I've been trying to get analog to work with my access log but I keep getting
errors. The format is (with a few sample lines):
#Fields: date time c-ip cs-uri sc-status s-ip cs(Referer) cs(User-Agent)
sc-bytes time-taken cs(Cookie)
2004-06-18 12:42:28.774 10.0.0.132 /salesportal/index.jsp 200 - -
Hi there,
Analog tells me that I have al lot of corrupt lines. I've tried to use different log
formats. I've used Debugging to isolate the corrupted line.
The corrupted lines looks like this:
212.64.86.46||-none||01/Jan/2002:13:30:42 +0100||-||GET
/portals/web/images/communication/chat/a4chat
I have some logs that are transferred to my machine from another machine.
When I ran analog for those files, this is the error I received:
/usr/local/bin/analog: analog version 5.24/Unix
/usr/local/bin/analog: Warning L: Large number of corrupt lines in logfile
/home/nettracker/logs/error_gk: tu
Have you tried without any LOGFORMAT command? That's the recommended
practice when using W3C extended log file formats.
--
Jeremy Wadsack
Seven Simple Machines
Kirk Everett wrote:
I've been trying to get analog to work with my access log but I keep
getting errors. The format is (with a few sampl
d/1.0
32865 0.031 -
C: *
From: Jeremy Wadsack <[EMAIL PROTECTED]>
Reply-To: [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Subject: Re: [analog-help] Log Format Problem
Date: Fri, 18 Jun 2004 09:20:17 -0700
Have you tried without an
"Jerry Caupain" <[EMAIL PROTECTED]>
> Analog tells me that I have al lot of corrupt lines. I've tried
> to use different log formats. I've used Debugging to isolate the
corrupted line.
> The corrupted lines looks like this:
>
...
>WebLogicSession=mZMFXUJfsT2w1q9|8645484
>
> I've tried the
That did the trick!!
Thanx a lot for helping me out!
Kind regards,
Jerry
>>> [EMAIL PROTECTED] 02/01/02 03:49PM >>>
"Jerry Caupain" <[EMAIL PROTECTED]>
> Analog tells me that I have al lot of corrupt lines. I've tried
> to use different log formats. I've used Debugging to isolate the
corru
Indira wrote:
> APACHELOGFORMAT (%v %s %j %j [%d/%M/%Y:%h:%n:%j]"%j%w%r%wHTTP%j" %c %b
> "%f" "%j")
The log files have a space after the date, so the format above would not
match. The following three rules should work:
LOGFORMAT (%v %S %j %u [%d/%M/%Y:%h:%n:%j] "%j%w%r%wHTTP%j" %c %b "%f"
"%B")
L
I too have a similar problem. I'm not a programmer, so even after reading
the errors.html, I'm not sure what it means. Can someone please help me:
My current Logformat is:
LOGFORMAT (%v %S %j %u [%d/%M/%Y:%h:%n:%j] "%r" %c %b "%f" "%B")
My error is:
Warning L: Large number of corrupt lines in lo
Alfred <[EMAIL PROTECTED]> wrote:
> I too have a similar problem. I'm not a programmer, so even after
> reading the errors.html, I'm not sure what it means.
"Large number of corrupt lines in logfile access_log" means exactly what it says -
Analog can't figure out how to interpret the entries in
Indira <[EMAIL PROTECTED]> wrote:
> The log format in the analog.cfg was
> APACHELOGFORMAT (%v %h %l %u %t \"%r\" %>s %b \"%{Referer}i\"
> \"%{User-Agent}i\")
> sample log file:
> www.modernhumorist.com 202.138.202.38 - - [28/Nov/2002:00:04:52 -0500]
> "GET /images/new_on_mh.gif HTTP/1.0" 200 72
lt;[EMAIL PROTECTED]>
> Reply-To: [EMAIL PROTECTED]
> To: [EMAIL PROTECTED]
> Subject: Re: [analog-help] log format problem
>
> Indira <[EMAIL PROTECTED]> wrote:
>
> > The log format in the analog.cfg was
> > APACHELOGFORMAT (%v %h %l %u %t \"%r\" %
Indira <[EMAIL PROTECTED]> wrote:
> ok, i run DEBUG C and it looks that the lines that are corrupt are in
> the error log file.As you can see, the format is totally different.
> Any suggestion?
Are these errors in the main access log, or in a separate error log? If they're all in
the same logfil
Thank you, it worked.
Best,
Indira
On Fri, 29 Nov 2002, Aengus wrote:
> Date: Fri, 29 Nov 2002 17:18:20 -
> From: Aengus <[EMAIL PROTECTED]>
> Reply-To: [EMAIL PROTECTED]
> To: [EMAIL PROTECTED]
> Subject: Re: [analog-help] log format problem
>
> Indir
Can someone help me please,
My server is running on Apache
I can't get the correct log format.
My hosting support replied the below as the log format they use:
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\""
combined
LogFormat "%h %l %u %t \"%r\" %>s %b" common
LogFormat
On Sun, 1 Dec 2002, Alfred wrote:
> Can someone help me please,
>
> My server is running on Apache
> I can't get the correct log format.
> My hosting support replied the below as the log format they use:
>
> LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\""
> combined
> Lo
d Raw Log files?
Sorry I have to resort to asking here. My hosting support is below horrible.
Help Please.
-Alfred
- Original Message -
From: "Stephen Turner" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Sunday, December 01, 2002 6:51 PM
Subject: Re: [anal
On Sun, 1 Dec 2002, Alfred wrote:
> Tried it, still has corrupt lines and errors.
> I'm starting to wonder if what I have is the correct log file needed. Tried
> it on other Log Analysis tools, all report back with corrupt lines.
>
> Do I need to process it first? The file is just access_log. Is
p.exe HTTP/1.1" "-" 206 3150509
Like I said, if I tried other log files from other servers, it works fine,
just this log file from my hosting server.
Please help
Thanks,
- Alfred
- Original Message -
From: "Stephen Turner" <[EMAIL PROTECTED]>
To: <[EMAIL P
On Sun, 1 Dec 2002, Alfred wrote:
> Here it is:
>
> 66.28.233.165 - - [01/Dec/2002:03:50:01 -0500] "GET /robots.txt HTTP/1.0"
> "-" 404 1540
> 66.28.233.165 - - [01/Dec/2002:03:50:07 -0500] "GET /hyperscreensaver.html
> HTTP/1.0" "-" 200 13590
> payne-s195h245.resnet.uga.edu - - [01/Dec/2002:03:5
t;[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Sunday, December 01, 2002 8:58 PM
Subject: Re: [analog-help] log format problem
> On Sun, 1 Dec 2002, Alfred wrote:
>
> > Here it is:
> >
> > 66.28.233.165 - - [01/Dec/2002:03:50:01 -0500] "GET /robots.txt
HTT
On Sun, 1 Dec 2002, Alfred wrote:
> Thanks for the quick response. Like I said, the hosting support is below
> horrible.
>
> Is it possible for me to remove all "-" in the log by search and replace
> with nothing?
> What would the Logformat be then?
>
It's not necessary to do that. You can use
22 matches
Mail list logo
