] wrote: I'm trying to suppress internal referrers from the Referrer Report. I've put the following lines in the config file: REFREPEXCLUDE http://mydomain.com.au/ REFSITEEXCLUDE http://mydomain.com.au/ However this doesn't suppress requests from mydomain.com.au from the report. Obviously I'm missing something but I can't see what? REFREPEXCLUDE http://mydomain.com.au/ will only exclude http://mydomain.com.au/ as a referrer. It won't exclude http://mydomain.com.au/index.html (for example). Try REFREPEXCLUDE http://mydomain.com.au/* REFSITEEXCLUDE http://mydomain.com.au/* Aengus + | TO UNSUBSCRIBE from this list: |http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +
Re: [analog-help] RE: display organisation name
Terri Saunders [EMAIL PROTECTED] wrote: I am using analog 6.0 Can you please tell me how to display the organisation name in the organisation report, rather than the number as shown below? http://analog.cx/docs/faq.html#faq140 By default, Analog doesn't resolve the IP addresses recorded in your logfile into DNS names. For a small log (up to a couple of hundred IP addresses), you can have Analog do the lookups by adding these two lines to your analog.cfg file: DNSFILE dnscache DNS WRITE Because DNS lookups are slow, an Analog report that runs in 2 or 3 seconds without doing DNS lookups might take 10 minutes or an hour with DNS lookups. (Running Analog against the same logfile a second time will be faster, because the DNS lookups will be cached in the dnscache file). There are a number of helper applications that can be used to create that DNS cache file. They are a lot faster than Analog at doing DNS lookups, so if you have more than a couple of hundred IP addresses to deal with, they may be worth the added complexity. Aengus + | TO UNSUBSCRIBE from this list: |http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +
Re: [analog-help] Supressing my domain from Referrer Report
Darren Munt [EMAIL PROTECTED] wrote: Try REFREPEXCLUDE http://mydomain.com.au/* REFSITEEXCLUDE http://mydomain.com.au/* Yes I tried that already to no avail - then I found the following in the readme: === All directory names end in slashes, so DIRINCLUDE and DIREXCLUDE, and REFSITEINCLUDE and REFSITEEXCLUDE, implicitly add a trailing slash even if you don't give one. This sometimes catches people out in the following situation. REFSITEEXCLUDE http://my.host.com/* # probably not what you want means not to list subdirectories of the referring site http://my.host.com/, but to keep the site itself in the list. To exclude the site completely, just use REFSITEEXCLUDE http://my.host.com/ === So I took the * out but no change. REFREPEXCLUDE http://www.mysite.com/* definitely works for me. My Referrer Report is significantly different with that line added, because there are hundreds of internal referrers removed from the Referrer Report. The * is necessary to match all the different refering pages on my site. REFSITEEXCLUDE http://www.mysite.com/ and REFSITEEXCLUDE http://www.mysite.com both have the same small effect on my Referring Site Report - the top line of the report (my own site is the top referring site) disappears. REFSITEEXCLUDE http://www.mysite.com/* doesn't work, because the * isn't part of the site name. REFSITEEXCLUDE only effects the Referring Site Report. REFREPEXCLUDE only effects the Referrer Report Aengus + | TO UNSUBSCRIBE from this list: |http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +
Re: [analog-help] Supressing my domain from Referrer Report
At Thursday, November 15, 2007 7:41 PM, Darren Munt [EMAIL PROTECTED] wrote: OK, so something weird is going on. Here are the top few lines of my config file: HOSTNAME www.mydomain.com.au HOSTURL http://www.mydomain.com.au/ HOSTALIAS REGEXP:^([^.]