list of reports you can turn on or off is listed here:
http://www.analog.cx/docs/output.html#replist
If you paste the full text of the error you get, someone should be able
to help you.
Aengus
+
| This is the analog-h
han the
> individual terms then I'd be able to get a much clearer idea of how
> people are finding my consulting pages.
You can control the number of entries in any report by using the FLOOR
commands.
Aengus
+--
u are looking for.
(Note that I have sent this response to the list. Please keep all analog
related questions on the list).
Aengus
+
| This is the analog-help mailing list. To unsubscribe from this
| mailing list, go to
|
t.org (assuming Analog recognized
www.amerisat.org as a domain, which I don't think it does).
Aengus
+
| This is the analog-help mailing list. To unsubscribe from this
| mailing list, go to
|http://lists.isite.net/l
cs/faq.html#faq128
You would have to run a seperate report for each country, using the
HOSTINCLUDE command. That isn't necessarily as big a deal as it might
sound -unless your log files are so huge that this would be prohibitive.
Aengus
+-
PACHELOGFORMAT (%h %l %u %t %v \"%r\" %>s %b)
LOGFILE /var/log/apache/access.log
Aengus
+
| This is the analog-help mailing list. To unsubscribe from this
| mailing list, go to
|http://lists.isite.net
everything between the 3rd ":" in the date/time and the closing
"]", so you can just use a single %j.
I'm basing this solely on the 2 lines of debug output you posted, so I
may well have missed something, but usually a couple of lines are enough
to set this up.
Aengus
+
falls into, but, as far as I
know, this tool doesn't work on NT. But I haven't looked at it in almost
2 years, so more of the dependencies may have been ported to NT since
then).
Aengus
+
| This is the analog-help ma
HELOGFORMAT" to LOGFORMAT above, you have
started and ended your format string with a space that isn't in your
logfile - ( %j should be (%j and " ) should be ").
Your logformat also has 5 fields before the date/time,
;
> This Apache server is a proxy server, and I need to monitor internet
> traffic per username in a month.
> I cannot figure out how to do this with analog (I'm a novice...).
USERCOLS
http://www.analog.cx/docs/othreps.html#othCOLS
Aengus
+-
r, and the SEARCHENGINE directive includes a field
to tell Analog where to find the actual search terms in the referrer.
SEARCHQUERYINCLUDE/EXCLUDE will only include or exclude queries from
Engines that are already defined with the SEARCHEN
the command line
> /root/analog-5.21/analog -G +g/root/analog-5.21/daily.cfg
> it works perfectly.
The usual cause of this problem is that the cron job is running under an
account that doesn't have permissions in the directory that the logs
files are in.
Aengus
+-
me that, if there is more than one
Organization involved, the number is small enough that it would be
practical to include them all). You could use something similiar for the
GET and POST requests, perhaps using %B and BROWINCLUDE "POST" or
BROWINCLUDE "GET"
Aengus
+---
here you put SETTINGS ON.
SETTINGS ON isn't "interfering" with DEBUG and OUTPUT, they just don't
have any function when Analog is just displaying it's current settings.
Aengus
+
| This is the anal
domain files
you have edited.
Aengus
+
| This is the analog-help mailing list. To unsubscribe from this
| mailing list, go to
|http://lists.isite.net/listgate/analog-help/unsubscribe.html
|
| List archives are available
t and
last line are basically the same, except that I just used a space
instead of %w). You just replicate your existing LOGFORMAT lines and add
"%j" for the last field.
Aengus
+
| This is the analog-help mailing list
port that is generated indicate that
Analog recognizes any of the lines in your log?".
If you have lines in your log from before your provider added
"{X-Forwarded-For}" then you'll get the "large numb
Max Gut <[EMAIL PROTECTED]> wrote:
> am 10.04.2002 17:26 Uhr schrieb Aengus unter [EMAIL PROTECTED]:
>
>>>>> The string was send to me like this:
>>>>>
>>>>> "%A %h %l %u %t \"%r\" %s %b %{Host}i \"%{Referer}i\"
Max Gut <[EMAIL PROTECTED]> wrote:
> am 10.04.2002 16:32 Uhr schrieb Aengus unter [EMAIL PROTECTED]:
>
>> Max Gut <[EMAIL PROTECTED]> wrote:
>>
>>> analog says to the new logformat of my Provider:
>>>
>>> Warning C: Bad argument in confi
n a wrong way, for instance, it considers any of the
> .gif files as a different type with its different alias.
