[analog-help] Need Help w/ Apache Log

[Aengus]

On Thursday, September 06, 2007 8:36 PM [EDT],
Raj Hungund <RHungund at comcastnets.com> wrote:

> Hey guys...I can't get even the most simplest of log analysis working
> for Apache/Analog
>
> Here's my logformat:
>
> LogFormat "%h %v %u %t \"%r\" %>s %b \"%{Referer}i\"
> \"%{User-Agent}i\" %{EOL_GEO_COUNTRY}n %{EOL_GEO_REGION}n
> %{EOLUSERID}n" combined
>
>
> 75.32.62.215 forums.####.com> - [04/Sep/2007:00:00:39 -0700] "GET
> /style/style.jsp HTTP/1.1" 200 49170
> "http://forums.####.com/thread.jspa?messageID=12791910&#12791910"
> "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; YPC 3.0.3)"
> US TX CTL4D9B11078F08418A7ADF39A5524ACB46
>
> 75.32.62.215 forums.####.com> - [04/Sep/2007:00:00:42 -0700] "GET
> /recent-history.jspa?messageID=12791910 HTTP/1.1" 200 1763
> "http://forums.####.com/thread.jspa?messageID=12791910&#12791910"
> "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; YPC 3.0.3)"
> - - -
>
> 75.32.62.215 forums.####.com> - [04/Sep/2007:00:00:42 -0700] "GET
> /resources/scripts/prototype/prototype.js HTTP/1.1" 200 14503
> "http://forums.####.com/recent-history.jspa?messageID=12791910"
> "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; YPC 3.0.3)"
> - - -
>
>
> I've tried to cut it down to just:
> 75.32.62.215
> APACHELOGFORMAT (%s)

Is %s a valid marker in a httpd.conf LogFormat command? Shouldn't it be %h 
in "apache"?

> When I try:
> 75.32.62.215 forums.####.com
> APACHELOGFORMAT (%h %v)
>
> It kind of works.

Unless the logformat in your httpd.conf works "out of the box" you're better 
off ignoring the APACHELOGFORMAT command, and just build an analog LOGFORMAT 
from scratch.

LOGFORMAT (%s %v> %j [%d/%M/%Y:%h:%n:%j] "%j %r %j" %c %b "%f" "%B" %j %j 
%u)

matches your sample logfile lines, and treats the last field (%{EOLUSERID}n) 
as the UserID field - the Geo fields are ignored.

Aengus