[analog-help] Problems with definition for apache webserver runningon IBM system i5

[Aengus]

Rolf Busch <Busch at pcsacc400.de> wrote:
>> Hello there,
>> we've a apache webserver running on the ibm system i5.
>>
>> I've build a big file from the high number of daily access logs with
>> MergeLog.
>>
>> This are typical data in the log files
>>
>> 65.36.241.79 - - [13/Jul/2006:00:21:36 +0200] "HEAD / HTTP/1.1" 200
>> -"
>> 57.86.133.98 - - [13/Jul/2006:00:50:18 +0200] "GET /img/preisean.gif
>> C: 65.36.241.79 - - [13/Jul/2006:00:21:36 +0200] "HEAD / HTTP/1.1"
>> 200 -"
>> C:
>>      *
>> C: 57.86.133.98 - - [13/Jul/2006:00:50:18 +0200] "GET
>> /img/preisean.gif HTTP/1.1" 304 -"
>> C:                               *
>>
>> Thats the enries from the config file
>> LOGFORMAT (%s %j %j [%d/%M/%Y:%h:%n:%t %j] "%j%w%r%wHTTP"%W%j%W%b%j)
>>
>> The program has problems with the last byte "
>>
>> Any idea?
>>
>> Whats going wrong with my definitions?

200 and 304 aren't byte counts, they're HTTP status codes. But that's 
not your problem.

Analog generates the following error when you use your LOGFORMAT:

analog: Warning C: Bad argument in configuration command: ignoring it:
  LOGFORMAT (%S %j %j [%d/%M/%Y:%h:%n:%t %j] "%j%w%r%wHTTP"%W%j%W%b%j)
analog: ...cont..:   (reason: an unterminated string is present)

The "unterminated string" string message is a bit misleading - the 
actual problem is that you're used %W (uppercase) when %W isn't a 
recognized part of a LOGFORMAT command. If you change the %W to %w (or 
just put in the easier to read space), then you'll see that your 
LOGFORMAT doesn't refer to the HTTP version (/1.1 or /1.0). So the 
request part of your logformat should look like "%j %r %j" instead of 
"%j%w%r%wHTTP".

The last part of your log entries is [200 -"]  or [304 -"] - that's just 
[%c -"]  (I've just used the the brackets for legibility).

LOGFORMAT (%s %j %j [%d/%M/%Y:%h:%n:%t %j] "%j %r %j" %c -")
will read the 2 sample lines you provided - but that trailing " suggests 
that your logging process is misconfigured.

Aengus