[analog-help] Need Help w/ Apache Log

[Raj Hungund]

Thanks Aengus.  Looks like that worked. 

Best,

-Raj 

-----Original Message-----
From: analog-help-bounces at lists.meer.net
[mailto:analog-help-bounces at lists.meer.net] On Behalf Of Aengus
Sent: Thursday, September 06, 2007 5:58 PM
To: Support for analog web log analyzer
Subject: Re: [analog-help] Need Help w/ Apache Log

On Thursday, September 06, 2007 8:36 PM [EDT], Raj Hungund
<RHungund at comcastnets.com> wrote:

> Hey guys...I can't get even the most simplest of log analysis working 
> for Apache/Analog
>
> Here's my logformat:
>
> LogFormat "%h %v %u %t \"%r\" %>s %b \"%{Referer}i\"
> \"%{User-Agent}i\" %{EOL_GEO_COUNTRY}n %{EOL_GEO_REGION}n 
> %{EOLUSERID}n" combined
>
>
> 75.32.62.215 forums.####.com> - [04/Sep/2007:00:00:39 -0700] "GET 
> /style/style.jsp HTTP/1.1" 200 49170 
> "http://forums.####.com/thread.jspa?messageID=12791910&#12791910"
> "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; YPC 3.0.3)"
> US TX CTL4D9B11078F08418A7ADF39A5524ACB46
>
> 75.32.62.215 forums.####.com> - [04/Sep/2007:00:00:42 -0700] "GET 
> /recent-history.jspa?messageID=12791910 HTTP/1.1" 200 1763 
> "http://forums.####.com/thread.jspa?messageID=12791910&#12791910"
> "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; YPC 3.0.3)"
> - - -
>
> 75.32.62.215 forums.####.com> - [04/Sep/2007:00:00:42 -0700] "GET 
> /resources/scripts/prototype/prototype.js HTTP/1.1" 200 14503 
> "http://forums.####.com/recent-history.jspa?messageID=12791910"
> "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; YPC 3.0.3)"
> - - -
>
>
> I've tried to cut it down to just:
> 75.32.62.215
> APACHELOGFORMAT (%s)

Is %s a valid marker in a httpd.conf LogFormat command? Shouldn't it be
%h in "apache"?

> When I try:
> 75.32.62.215 forums.####.com
> APACHELOGFORMAT (%h %v)
>
> It kind of works.

Unless the logformat in your httpd.conf works "out of the box" you're
better off ignoring the APACHELOGFORMAT command, and just build an
analog LOGFORMAT from scratch.

LOGFORMAT (%s %v> %j [%d/%M/%Y:%h:%n:%j] "%j %r %j" %c %b "%f" "%B" %j
%j
%u)

matches your sample logfile lines, and treats the last field
(%{EOLUSERID}n) as the UserID field - the Geo fields are ignored.

Aengus 

+-----------------------------------------------------------------------
+-
|  TO UNSUBSCRIBE from this list:
|    http://lists.meer.net/mailman/listinfo/analog-help
|
|  Analog Documentation: http://analog.cx/docs/Readme.html  List 
| archives:  http://www.analog.cx/docs/mailing.html#listarchives
|  Usenet version: news://news.gmane.org/gmane.comp.web.analog.general
+-----------------------------------------------------------------------
+-