You probably want REQALIAS rather than FILEALIAS.
http://www.analog.cx/docs/alias.html#OUTPUTALIAS
Aengus
+
| Th
\"%{X-Forwarded-For}i\")
>
> The string was send to me like this:
>
> "%A %h %l %u %t \"%r\" %s %b %{Host}i \"%{Referer}i\" \"%{User-
> agent}i\" \"%{X-Forwarded-For}
it into a database in
a similiar fashion.
Aengus
+
| This is the analog-help mailing list. To unsubscribe from this
| mailing list, go to
|http://lists.isite.net/listgate/analog-help/unsubscribe.html
|
| List ar
ease the number or command-line
> arguments analog will read?
I've often used more arguments than that on NT, so I don't think the
problem is with Analog. I'd be surprised if it has anything to do with
the total line length, but to test that, I&#
f requests for the file, and then breaks that down to show how often
each argument was used. So /board/top.cgi was called 271 times, of which
112 requests had forum=5&topic=1 as a paremeter, etc.
112+58+20+12+12+9+5+4+4+4+4+4+4+4+4+4+2+2+2+1 = 271
There
I am using version 5.21 so I don't know if this makes a difference.
> Thanks for the help.
I haven't done much with Directory reports, but shouldn't that be
SUBDIR /gucdc/*/*/*
Aengus
+
| This is th
}i\""
(Note that I can't be sure whether your httpd.conf entry contains a
space between referrer and User agent, because of line wraps, but the
sample entry you show below indicates that there is no space).
Aengus
+--
7;s
wrong, your User Report would contain unaliased Users. If you're getting
an empty User Report, that means that your LOGFORMAT command isn't
allowing Analog to recognize your cookie as a User.
What LOGFORMAT are you using?
Aengus
+
the page manually ever day for all of our
> sites to insert his code.
http://www.analog.cx/docs/output.html#HEADERFILE
Aengus
+
| This is the analog-help mailing list. To unsubscribe from this
| mailing list, go to
|ht
m
>
> At the moment I am unable to generate a user report. Could you please
> confirm that the APACHELOGFORMAT I set is correct.
Which of these LogFormats is Apache actually using? Is there a CustomLog
command in your httpd.conf?
Aengus
+-
- if I
understand you properly, you want January.html to give an over-all report
for January, and January22.html to give a more detail report for the 22nd of
January (and presumably January1.html to January31.html for each day in
January).
Aengus
+--
to parse such a field. But, depending on the source of the log, it
might make more sense to "fix" the program that's producing the output,
rather than applying the fix to Analog.
What application is producing the logs?
Aengus
+--
crosoft IIS, record time-taken in milliseconds as
an integer, rather than seconds, which is why Analog supports %t and %T.
Even if the first is recorded in milliseconds, 1.01648909E9 seems like an
exceptionally long time.
Aengus
+--
r/newpage.htm
will cause analog to ignore everything except the specified file.
Aengus
+
| This is the analog-help mailing list. To unsubscribe from this
| mailing list, go to
|http://lists.isite.net/listgate/analog-help/
ed to put
multiple consecutive %j entries is if you are trying to keep count, so You
might put multiple %j's if you wanted to ignore the 4th and 5th of 8
entries, for example.
Aengus
+
| This is the analog-help mai
eport, rather than the request report. If the log shows
a request for /academy/74/photos then you may have to try a different
tack.
Aengus
+
| This is the analog-help mailing list. To unsubscribe from this
| mailing list, go
of 200 (successful). I ran analog
> against it and my result shows 3 successful hits.
>
> Any suggestion what I should try next? Thanks!
What does the General Summary say about the other lines? It should show
how many were c
443 for SSL requests, as %j. If you have a custom
LOGFORMAT directive, it might be only looking at port 80 requests, but you
should get a warning message about corrupt log entries.
Aengus
+
| This is the analog-help mailing lis
a FLOOR.
> There is always only one value in *floor commands,
> and I need two of them...
Why would you need two?
Aengus
+
| This is the analog-help mailing list. To unsubscribe from this
| mailing list, go to
"Jeremy Wadsack" <[EMAIL PROTECTED]> wrote:
> Aengus ([EMAIL PROTECTED]):
>
> > I think your best bet will be to grep the logs for matching
> > requests. Does anyone know how to create a regular expression
> > to pick out lines with a field that is bet
best bet will be to grep the logs for matching requests. Does
anyone know how to create a regular expression to pick out lines with a
field that is between 2 numerical values?