*)$ $1.mydomain.com.au HOSTEXCLUDE *.mydomain.com.au # REQINCLUDE pages REQLINKINCLUDE pages REFLINKINCLUDE * REDIRREFLINKINCLUDE * FAILREFLINKINCLUDE * REFREPEXCLUDE http://mydomain.com.au/* REFSITEEXCLUDE http://mydomain.com.au/* Is there perhaps something in one of the other lines that might be causing it? I've run it several times now, checked the dates on the config file vs the run date at the top of the report to make sure I'm looking at the refreshed version of the HTML file. For some reason, it is ignoring the REFREPEXCLUDE command. Also I'm using version 6.0 if that makes a difference. Post 4 lines from your logfile. If the Referrer field matches http://mydomain.com.au/*, then those referrers will not be listed in your Referrer Report. The log entries will still be included in your Request Report, and your Host Report, because REFREPEXCLUDE just excludes them from the Referrer Report - the actual log entries are still included for every other relevant report. REFSITEEXCLUDE http://mydomain.com.au/* won't work - you need to leave off the *. It will only change the Referring Site report - the log enties are still used for all the other relevant reports. Aengus + | TO UNSUBSCRIBE from this list: |http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +
Re: [analog-help] Supressing my domain from Referrer Report
At Thursday, November 15, 2007 11:11 PM, Darren Munt [EMAIL PROTECTED] wrote: I created a truncated log file with only the header lines and the four lines I posted. The only change I made to the config file was to use a single specific log file: LOGFILE C:\WINDOWS\system32\LogFiles\W3SVC921719038\logfile.log In place of: LOGFILE C:\WINDOWS\system32\LogFiles\W3SVC921719038\ex*.log When I ran the job, it produced a report that had suppressed www.turfmonthly.com.au from the referrer report: I don't know what to tell you - if it works properly on a test log file, and all you changed was the LOGFILE command in the analog.cfg file, then it should work for the main logfile. Aengus + | TO UNSUBSCRIBE from this list: |http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +
Re: [analog-help] RE: display organisation name
At Friday, November 16, 2007 2:21 AM, Shedi Shedi [EMAIL PROTECTED] wrote: How about name the ip for.e.g 10.10.x to ABC and 10.20 to XYZ without resorting to DNS Lookup? You can use HOSTALIAS to rename groups of IP addresses to a single hostname. I'm sure there's a way to construct a regular expression to rename a block of IP addresses to a single host name, but regular expressions aren't my forte, so someone else will have to provide that answer. Aengus + | TO UNSUBSCRIBE from this list: |http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +
Re: [analog-help] Very complex apache log format
At Friday, November 16, 2007 9:08 PM, Joshua S. Freeman
[EMAIL PROTECTED] wrote:
Hi,
I've read the Analog docs pretty closely. I've used Analog on and
off over the last 10 years and am always pleased to come back...
Here are the facts:
Httpd.conf logformat line:
LogFormat %h %l %u %t \(%r)\ %s %b \(ref %{Referer}i)\ \
\(client %{User-agent}i)\ \(elapsed %D)\ mainserver
What I put in my analog.cfg file:
APACHELOGFORMAT (%h %l %u %t \(%r)\ %s %b \(ref %{Referer}i)\
\(client %{User-agent}i)\ \(elapsed %D)\)
Which, as far as I can read, *should* work.. However, when I run
analog:
$ analog -G +g./analog.cfg -v
analog: analog version 6.0/Unix
analog: Warning C: Too many arguments for configuration command:
ignoring end of line starting:
APACHELOGFORMAT (%h %l %u %t \(%r) \
(For help on all errors and warnings, see docs/errors.html)
You're using () as a delimiter for your LOGFORMAT, even though you have ()
characters in the format string. Use a different delimiter, such as [].
APACHELOGFORMAT [%h %l %u %t \(%r)\ %s %b \(ref %{Referer}i)\
\(client %{User-agent}i)\ \(elapsed %D)\]
analog: Warning C: Ignoring long configuration line starting
# cuscon11608.tstt.net.tt - - [04/Nov/2007:00:00:06 -0400] (GET
/imag
You probably put a line from your logfile into the .cfg so you could
compare it to your LOGFORMAT.
analog: Warning M: Logfile /u/2/j/jf2412/logfiles/*.20071110
contains lines with no bytes: byte counts may be low
Many of the reports will report on the bytes transferred - if you're not
recording that information, Analog can't report on it.
I do see that the hosts.txt file I set up is getting bigger and
bigger so SOMETHING's happening..
Of course I won't know until the file is done being parsed, etc.. But
I'm concerned about this error... Is there ANYTHING you can suggest I
do to make analog happier with the apache logformat?
