Mailing List Archive: LOGFORMAT problem

Hi,
My problem is with LOGFORMAT. I thought I read to use the format from my httpd.conf file so I have. It loads a page with a few records but gives me the errors below:
I have degugging turned on and have tried several differnet examples of format including not using one and can't quite seem to get it right yet.

Any help you can offer would be great !

Thanks,
Ken

From httpd.conf - this is what I used in analog.cf
APACHELOGFORMAT (%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\")

A piece of the access log, I modified this because it has customer info but this is the format.
11.11.111.111 - - [30/Nov/2007:12:04:04 -0600] "GET /abc/ws/DI-4367/css/horizont
al_menu_styles.css HTTP/1.0" 200 2646 "https://customer/site" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; S
V1; .NET CLR 1.1.4322; .NET CLR 2.0.50727; InfoPath.1)"

The tail of the error.log
Closing logfile test.gz
S: Successful requests: 2
S: Redirected requests: 0
S: Failed requests: 0
S: Requests returning informational status code: 0
S: Status code not given: 0
S: Unwanted lines: 0
S: Corrupt lines: 263
analog: Warning L: Large number of corrupt lines in logfile test.gz: turn
debugging on or try different LOGFORMAT
Current logfile format:
%S %j %j [%d/%M/%Y:%h:%n:%j] "%j%w%r%wHTTP%j" %c %b "%f" "%B"\n
S: Earliest entry in logfile: 5/Dec/07:0009
S: Latest entry in logfile: 5/Dec/07:0009
F: Opening Report.html as output file

---------------------------------
Never miss a thing. Make Yahoo your homepage.

On Monday, December 10, 2007 9:37 PM [EDT],
Ken Mooney <ub687@yahoo.com> wrote:

>> Hi,
>> My problem is with LOGFORMAT. I thought I read to use the format
>> from my httpd.conf file so I have. It loads a page with a few
>> records but gives me the errors below: I have degugging turned on
>> and have tried several differnet examples of format including not
>> using one and can't quite seem to get it right yet.
>>
>> Any help you can offer would be great !
>>
>> Thanks,
>> Ken
>>
>>
>> From httpd.conf - this is what I used in analog.cf
>> APACHELOGFORMAT (%h %l %u %t \"%r\" %>s %b \"%{Referer}i\"
>> \"%{User-Agent}i\")
>>
>>
>> A piece of the access log, I modified this because it has customer
>> info but this is the format.
>> 11.11.111.111 - - [30/Nov/2007:12:04:04 -0600] "GET
>> /abc/ws/DI-4367/css/horizont
>> al_menu_styles.css HTTP/1.0" 200 2646 "https://customer/site"
>> "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; S
>> V1; .NET CLR 1.1.4322; .NET CLR 2.0.50727; InfoPath.1)"

That line matches the APACHELOGFORMAT above - if all the lines in your
logformat match that line, then you shoudn't have a problem.

>> The tail of the error.log
>> analog: Warning L: Large number of corrupt lines in logfile test.gz:
>> turn debugging on or try different LOGFORMAT
>> Current logfile format:
>> %S %j %j [%d/%M/%Y:%h:%n:%j] "%j%w%r%wHTTP%j" %c %b "%f" "%B"\n

This logformat also matches the sample line you provided, but it DOESN'T
match the APACHELOGFORMAT command - the 3rd field is %u in your
APACHELOGFORMAT. That suggests that your APACHELOGFORMAT isn't being read,
and that Analog is autoparsing the log entries (the sample line you provided
will be recognized automatically anyway). You mentioned analog.cf above - is
that a typo for analog.cfg?

You'll have to run Analog with DEBUG ON to see which log entries Analog is
seeing as corrupt. It will also give you an indication of which field in the
line doesn't match the LOGFORMAT that Analog is using.

Aengus

+------------------------------------------------------------------------
| TO UNSUBSCRIBE from this list:
| http://lists.meer.net/mailman/listinfo/analog-help
|
| Analog Documentation: http://analog.cx/docs/Readme.html
| List archives: http://www.analog.cx/docs/mailing.html#listarchives
| Usenet version: news://news.gmane.org/gmane.comp.web.analog.general
+------------------------------------------------------------------------