Aengus
+
| This is the analog-help maili
do that with Analog. You can probably use floors to
see how many requests fall into that size window, but you can get a report
of the associated users. I think you might need to use some sort of
preproccessing to extract the requests that meet y
any attention to are LOGFILE,
DNSFILE, DNSBADHOURS and DNSGOODHOURS. (I don't know if it parses
LOGFORMAT. I know it works without one).
Aengus
+
| This is the analog-help mailing list. To unsubscribe from this
| mail
address your
original question - problems with unresolved numerical addresses. Are you
still having problems with unresolved numerical addresses?
Aengus
+
| This is the analog-help mailing list. To unsubscribe from this
|
d
> of "in", but that doesn't seem like it should make any difference
> to Analog. Why would it object to
> LOGFILE //server_name/LogFiles/ex%y%M??.log
> but not
> LOGFILE //server_name/InfoCtrLogs/in%y%M??.log"?
Have you checked that the process that is runnin
le to write a batch
> file to automate this. Check the list archives for examples.
There's a fairly detailed example of a batch file for NT for calling
monthly log files at:
http://www.mail-archive.com/analog-help@lists.isite.net/msg06596.html
Aengus
+---
gfile=ex02%month%.log
QDNS /L %logfile% /D C:\analog\DNS.DNS /Y 1.2.3.4
Analog -G +gd:\www\sites\site.cfg %logfile%
There are some examples of getting the date into an NT environment
variable in the list archive:
http:/
t feels like I need to put together a analog.cfg for each site
being
> analyzed.
You only need to specify the "non-standard" settings for each site - the
log file location, the Hostname, any custom settings. (You may be better
off using a single, shared DNS
file.
The FROM and TO directives allow you to specify a specific period that
Analog should include. Check you Analog.cfg file for any FROM directives.
If you don't find anything, try running Analog with SETTINGS ON
ml but be aware that, even with DNS lookups
enabled, you may still have significant numbers of unresolved addresses
showing up.
Aengus
+
| This is the analog-help mailing list. To unsubscribe from this
| mailing list,
r - %c %b %j %j %j %u
%f)
That LOGFORMAT parses that sample line. What problems are you having with
it?
Aengus
+
| This is the analog-help mailing list. To unsubscribe from this
| mailing list, go to
|http://list
alog on Solaris may be able to shed
some more light.
Aengus
> I'm running on Solaris 2.6.
> I think Analog does write the dnscache, but it's something like this:
>
> 16944964 80.192.212.49 *
> 16944964 80.1.8.61 *
> 16944964 152.163.197.212 *
&
on't have a "." in them. This usually only happens
for hosts that are defined locally.
Aengus
+
| This is the analog-help mailing list. To unsubscribe from this
| mailing list, go to
|http://lists.isite
What OS are you running on? Is Analog actually writing to the dnscache
file - it should be writing even unresolved addresses to it.
Aengus
+
| This is the analog-help mailing list. To unsubscribe from this
| mailing list, go t
"Stephen Turner" <[EMAIL PROTECTED]> wrote:
> On Wed, 20 Mar 2002, Aengus wrote:
> >
> > (Actually, I just checked, and I can't find old language files
> > on the analog website. Does anyone know where they are?)
>
> Why would they be needed?
#x27;s not
possible to upgrade, and use a LANGFILE directive to point to it.
(Actually, I just checked, and I can't find old language files on the
analog website. Does anyone know where they are?)
Aengus
+
|
ou won't see any mention of bytes, Kbutes, Mbytes or Gbytes.
Aengus
+
| This is the analog-help mailing list. To unsubscribe from this
| mailing list, go to
|http://lists.isite.net/listgate/analog-help/unsubscri
equests: 0
> S: Redirected requests: 7034
The sample lines you provided all show a 302 status code, and what would
normally be sizes of 302 bytes and 297 . It looks like the rest of your
log file is also only returning 302 codes, suggesting that who
setup the cookie as you describe, I still don't see any
> time-based reports in analog. Are they not even possible?
http://www.analog.cx/docs/webworks.html
Analog does time reports, but not what you call "time reports". In the
non-time reports, such as the User report, Analog w
, but there are obviously some people for whom the default
behaviour doesn't work.
I don't know what the best way to improve this would be: a few lines of
explanation in the analog.cfg, a more explicit discussion of the issue in
startpc.html, a batch file in the Windows distribution t
#x27;re using the form mechanism, and allowing them to create dynamic
reports, it would be possible to modify the perl script to insert
USERINCLUDE commands based on the logonID of the administrator.
Aengus
+
| This is
now that it's not all that
useful until after you analyse it (at least the first time).