That sounds like you're having Analog do it's own DNS lookups. You really
need to look into some of the DNS Helper apps that will create the
hosts.txt file for you much faster than Analog can do on it's own.
http://www.analog.cx/helpers/#dns
Aengus
+
| TO UNSUBSCRIBE from this list:
|http://lists.meer.net/mailman/listinfo/analog-help
|
| Analog Documentation: http://analog.cx/docs/Readme.html
| List archives: http://www.analog.cx/docs/mailing.html#listarchives
| Usenet version: news://news.gmane.org/gmane.comp.web.analog.general
+
Re: [analog-help] FILEEXCLUDE via anlgform
On Wednesday, November 21, 2007 4:20 AM [EDT], Walter Ian Kaye [EMAIL PROTECTED] wrote: I can't get FILEEXCLUDE to work -- it's ignored. Run Analog with SETTINGS on to see what is and what isn't included. How do I exclude all .gif and .jpg/.jpeg files from the report? Which report? You can exclude non-pages from the Request Report by using the REQINCLUDE PAGES command. (Make sure your pages are defined properly using the PAGEINCLUDE command). For other reports, there are seperate columns for Requests (imcluding images) and for Pages. Aengus + | TO UNSUBSCRIBE from this list: |http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +
Re: [analog-help] FILEEXCLUDE via anlgform
Walter Ian Kaye [EMAIL PROTECTED] wrote: At 03:47 p + 11/21/2007, Hunter John didst inscribe upon an Hmm... maybe it didn't work because I didn't have root-relative paths? I had *.gif -- does it only match from the left? *.gif should work just fine. Do a simple test from first principles - create a 4 line logfile with each entry having a different file type. Run analog against it with your current .cfg file, and see if your FILEEXCLUDEs work as expected. If they don't, then run analog against the test logfile without any .cfg file: analog test.log -G +CFILEEXCLUDE *.gif +OReport.html This will demonstrate how analog interprets the FILEEXCLUDE command. If you're still getting unexpected results, then the order of your INCLUDES/EXCLUDES is the problem. SETTINGS ON will show you the order in which they are being applied. Aengus + | TO UNSUBSCRIBE from this list: |http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +
Re: [analog-help] FILEEXCLUDE via anlgform
On Saturday, November 24, 2007 10:37 AM [EDT], Walter Ian Kaye [EMAIL PROTECTED] wrote: What sort of interaction is there between the anlgform.pl script and any other settings elsewhere (wherever elsewhere is -- I haven't touched anything else)? anlgform.pl calls the analog program. If you don't know where the analog configuration files are, or what they contain, then get your anlgform.pl configuration to report what settings it is using (http://analog.cx/docs/form.html#formqv). Aengus + | TO UNSUBSCRIBE from this list: |http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +
Re: [analog-help] time range across multiple days?
Matt Singerman [EMAIL PROTECTED] wrote: Hello, I would like to run a log analysis from just 7:00 PM to 12:00 AM every day. After reading the manual, it appears that there is a way to delineate the times to search, but only as part of a broader date range. Is there any way to limit analog to only searching certain time ranges? If you have a weeks worth of logfiles, and you want to ignore all requests that occurred during daylight hours (for example) then, no, there isn't a straightforward way to do this with Analog. Aengus + | TO UNSUBSCRIBE from this list: |http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +
Re: [analog-help] Only include logs that has a certain string
On Wednesday, November 28, 2007 1:56 AM [EDT], Ridwan [EMAIL PROTECTED] wrote: I would like to create a report from an IIS web server log files for only the lines which contain a certain pattern of strings in them, like sydneyports. Help please? Without a bit more details, the best suggestion I can make would be to try FILEINCLUDE *sydneyports* http://analog.cx/docs/include.html Aengus + | TO UNSUBSCRIBE from this list: |http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +
Re: [analog-help] Only include logs that has a certain string
On Wednesday, November 28, 2007 6:43 PM [EDT], Ridwan [EMAIL PROTECTED] wrote: Hi Anegus, Thanks for your response. Sorry I should have been more specific. In my IIS log file, among other logging properties I also log the URI Query (cs-uri-query) which basically is the web request URLs sent back from the clients to the web server. For example, in the IIS log, URI Query logged for a line is the string: operation=checkpassuser=mnphmfpwd=blahblahpassdirect=y and for my Analog report I want to take into account only the lines from that IIS log file which has the word mnphmf in them or may be user=mnphmf in them. This way I would know exactly how many times they logged into my server. By the way, we run CGI based web applications on our web server and hence most of the activities are not pulling up just static files, they are rather web requests as URLs from the clients sent to the server which executes a .exe CGI program with parameters at the server and it sends back a dynamic HTML page as streams to the client. Its (CGI) a very old technology but works well for our heavily database driven applications. I'm sure that there's a better way, but the first thing that coes to mind is a slightly convoluted process using a FILEALIAS. FILEALIAS *.cgi?*mnphmf* $1.abc?$2mnphmf$3 will take all calls to your script and convert the script extension to .abc, if and only if that particular line includes the string you care about. Then if you use FILEINCLUDE *.abc* analog will report on just those lines. (By the way, I'm subscribed to the list. Just reply to the list, if you cc me, I end up with 2 copies of your message, and I only need 1). Aengus + | TO UNSUBSCRIBE from this list: |http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +
