[analog-help] Logfile lines without status code - Huge number

[Aengus]

Sokolow, Daniel <DSokolow at nshs.edu> wrote:
> All,
>
> I just ran Analog and got a weird listing in the general summary - the
> "Logfile lines without status code" was listed as 5500, which seemed
> an awfully large number for one month on this server.
>
> So I ran another report limited by a smaller subset of days, and
> finally I thought I had it localized to a single day and ran a report
> for that day.  But when I looked at the logfiles themselves for that
> day, there's only a single entry at all in the logs?  Where would
> those additional logfile lines be coming from?

?? You have a logfile with 1 line in it and Analog is reporting that it 
contains 5500 lines without a status code?

> Everything else for the month looks normal, so I am guessing it's not
> impacting my numbers, but it seems odd and I wondered if anyone had a
> suggestion for diagnosing the issue.  Since the prior 7 months of logs
> had 4700 lines without status code, it seems odd to have that large a
> number in one month.

If you're not specifying a LOGFORMAT, and Analog is autodetecting your 
logfile, there may be something that is causing it to misinterpret some 
lines as being a different format, and it's not seeing the status code 
in that case. Comment lines (such as the #Fields lines that are used to 
specify a format) are recognized as valid lines, but they don't have a 
status code, so if your web server was restarted a couple of hundred 
times that day, you could end up with a bunch of lines without status 
code (though you'd probably have noticed that your server was restarted!

Try specifying the particular LOGFORMAT that you think Analog should be 
using, and see if the "Lines without Status code" change to "Corrupt 
lines". That would indicate that something is injecting non-standard log 
entries into your logfile that are close enough to a valid format that 
they are being recognized as valid, but without a status code.

Aengus