Your LOGFORMAT is wrong. I realise it's in the documentation, but only as the last LOGFORMAT of three. With "%r" in the LOGFORMAT, your filename is "GET /b/a.html HTTP/1.1" not "/b/a.html". PS You know there's a Debian package of analog? -- Stephen Turner