Re: [analog-help] Requests by half-hour
Morgen Nilsson [EMAIL PROTECTED] wrote: Can Analog report a list of when each file (mp3) was accessed/requested? I currently have it reporting how many total requests for mp3 files per quarter-hour using 'QUARTERREP ON', and it also reports how many times each mp3 file was requested using 'REQCOLS NRr' (I think). I want to be able to tell when each file was downloaded and a graph that marks the number or requests, per file, per half-hour. http://analog.cx/docs/faq.html#faq128 The short answer is no. You can get a report of how many times any single .MP3 file was downloaded during set periods (5 minutes, quarter hour, hourly, daily or weekly), but there isn't any way within Analog to get seperate periodic totals for seperate files in a single run. You either run Analog against each .MP3 file, or (possible more useful) run Analog once every half hour, and import the data into some other application to display the results). Aengus + | TO UNSUBSCRIBE from this list: |http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +
Re: [analog-help] Aggregate file requests [RE: Requests by half-hour]
Morgen Nilsson [EMAIL PROTECTED] wrote: Thanks for the quick response. I've got another question for you. Is it possible to combine requests for all files that start with the same name? Example: I have a bunch of files that have this format: show1MMDD.mp3 show2MMDD.mp3 Show3MMDD.mp3 ForumMMDD.mp3 etc... And each one of those examples has 5 other files with the same first half of the name, (such as show1) but with a different ending date. Is there a way to combine the statistics for all show1MMDD.mp3 files, all show2MMDD.mp3 files, ect. so the aggregate requests for show1 can be compared to the aggregate requests for show2 and show3, etc.? FILEALIAS show1*.mp3 show1.mp3 http://analog.cx/docs/alias.html Aengus + | TO UNSUBSCRIBE from this list: |http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +
Re: [analog-help] Only include logs that has a certain string
Stephen Turner [EMAIL PROTECTED] wrote: It turns out this is a problem with case insensitivity, though it's less clear what to do about it. If you're on a case insensitive filesystem (such as Windows), all the filenames are lower-cased, and so all the FILEINCLUDEs are lower-cased too to match. That way *test* and *TEST* will both match. The problem is that the lower casing only applies to the stem of the URL, not the query string; but analog doesn't know that the FILEINCLUDE is targetted at the query string, so it's looking for desc and not finding it. A workaround is to use FILEINCLUDE REGEXP:DESC That still does a case insensitive match, but the case insensitivity is handled by the regexp engine not by folding the specification to lower case, so it will match. Wow! :-) Aengus + | TO UNSUBSCRIBE from this list: |http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +
Re: [analog-help] Analog on Windows
On Saturday, December 01, 2007 8:30 AM [EDT], Ken Mooney [EMAIL PROTECTED] wrote: Hi, I'd like to use Analog but don't have root access to a UNIX server to install it on. Is there a way to run Analog on my laptop and have the Websphere logs from the Solaris 2.8 web server as the input files? You can either copy the log files to your laptop, or you can map a drive to the files on the server and run Analog locally on your laptop. If the logfiles are particularly large, it may make sense to compress them before transporting them across the netwrok - Analog has native support for zipped and gzipped log fies. Aengus + | TO UNSUBSCRIBE from this list: |http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +
Re: [analog-help] Analog on Windows
On Wednesday, December 05, 2007 7:37 PM [EDT], Ken Mooney [EMAIL PROTECTED] wrote: Thank you, it work just as you said, unzipped them perfectly. One last question, I don't seem to have my Logformat set right. I thought I read to copy the Logformat from the httpd.conf and I did. Didn't work I get this. If you take the LogFormat statement from a httpd.conf, ou have to tell Analog that it's written using Apache syntax, not analog syntax - specify APACHELOGFORMAT () instead of LOGFORMAT () in the analog.cfg file. http://analog.cx/docs/logfmt.html 11.111.111.111 - - [30/Nov/2007:12:04:04 -0600] GET /filename/css/fonts-ie.css HTTP/1.1 200 1664 https://website.com/Something; Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1; .NET CLR 2.0.50727; .NET CLR 1.1.4322) That's the standard LOGFORMAT COMBINED that Analog will automatically recognize, but it looks like there are 2 spaces between the referrer and the Browser string, rather than the single space that Analog expects. Aengus + | TO UNSUBSCRIBE from this list: |http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +
Re: [analog-help] Analog on Windows
On Wednesday, December 05, 2007 8:27 PM [EDT],
Ken Mooney [EMAIL PROTECTED] wrote:
Cool thanks, I probably put that 2nd space in there when I copied
this line into the email and removed our customers name.