By the way, if your logon information is being tracked in a cookie, then
you must be checking that cookie within the page access code. I presume
that code uses some sort of timeout me
ld in your
logs, you can try it with the IP address field, but you'll likely
encounter the difficulties mentioned above.
The key issue is that the numbers that Webtrends will happily deliver to
you don't necessarily mean what they appear to mean on the surface.
see the error messages/warnings that explain
why you are getting an empty report.
(You can also add ERRFILE error.txt, and then open error.txt in notepad
instead.
Aengus
+
| This is the analog-help mailing list. To
mes", not "users". The term "user" is open to
interpretation. Username refers to whatever field in your log file that
you map with %u. It might be the logonID field, or a cookie, or even the
IP address.
Aengus
+
ant to try adding the SETTINGS ON directive to see if you can
spot what Analog has been told to look for (to the exclusion of everything
else).
Aengus
+
| This is the analog-help mailing list. To unsubscribe from this
n't be a problem, but you need to be comfortable that your reporting
strategy is answer the questions that you want it to, and you can be sure
that someone else wants different questions answered than you do!
Aengus
+-
last month, or the last
year? Also bear in mind that some customers will not want this information
made public, and some will.
Aengus
+
| This is the analog-help mailing list. To unsubscribe from this
| mailing list,
From: "Aengus" <[EMAIL PROTECTED]>
> "Carsten Böttcher" <[EMAIL PROTECTED]> wrote:
>
> > The admin had added a new field at the end of the fileformat...
> > (you can see the IP)
> >
> > 195.206.128.91 - - [13/Mar/2002:09:50:00 +0100]
ve 217.160.73.138 in the field before the
referrer, then you can ignore that field, and use the Virtual Host report
for the extra field instead.
LOGFORMAT (%S %j %u [%d/%M/%Y:%h:%n:%j] "%j%w%r%wHTTP%j" %c %b
217.160.73.138 "%f" "%B" %v)
Aengus
+---
MAIL PROTECTED];
> http://www.inktomi.com/slurp.html)" -
>
> Is it possible, to have a LOGFORMAT that can interpret all three
> versions of the logfile?
The first and second version are really the same, with - being used when
the actu
mi.com/slurp.html)" -
>
> Is it possible, to have a LOGFORMAT that can interpret all three
> versions of the logfile?
The first and second version are really the same, with - being used when
the actual data isn't avail
lar, if you see that the 6,000 hits were generated by
only 200 different hosts, it should answer your first question.
> Is there a rule-of-thumb for how many requests are genuine human
> requests?
Different websites would have different rules of thu
;-" in your example, but normally
"hhtp://...") and %B, the Browser string.
> In my opinion thats the error in the file wich is reported by analog ?
It's not a matter of opinion - Analog quite clearly indicates which field
it's having problems with, but putting a *
re my cfg-file to analyse only special directorys for
> example /free ?
FILEINCLUDE /free/*
Aengus
+
| This is the analog-help mailing list. To unsubscribe from this
| mailing list, go to
|http://lists.isite.net/list
FORMAT (%S %j %u [%d/%M/%Y:%h:%n:%j] "%j %r/recipient%j HTTP%j" %c %b
"%f" "%B")
If you also add the LOGFORMAT for NCSA Combined, then Analog should be
able to parse the lines that aren't messed up too.
LOGFORMAT (%S %j %u [%d/%M/%Y:%h:%n:%j] "%j%w%r%wHTTP%j
g through stdout, then it fails.
> I cant manage to get htm-out or any other output to
> files, so I also miss the pie-charts in which i'm interested
> to have.
If you want to create htm files, use analog.exe, not anlgform.exe.
Aengus
+--
though
> that report is on. I used the bigbyrep.cfg file in the examples folder
as a
> starting point, and made changes to customize.
>
> My logformat now looks like this:
>
> LOGFORMAT (%S%j[%d/%M/%Y:%h:%n:%j%j] "%j%w%rHTTP%j" %c%b "%B" "%f")
navclient&q=widget
That information is already in the Referrer report. You may need to lower
the default floors to see it displayed.
REFERRER ON
REFFLOOR 1r
REFARGSFLOOR 1r
Aengus
+
| This is the analog-help mailing list.
ing, and can't find any query
string in what it things is the Referrer (but is actually the Browser
string). It looks as though you were on the right line above, but that you
inadvertently commented out your LOGFORMAT line.
Aengus
+
ow of any reason why DNS file issues should cause whole days
worth of hits not to be reported.
I had assumed that you have a single log file. But if you're generating
DNS files of that size, your log file would have to be huge. If you
disable DNS lookups, do you see the "holes&q
ginal IIS logs. What
> could be happening?
