Well,
I sincerely wish I could recall what the analog config line was that I used
to produce this analog output but, if you look here:
http://www.columbia.edu/~jf2412/test_report.html
You'll see that analog was able to parse most of the 6,846,761 lines in the
one logfile I'm using for testing. Unfortunately, I overwrote the LOGFORMAT
string I used, but this LOGFORMAT determined that only 50,735 lines of the
logfile were corrupted.
So.. Here's an update. It seems that the logfiles I have to work with are
actually being written to using two different apache logformats. Here they
are:
LogFormat "%h %l %u %t \"(%r)\" %>s %b \"(ref %{Referer}i)\" \"(client
%{User-agent}i)\" \"(elapsed %D)\"" mainserver
LogFormat "%h %l %u %t \"(%r)\" %>s %b \"(ref %{Referer}i)\" \
\"(client %{User-agent}i)\" \"vhost %v\" \"(elapsed %D)\"" virtualhost
Both of those formats are being used to write to the same apache logfile.
It is that logfile that I'm trying to analyze using Analog.
Among many experiments I tried this:
LOGFORMAT '%S - - [%d/%M/%Y:%h:%n:%j %j] "(%j %r %j)" %c %b "(%j %f)"
"(%B)"' and it kinda worked as you can see here:
http://www.columbia.edu/~jf2412/test6.html
Which complains that 6,394,424 lines of the logfile are corrupted.
And I tried this:
APACHELOGFORMAT '%h %l %u %t \"(%r)\" %>s %b \"(%{Referer}i)\"
\"(%{User-agent}i)\" \"%v\"' which is ALMOST an exact replica of the
'virtualhost' version of the apache logformat...
The results if this analysis are here:
http://www.columbia.edu/~jf2412/test10.html
This analysis says that 6,878,070 lines are corrupted....
At this point, I would love it if someone really smart could provide me a
LOGFORMAT format or an APACHELOGFORMAT format that I could try that would
get me the least worst results.
:-)
Meanwhile, I'll keep reading, learning and experimenting.
Best wishes,
Joshua
+------------------------------------------------------------------------
| TO UNSUBSCRIBE from this list:
| http://lists.meer.net/mailman/listinfo/analog-help
|
| Analog Documentation: http://analog.cx/docs/Readme.html
| List archives: http://www.analog.cx/docs/mailing.html#listarchives
| Usenet version: news://news.gmane.org/gmane.comp.web.analog.general
+------------------------------------------------------------------------
I sincerely wish I could recall what the analog config line was that I used
to produce this analog output but, if you look here:
http://www.columbia.edu/~jf2412/test_report.html
You'll see that analog was able to parse most of the 6,846,761 lines in the
one logfile I'm using for testing. Unfortunately, I overwrote the LOGFORMAT
string I used, but this LOGFORMAT determined that only 50,735 lines of the
logfile were corrupted.
So.. Here's an update. It seems that the logfiles I have to work with are
actually being written to using two different apache logformats. Here they
are:
LogFormat "%h %l %u %t \"(%r)\" %>s %b \"(ref %{Referer}i)\" \"(client
%{User-agent}i)\" \"(elapsed %D)\"" mainserver
LogFormat "%h %l %u %t \"(%r)\" %>s %b \"(ref %{Referer}i)\" \
\"(client %{User-agent}i)\" \"vhost %v\" \"(elapsed %D)\"" virtualhost
Both of those formats are being used to write to the same apache logfile.
It is that logfile that I'm trying to analyze using Analog.
Among many experiments I tried this:
LOGFORMAT '%S - - [%d/%M/%Y:%h:%n:%j %j] "(%j %r %j)" %c %b "(%j %f)"
"(%B)"' and it kinda worked as you can see here:
http://www.columbia.edu/~jf2412/test6.html
Which complains that 6,394,424 lines of the logfile are corrupted.
And I tried this:
APACHELOGFORMAT '%h %l %u %t \"(%r)\" %>s %b \"(%{Referer}i)\"
\"(%{User-agent}i)\" \"%v\"' which is ALMOST an exact replica of the
'virtualhost' version of the apache logformat...
The results if this analysis are here:
http://www.columbia.edu/~jf2412/test10.html
This analysis says that 6,878,070 lines are corrupted....
At this point, I would love it if someone really smart could provide me a
LOGFORMAT format or an APACHELOGFORMAT format that I could try that would
get me the least worst results.
:-)
Meanwhile, I'll keep reading, learning and experimenting.
Best wishes,
Joshua
+------------------------------------------------------------------------
| TO UNSUBSCRIBE from this list:
| http://lists.meer.net/mailman/listinfo/analog-help
|
| Analog Documentation: http://analog.cx/docs/Readme.html
| List archives: http://www.analog.cx/docs/mailing.html#listarchives
| Usenet version: news://news.gmane.org/gmane.comp.web.analog.general
+------------------------------------------------------------------------