If there's only one space in the actual logfile, then Analog will recognize
that format without any explicit LOGFORMAT statement - it's a standard
Combined logformat that Anaog recognizes automatically.
Here's what I was using:
APACHELOGFORMAT (%h %l %u %t \%r\ %s %b \%{Referer}i\
\%{User-Agent}i\)
Are there 2 spaces between \%{Referer}i\ and \%{User-Agent}i\ ?
If the line in the logfile is standard format then I can just use
this one ?
LOGFORMAT COMBINED
If LOGFORMAT COMBINED works, then it's not actually needed - Analog checks
for that by default.
Aengus
+
| TO UNSUBSCRIBE from this list:
|http://lists.meer.net/mailman/listinfo/analog-help
|
| Analog Documentation: http://analog.cx/docs/Readme.html
| List archives: http://www.analog.cx/docs/mailing.html#listarchives
| Usenet version: news://news.gmane.org/gmane.comp.web.analog.general
+
Re: [analog-help] LOGFORMAT problem
On Monday, December 10, 2007 9:37 PM [EDT],
Ken Mooney [EMAIL PROTECTED] wrote:
Hi,
My problem is with LOGFORMAT. I thought I read to use the format
from my httpd.conf file so I have. It loads a page with a few
records but gives me the errors below: I have degugging turned on
and have tried several differnet examples of format including not
using one and can't quite seem to get it right yet.
Any help you can offer would be great !
Thanks,
Ken
From httpd.conf - this is what I used in analog.cf
APACHELOGFORMAT (%h %l %u %t \%r\ %s %b \%{Referer}i\
\%{User-Agent}i\)
A piece of the access log, I modified this because it has customer
info but this is the format.
11.11.111.111 - - [30/Nov/2007:12:04:04 -0600] GET
/abc/ws/DI-4367/css/horizont
al_menu_styles.css HTTP/1.0 200 2646 https://customer/site;
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; S
V1; .NET CLR 1.1.4322; .NET CLR 2.0.50727; InfoPath.1)
That line matches the APACHELOGFORMAT above - if all the lines in your
logformat match that line, then you shoudn't have a problem.
The tail of the error.log
analog: Warning L: Large number of corrupt lines in logfile test.gz:
turn debugging on or try different LOGFORMAT
Current logfile format:
%S %j %j [%d/%M/%Y:%h:%n:%j] %j%w%r%wHTTP%j %c %b %f %B\n
This logformat also matches the sample line you provided, but it DOESN'T
match the APACHELOGFORMAT command - the 3rd field is %u in your
APACHELOGFORMAT. That suggests that your APACHELOGFORMAT isn't being read,
and that Analog is autoparsing the log entries (the sample line you provided
will be recognized automatically anyway). You mentioned analog.cf above - is
that a typo for analog.cfg?
You'll have to run Analog with DEBUG ON to see which log entries Analog is
seeing as corrupt. It will also give you an indication of which field in the
line doesn't match the LOGFORMAT that Analog is using.
Aengus
+
| TO UNSUBSCRIBE from this list:
|http://lists.meer.net/mailman/listinfo/analog-help
|
| Analog Documentation: http://analog.cx/docs/Readme.html
| List archives: http://www.analog.cx/docs/mailing.html#listarchives
| Usenet version: news://news.gmane.org/gmane.comp.web.analog.general
+
Re: [analog-help] Inflated numbers on PDF?
