Tried it, and works fine !
Thanks again
Johan
From: "Johan Eeckhout" <[EMAIL PROTECTED]> Reply-To: Support for analog web log analyzer <analog-help@lists.meer.net> To: analog-help@lists.meer.net Subject: Re: [analog-help] Corrupt lines due to Referrer field Date: Thu, 07 Apr 2005 07:23:25 +0000
Indeed, the other lines have referrer between quotes.
By the way, I was not entirely correct saying I was using IIS files; actually the logging comes from our firewall, which is not MS at all.
Anyway, I'll try your solution later on and give you feedback.
Thanks!
Johan
From: "Aengus" <[EMAIL PROTECTED]> Reply-To: Support for analog web log analyzer <analog-help@lists.meer.net> To: "Support for analog web log analyzer" <analog-help@lists.meer.net> Subject: Re: [analog-help] Corrupt lines due to Referrer field Date: Wed, 6 Apr 2005 23:00:29 +0100
On Wednesday, April 06, 2005 10:03 PM [GMT], Johan Eeckhout <[EMAIL PROTECTED]> wrote:
> Hi, > > I'm trying to build a report with some IIS logfiles using Analog 6. > Analog reports lots of corrupt lines. I turned on debugging and got > this : > ------------- > C: 1110026691376 192.168.5.15 - 2005-03-05 12:44:51.376 GET > /IXDIA01EN/Fr/upload_input.asp - 200 5060 - "Mozilla/4.0 (compatible; > MSIE > 6.0)" > C: > * > ------------- > (Asterisk is shown for cs(referer) field). > > The logfile format is as follows : > --------------- > #Fields: x-tmstp c-ip c-auth-id date time cs-method cs-uri-stem > cs-uri-query sc-status sc-bytes cs(referer) cs(user-agent) > --------------- > > Apparently analog has a problem with the Referrer field when it > equals "-", since all entries where the Referrer field has another > value are accepted just fine. > > Any ideas ?
That's odd. If I create a 2 line logfile with just your #Fields line and that one log line, Analog says "F: Detect that it's in W3 extended format", but doesn't like your referrer. If I put the 3 lines from an IIS log file that cause Analog to see the log file as "Microsoft's version of extended format", Analog has no problem with your Referrer.
This old post from the archives suggests that W3 Extended format is supposed to have quotes around referrers, and that IIS didn't do this, so Analog treats it as a special case, which is why "tricking" Analog into treating your logfile as an IIS logfile works. But the W3 "definition" was never actually finished, as far as I can remember, and there were other issues with it. http://lists.meer.net/pipermail/analog-help/2001-November/010515.html
Do the log entries that do have referrers have quotes? If they do, you could use these two LOGFORMAT strings together to read your logfile:
LOGFORMAT (%j %s %u %Y-%m-%d %h:%n:%j %j %r %q %c %b "%f" "%B")
LOGFORMAT (%j %s %u %Y-%m-%d %h:%n:%j %j %r %q %c %b %f "%B")
(You can use DEFAULTLOGFORMAT if you want to keep specifying the logfile on the command line).
Aengus
+------------------------------------------------------------------------ | TO UNSUBSCRIBE from this list: | http://lists.meer.net/mailman/listinfo/analog-help | | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general | List archives: http://www.analog.cx/docs/mailing.html#listarchives +------------------------------------------------------------------------
_________________________________________________________________
Is your PC infected? Get a FREE online computer virus scan from McAfee® Security. http://clinic.mcafee.com/clinic/ibuy/campaign.asp?cid=3963
+------------------------------------------------------------------------ | TO UNSUBSCRIBE from this list: | http://lists.meer.net/mailman/listinfo/analog-help | | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general | List archives: http://www.analog.cx/docs/mailing.html#listarchives +------------------------------------------------------------------------
_________________________________________________________________
Don’t just search. Find. Check out the new MSN Search! http://search.msn.click-url.com/go/onm00200636ave/direct/01/
+------------------------------------------------------------------------ | TO UNSUBSCRIBE from this list: | http://lists.meer.net/mailman/listinfo/analog-help | | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general | List archives: http://www.analog.cx/docs/mailing.html#listarchives +------------------------------------------------------------------------
