[analog-help] Only include logs that has a certain string

[Aengus]

On Wednesday, November 28, 2007 6:43 PM [EDT],
Ridwan <ridwan at chemwatch.net> wrote:

> Hi Anegus,
>
> Thanks for your response. Sorry I should have been more specific. In
> my IIS log file, among other logging properties I also log the "URI
> Query (cs-uri-query)" which basically is the web request URLs sent
> back from the clients to the web server. For example, in the IIS log,
> URI Query logged for a line is the string:
> "operation=checkpass&user=mnphmf&pwd=blahblah&passdirect=y" and for my
> Analog report I want to take into account only the lines from that IIS
> log file which has the word "mnphmf" in them or may be "user=mnphmf"
> in them. This way I would know exactly how many times they logged
> into my server. By the way, we run CGI based web applications on our
> web server and hence most of the activities are not pulling up just
> static files, they are rather web requests as URLs from the clients
> sent to the server which executes a .exe CGI program with parameters
> at the server and it sends back a dynamic HTML page as streams to the
> client. Its (CGI) a very old technology but works well for our
> heavily database driven applications.

I'm sure that there's a better way, but the first thing that coes to mind is 
a slightly convoluted process using a FILEALIAS.

FILEALIAS *.cgi?*mnphmf* $1.abc?$2mnphmf$3

will take all calls to your script and convert the script extension to .abc, 
if and only if that particular line includes the string you care about. Then 
if you use

FILEINCLUDE *.abc*

analog will report on just those lines.

(By the way, I'm subscribed to the list. Just reply to the list, if you cc 
me, I end up with 2 copies of your message, and I only need 1).

Aengus