Kyle Smego [EMAIL PROTECTED] wrote: Analog is showing an huge amount of requests on PDF files. Most months they seem to be 4-5 times more than any other page/file. For example...in November I have one PDF file that shows 85000+ requests. Any ideas on why this might be happening? http://analog.cx/docs/faq.html#faq143 Aengus + | TO UNSUBSCRIBE from this list: |http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +
Re: [analog-help] Log by specific client IP addresses
On Thursday, December 13, 2007 8:58 PM [EDT], Ridwan [EMAIL PROTECTED] wrote: I want to create a report from IIS logs only for certain client IPs. For example, only for the clients coming through the IP 210.55.53.X and IP range from 202.62.123.224 to 202.62.123.231 and for IP 203.20.238.X all in a single report. Here X means 0 to 255. Can some please help? http://analog.cx/docs/include.html#HOSTINCLUDE Aengus + | TO UNSUBSCRIBE from this list: |http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +
Re: [analog-help] Need to see full IP addresses
Esposito, Richard [EMAIL PROTECTED] wrote: Aengus, it seems I am not configured to get a Host Report section. Based on the documentation, it seems that I need to insert this line into the config file: HOST ON Is this correct? Does it matter where in the config file I put it? Thanks. HOST ON is the correct command. You can put it anywhere in the analog.cfg. Note that the default is to only list the top 50 Hosts by bytes transferred (as far as I can recall). If you want to see more, you will want to change the HOSTFLOOR: http://analog.cx/docs/othreps.html#FLOOR You can also change the sort order: http://analog.cx/docs/othreps.html#SORTBY Aengus + | TO UNSUBSCRIBE from this list: |http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +
Re: [analog-help] reqinclude
kevin creason [EMAIL PROTECTED] wrote: Hi... I'm using the form and trying to do pared down Request report, mostly so that I can publish little links for directory/site/app owners to get their own indivual statistics whenever they want. no matter what I try-- DIRINCLUDE, FILEINCLUDE, REQINCLUDE, I keep getting the complete Request report, not just their information that I want. so I put settings on, and I see the following asterisk. I think this is throwing me off-- am I right? Where is this getting set? Request Report [ON] Columns: number #requests last-time Sorting by number of requests Floor is: 1 request Sorting sub-items by number of requests Floor for sub-items is: 5 requests No pie chart Including (+) and excluding (-) the following in the report: All excluded, then + * + asdb Aliasing in the report as follows: */asdb/* - /asdb/ */cosmosd/* - /cosmos/ My analog.cfg: analog.cfg:REQUEST On analog.cfg:REQARGSFLOOR 5r analog.cfg:REQCOLS NRD analog.cfg:REQSORTBY REQUESTS analog.cfg:REQALIAS */asdb/* /asdb/ analog.cfg:REQALIAS */cosmosd/* /cosmos/ and many more REQALIASes The * is the problem. If you have a look at the source of anlgform.html, and it includes this section: h3Request Report options/h3 brShow select name=REQINCLUDE size=1 option value=* selectedall files option value=pagespages only /select So that's where the * comes from - the form is set up to either show all requests, or only pages. If you use FILEINCLUDE instead (or enter */asdb/* in the Analysing only part of the logfile section, then you should get the report you expect, because the excluded stuff is never even analyzed in the first place, so it's not available to include in the Request Report. Aengus + | TO UNSUBSCRIBE from this list: |http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +
Re: [analog-help] click pattern
Hildreth, Steve [EMAIL PROTECTED] wrote: I am using analog 5.32 and trying to find a way to display the user click patterns. The result that I am truly looking for is to find the dead links on our website. One method is to find the link the user click just prior to reaching our error page. Any help is greatly appreciated. Analog has a Failed Referrer report that is turned off by default. You can turn it on with FAILREF ON. This will list the referrers for all the failed requests. If you restrict this to just your own website (FAILREFINCLUDE *yoursite.com/*) then you get a list of any links on your site that generated errors when they were clicked on. Aengus + | TO UNSUBSCRIBE from this list: |http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +
Re: [analog-help] Struggling with memory problem using Search Query
Zembower, Kevin [EMAIL PROTECTED] wrote: I thought that maybe I could generate a Search report by not using the entire lists available in SearchEngines.txt and SearchQuery.txt. Instead, I'm trying to just look at the top ten search engines that refer to my site. I started with Google. I entered this in my Analog config file: # Creating Search Query and Word reports here REFARGSEXCLUDE *#Reject all ref arguments, to prevent seg fault with 12 months of data, then REFARGSINCLUDE /search* #accept only the one for Google. Why not just use REFINCLUDE *.google.*. Your problem is not that your list of search engines is too big, it's that your list of log entries is too big. By excluding every entry that wasn't referred by Google, you should be well able to report on just the Google Search terms. If you're primarily interested in the Search Reports, you need to use the LOWMEM commands for everything _except_ the Referrers - that's the information that you want. Aengus + | TO UNSUBSCRIBE from this list: |http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +
