[analog-help] LOGFORMAT assistance required please

[Aengus]

On Sunday, February 11, 2007 11:31 PM [EDT],
andrew.ac.main at centrelink.gov.au <andrew.ac.main at centrelink.gov.au> wrote:

>> Hi there,
>>
>> Analog doesn't like these logs in the following format:
>>
>> 172.23.9.16 - - [04/Feb/2007:13:00:00 +1100] "GET
>> http://www.medicareaustralia.gov.au/apps/lspn/lspn.nsf/842af780a4270557ca256d02001c8864?OpenView&Start=72&Count=30&Collapse=65
>> HTTP/1.0" 200 -  553 13220 123270

If you turn DEBUG ON, you'll see that analog doesn't know what the last 3 
fields are. I can't tell what the 4th field from the end is either, so this 
LOGFORMAT will parse the lines that you have provided:

LOGFORMAT (%S %j %j [%d/%M/%Y:%h:%n:%j %j] "%j %r %j" %c %j)

Aengus