If you do a report on just one of those days (using a FROM - TO pair), do
you get anything?
Aengus
+
| This is the analog-help mailing list. To unsubscribe from this
|
inst using big.cfg as a prototype. It's a
useful tool for learning what options exist, but it may make it harder to
keep track of what changes you have made. You may find it easier to start
with an almost blank ana
ed and it seems to be
!working now. Takes a while to generate a report of course due to the
!huge amount of data it has to parse but its going.
Aengus
+
| This is the analog-help mailing list. To unsubscribe from this
| maili
thousands of other
sites, it will usually remember authentication details for your site for
all that time (though there may be a limit on how many different sets of
credentials it will remember).
Aengus
+
| This is the
entry and not the /usr/local/bin/analog
> +gcort.cfg entry. Again, when I run the /usr/local/bin/analog
+gcort.cfg
> from the command line, it works fine.
crontab errors are usually caused by permission problems. The cron process
doesn'
outputfile in
> the directory of the last configfile of the main analog.cfg
Each time Analog runs, it creates 1 output file. If you want multiple
output files, you run Analog multiple times.
analog +gunicareanalog.cfg
b2.cfg
http://www.analog.cx/docs/syntax.html
Aengus
+
| This is the analog-help mailing list. To unsubscribe from this
| mailing list, go to
|http://lists.isite.net/listgate/analog-help/unsubscribe.html
|
| List a
"Digital Photography Now Information" <[EMAIL PROTECTED]> wrote:
> Thank you too, Aengus, but your solution hasn't worked either
> - I get successful requests - 0 and x number of corrupt logfile
> lines.
If you try my LOGFORMAT against the sample lines you posted
uot; "%B")
But you'll notice that Analog puts a "*" under the www.dp-now.com field,
just after the %b, because it's expecting "%f", (the referrer field, which
is quoted, and www.dp-now is not quoted). I'd guess that www.dp-now.
ecause I know it will take hours. But I can
resolve the 25,000 hosts in that log file in about 10 or so minutes using
a helper app. Have you tried to use DNSTrans with your logs?)
I don't know of any way to do what you're actually asking for, because I
presume that Analog simply
By default, pages is just *.htm, *.html and */. If you want *.jip and *.pl
included, for example, use
PAGEINCLUDE *.jip, *.pl
(This is referred to in passing in
http://www.analog.cx/docs/faq.html#faq126)
Aengus
+
| This is the
t | %H | %m | %U | %>s | %B | %T | %{Referer}i |
> %{User-Agent}i)
APACHELOGFORMAT, not LOGFORMAT.
> APACHELOGFORMAT (%v | %h | %t | %H | %m | %U | %>s | %B | %T |
%{Referer}i |
> %{User-Agent}i)
This also works on
recognize the status code as a successful response, then
the request won't show up in the Request Report.
Aengus
+
| This is the analog-help mailing list. To unsubscribe from this
| mailing list, go to
|http://list
r search
arguments in the Referrer Report.
To see the search arguments you may need to set the REFARGSFLOOR
lower. To avoid seeing them, you could set the REFARGSFLOOR higher,
or alternatively use the REFARGSEXCLUDE command to ign
ion he posted, his question is just a good example of how sometimes
we lose sight of the details when we look at the big picture.
Aengus
+
| This is the analog-help mailing list. To unsubscribe from this
| mailing list
hould be pointed out, though, that Analog can be used to see which
files a particular user accessed, but only one user at a time. If you use
the USERINCLUDE command, then all files listed in the Request report were
accessed by the specified user.
If you want to see all the
> Also, are there any advantages to using the W3C format instead of
> the IIS log format?
I think you have that question the wrong way round. There are NO
advantages to running the IIS log format. W3C is always better.
h
to my local time?
You want the LOGTIMEOFFSET directive:
http://www.analog.cx/docs/output.html#TIMEOFFSET
Aengus
+
| This is the analog-help mailing list. To unsubscribe from this
| mailing list, go to
|http://lists.i
27;t
work as an APACHELOGFORMAT, but did work as a LOGFORMAT. Apache, for
example, uses \"%{Referer}i\" whereas Analog uses "%f".
Aengus
+
| This is the analog-help mailing list. To unsubscribe from t
"Bruce Keene" <[EMAIL PROTECTED]> wrote:
> Can anyone tell me how to set up domain reports for analog
Analog does Domain reports automatically, but you have to do DNS lookups
to get anything useful.
http://www.analog.cx/docs/faq.
1 - 100 of 637 matches
Mail list logo