Re: [analog-help] Struggling with memory problem using Search Query
Zembower, Kevin [EMAIL PROTECTED] wrote: Aengus, thanks so much for your suggestion. Unfortunately, it doesn't seem to work for me. I made these entries in my analog config file: REFINCLUDE *.google.*,*.jhuccp.org*,*.yahoo.* SEARCHENGINEhttp://*.google.com/* q,as_q,as_oq,as_epq,query SEARCHENGINEhttp://*.google.co.*/* q,as_q,as_oq,as_epq,query SEARCHENGINEhttp://*.google.com.*/* q,as_q,as_oq,as_epq,query This generates this section in the '--settings' output: Including (+) and excluding (-) the following referrers: All excluded, then + *.google.* + *.jhuccp.org* + *.yahoo.* This leads me to believe that it's working correctly. I wanted these three referrers, because they make up most of my referrer report. However, I get this output when I run analog: ../analog-6.0/analog: analog version 6.0/Unix ../analog-6.0/analog: Warning M: Logfile /opt/analog/logdata/web1/access_log* contains lines with no referrers, which are being filtered (For help on all errors and warnings, see docs/errors.html) ../analog-6.0/analog: Warning M: Logfile /opt/analog/logdata/db/ccp-apps2/ex* contains lines with no referrers, which are being filtered sh: line 20: 19024 Segmentation fault ../analog-6.0/analog +gweb1.analog.cfg This error message troubles me, as it seems to indicate that log entries without referrers were being dropped. I'll have trouble interepting this report, I think. Even if this report didn't seg fault, I'm not sure it would be useful to me. If you want to generate a Search Report, you might as well ignore lines without referrers, because the Search report information comes from the Referrer. (As a generale rule, the number of lines that have no referrer at all is usally pretty tiny - under normal circumstances, only bookmarks and e-mail links generate log entries with no referrer. 90% of the rest of the referrers will usually be internal - referrers from your own site). Unless I or anyone else on this list can think of another suggestion, I think that I just have two options: 1) Add more memory to this host. You can test this very easily - exclude a couple of months from the report and see if you don't get the error when you're trying to generate a smaller report. 2) Generate a report with just the Search Query and Search Word sections, and minimize or eliminate everything else. Any guesses if this would work? Sorry, I thought that you were already doing this. Yes - if you have to many logfiles to crunch in a single report, running seperate reports may allow you to get the information you need. I just turning off the other reports doesn't work, try to use the LOWMEM commands for everything except the referrers. Aengus + | TO UNSUBSCRIBE from this list: |http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +
Re: [analog-help] Analog and EZproxy
Baker, Tammy K [EMAIL PROTECTED] wrote:
I'm writing because I'm wondering how you were able to get Analog to
work. I tried running it on a couple of smaller log files to test it
out by running the following command: analog ezp200801.log
But got the following error message:
analog: analog version 6.0/Win32
analog: Warning E: Redirecting future diagnostic messages to
errors1.txt (For help on all errors and warnings, see
docs/errors.html)
That's a warning, not an error - it just says that it's going to write any
error messages to a file instead of writing them to the screen. If you want
them to write to the screen, comment the ERRFILE command out of the analog.cfg
file.
The output that was in the error file is
Warning L: Large number of corrupt lines in logfile ezp200801.log:
turn debugging on or try different LOGFORMAT
That basically means that Analog doesn't recognize the data in your logfile -
it can't tell what each field means.
I have the following entered into the EZproxy configuration file:
## Logfile directives added 2006-04-04, LogSPU added 2006-05-18
LogFile -strftime ezp%Y%m.log
LogFormat %h %{ezproxy-session}i %u %t %r %s %b %{referer}i
LogSPU -strftime spu%Y%m.log %h %{ezproxy-session}i %u %t %r %s %b
%{ezproxy-groups}i %v %{referer}i
This is the Analog list, not the EZProxy list, so I have no idea what LOGSPU
means, but that LogFormat line wou;d probably correspond to something like this
in the analog.cfg file:
LOGFORMAT (%S %c %u [%d/%M/%Y:%h:%n:%j] %j %r HTTP%j %c %b %f)
(Note that Analog wants the date/time field spelled out - I'm just guessing at
what the %t in EZProxy might actually generate).
I attached my error report but I'm starting to thinking the analog
configuration file (analog.cfg) might need to be adjusted; actually,
I'm not sure where to begin. Can you give me some pointers?
Add
LOGFORMAT (%S %c %u [%d/%M/%Y:%h:%n:%j] %j %r HTTP%j %c %b %f)
LOGFILE ezp200801.log
When Analog completes, open the file Report.html that it generates to see the
result. If you're still not getting any output from Analog, post 2 or 3 lines
from your logfile, so that we can tweak the LOGFORMAT command that you need to
put in your Analog.cfg file.
Aengus
+
| TO UNSUBSCRIBE from this list:
|http://lists.meer.net/mailman/listinfo/analog-help
|
| Analog Documentation: http://analog.cx/docs/Readme.html
| List archives: http://www.analog.cx/docs/mailing.html#listarchives
| Usenet version: news://news.gmane.org/gmane.comp.web.analog.general
+
Re: [analog-help] Ignore [unresolved numerical addresses] in DomainReport
At Sunday, January 13, 2008 3:24 AM, Alex Jurkiewicz [EMAIL PROTECTED]
wrote:
Hi all,
I suspect this is a FAQ, but I can't find it anywhere...
My Domain Report shows something like this:
reqs %bytes domain
35801 32.00% [unresolved numerical addresses]
10015 7.47% .de (Germany)
6453 4.58% .au (Australia)
[...]
How can I remove the top item from showing up in there?
I've tried
DOMEXCLUDE REGEXP:\b(?:\d{1,3}\.){3}\d{1,3}\b
DOMEXCLUDE [unresolved numerical addresses]
which doesn't seem to affect the output at all.
DOMEXCLUDE [unresolved numerical addresses]
Aengus
+
| TO UNSUBSCRIBE from this list:
|http://lists.meer.net/mailman/listinfo/analog-help
|
| Analog Documentation: http://analog.cx/docs/Readme.html
| List archives: http://www.analog.cx/docs/mailing.html#listarchives
| Usenet version: news://news.gmane.org/gmane.comp.web.analog.general
+
Re: [analog-help] specifying what configuration file to use
[EMAIL PROTECTED] wrote: I assume this is in the documentation somewhere, but I can not find it. When I had the SysAdm install analog on my Linux workstation a configuration file was created in /etc. I do not have root access on this system, so I can not change that one. How do I specify what configuration file to use. It seems to always use the /etc/analog.cfg. You can specify an additional .cfg file with the +g command line switch. You can tell Analog to ignore the default .cfg file by specifying -G analog +gmyconfig.cfg logfile.log analog -G +gother.cfg access.log http://analog.cx/docs/syntax.html Aengus + | TO UNSUBSCRIBE from this list: |http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +
Re: [analog-help] Web Browser Variable Search
At Friday, February 08, 2008 11:55 PM, Walter Barbee [EMAIL PROTECTED] wrote: How do you make the Analog 6.0 print out the Search term(s) of browsers visiting a web site? Apache 1.3 is running under Windows XP Virtual Host log specification is as follows: CustomLog logs/access_web2.log %h %l %u %t \%r\ %s %b Thanks for any ideas to the solution ^..^ The information that you want is carried in the Referrer field, which doesn't appear to be in your log file. No Referrer, no Search Word or Search Query reports, I'm afraid! Aengus + | TO UNSUBSCRIBE from this list: |http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +
Re: [analog-help] LogFormat help request
Roberto Hoyle [EMAIL PROTECTED] wrote: DEFAULTLOGFORMAT ( [%Y-%m-%d %h:%n:%j] %v:%j %s:%j %j %j %Tms %c %j %j %b %j %j %r %j %q %f %B %j %j ) This is a sample of the log: [2008-02-11 10:50:02 EST] library.dartmouth.edu:80 130.189.217.32:- HTTP/1.1 GET 28505ms 200 200 + 270629 11428 GET /se arch/search360/search360.js HTTP/1.1 /data/websites/diglib/search/ search360/search360.js /search/search360/search360 .js http://www.dartmouth.edu/~biomed/; Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727) - - Your DEFAULTLOGFORMAT starts with a space (everything within the parentheses is important), your logfile doesn't. If you take the spaces out at the beinning and end of the LOGFORMAT, Analog will interpret the sample lines you provided. LOGFORMAT ([%Y-%m-%d %h:%n:%j] %v:%j %s:%j %j %j %Tms %c %j %j %b %j %j %r %j %q %f %B %j %j) Aengus + | TO UNSUBSCRIBE from this list: |http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +
