Mailing List Archive

On 6/4/2008 7:00 AM, Joe wrote:
> I don't know how to tell analog the format of my logfile.
>
> The log file in question is for Blackboard WebCT Vista and looks like this:
> http://joefylan.co.uk/logs/webct_monitor.log
>
> Can a log file of this format be analysed by analog and if so how?

I can't see anything in that log file to analyze. It's an event log of
some sort, not a web log. There aren't any records of web requests that
I can see in the log file.

Aengus
+------------------------------------------------------------------------
| TO UNSUBSCRIBE from this list:
| http://lists.meer.net/mailman/listinfo/analog-help
|
| Analog Documentation: http://analog.cx/docs/Readme.html
| List archives: http://www.analog.cx/docs/mailing.html#listarchives
| Usenet version: news://news.gmane.org/gmane.comp.web.analog.general
+------------------------------------------------------------------------

Thanks for having a look.

How about this webserver.log:
2008-06-04 06:19:44 0.056 163.167.82.61 1zk4LGlY8Yzy5yflRTsT 200 GET /webct/urw/lc61300502021.tp61300522021/courseFS.dowebct tab=view&forward=studentCourseView.dowebct&lcid=61300502021 15348 FIW0021:0:6

Thanks

2008/6/4 Aengus <analog07@eircom.net>:
> On 6/4/2008 7:00 AM, Joe wrote:
>>
>> I don't know how to tell analog the format of my logfile.
>>
>> The log file in question is for Blackboard WebCT Vista and looks like
>> this:
>> http://joefylan.co.uk/logs/webct_monitor.log
>>
>> Can a log file of this format be analysed by analog and if so how?
>
> I can't see anything in that log file to analyze. It's an event log of some
> sort, not a web log. There aren't any records of web requests that I can see
> in the log file.
>
> Aengus
> +------------------------------------------------------------------------
> | TO UNSUBSCRIBE from this list:
> | http://lists.meer.net/mailman/listinfo/analog-help
> |
> | Analog Documentation: http://analog.cx/docs/Readme.html
> | List archives: http://www.analog.cx/docs/mailing.html#listarchives
> | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general
> +------------------------------------------------------------------------
>
+------------------------------------------------------------------------
| TO UNSUBSCRIBE from this list:
| http://lists.meer.net/mailman/listinfo/analog-help
|
| Analog Documentation: http://analog.cx/docs/Readme.html
| List archives: http://www.analog.cx/docs/mailing.html#listarchives
| Usenet version: news://news.gmane.org/gmane.comp.web.analog.general
+------------------------------------------------------------------------

Joe <joefylan@gmail.com> wrote:
> Thanks for having a look.
>
> How about this webserver.log:
> 2008-06-04 06:19:44 0.056 163.167.82.61 1zk4LGlY8Yzy5yflRTsT 200 GET
> /webct/urw/lc61300502021.tp61300522021/courseFS.dowebct
> tab=view&forward=studentCourseView.dowebct&lcid=61300502021 15348
> FIW0021:0:6

LOGFORMAT (%y-%m-%d%w%h:%n:%j%w%j%w%S%w%u%w%c%w%j%w%r%w%q%w%b%w%j)

(The %w marks out white space - it makes the logformat hard to read, but it will cover spaces or tabs between the fields, and your example looks like it has tabs between the fields).

To break the line down, the fields, in order, look to me like this:
%Y-%m-%d Year-month-day, 2008-06-04
%h:%n:%j hour:minutes:junk, 06:19:44 (Analog doesn't do seconds)
%j junk, 0.056 (this might be processing time, %t)
%S Host address, 163.167.82.61
%u User, 1zk4LGlY8Yzy5yflRTsT
%c Status code, 200
%j junk, GET (the Request method - not relevant for analysis)
%r Request, /webct/urw/lc613...urseFS.dowebct
%q querystring, tab=view&for...502021
%b bytes transferred, 15348
%j junk, FIW0021:0:6

The "User" field is probably just a cookie, or sessionID, but you can use the User Report to count the sessions. If you don't need to count individual sessions, you can set it to %j)

Aengus

+------------------------------------------------------------------------
| TO UNSUBSCRIBE from this list:
| http://lists.meer.net/mailman/listinfo/analog-help
|
| Analog Documentation: http://analog.cx/docs/Readme.html
| List archives: http://www.analog.cx/docs/mailing.html#listarchives
| Usenet version: news://news.gmane.org/gmane.comp.web.analog.general
+------------------------------------------------------------------------

Thanks for that.

However, I have run it and got this message via the command prompt window:
C:\Program Files\analog 6.0>analog.exe
analog.exe: analog version 6.0/Win32
analog.exe: Warning L: Large number of corrupt lines in logfile
H:\Work\WebLearn_Analog\logs\webserver.log: turn debugging on or try
different LOGFORMAT
(For help on all errors and warnings, see docs/errors.html)
Current logfile format:
%y-%m-%d%w%h:%n:%j%w%j%w%S%w%j%w%c%w%j%w%r%w%q%w%b%w%j\n
analog.exe: Warning R: Turning off empty time reports
analog.exe: Warning R: Turning off empty Request Report
analog.exe: Warning R: Turning off empty File Type Report
analog.exe: Warning R: Turning off empty Directory Report
analog.exe: Warning R: Turning off empty Domain Report
analog.exe: Warning R: Turning off empty Organisation Report
analog.exe: Warning R: Turning off empty Search Word Report
analog.exe: Warning R: Turning off empty Operating System Report
analog.exe: Warning R: Turning off empty File Size Report
analog.exe: Warning R: Turning off empty Status Code Report

The report HTML file states:
Successful requests: 0
Corrupt logfile lines: 34,599

Any ideas?

2008/6/4 Aengus <analog07@eircom.net>:
> Joe <joefylan@gmail.com> wrote:
>> Thanks for having a look.
>>
>> How about this webserver.log:
>> 2008-06-04 06:19:44 0.056 163.167.82.61 1zk4LGlY8Yzy5yflRTsT 200 GET
>> /webct/urw/lc61300502021.tp61300522021/courseFS.dowebct
>> tab=view&forward=studentCourseView.dowebct&lcid=61300502021 15348
>> FIW0021:0:6
>
> LOGFORMAT (%y-%m-%d%w%h:%n:%j%w%j%w%S%w%u%w%c%w%j%w%r%w%q%w%b%w%j)
>
> (The %w marks out white space - it makes the logformat hard to read, but it will cover spaces or tabs between the fields, and your example looks like it has tabs between the fields).
>
> To break the line down, the fields, in order, look to me like this:
> %Y-%m-%d Year-month-day, 2008-06-04
> %h:%n:%j hour:minutes:junk, 06:19:44 (Analog doesn't do seconds)
> %j junk, 0.056 (this might be processing time, %t)
> %S Host address, 163.167.82.61
> %u User, 1zk4LGlY8Yzy5yflRTsT
> %c Status code, 200
> %j junk, GET (the Request method - not relevant for analysis)
> %r Request, /webct/urw/lc613...urseFS.dowebct
> %q querystring, tab=view&for...502021
> %b bytes transferred, 15348
> %j junk, FIW0021:0:6
>
> The "User" field is probably just a cookie, or sessionID, but you can use the User Report to count the sessions. If you don't need to count individual sessions, you can set it to %j)
>
> Aengus
>
> +------------------------------------------------------------------------
> | TO UNSUBSCRIBE from this list:
> | http://lists.meer.net/mailman/listinfo/analog-help
> |
> | Analog Documentation: http://analog.cx/docs/Readme.html
> | List archives: http://www.analog.cx/docs/mailing.html#listarchives
> | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general
> +------------------------------------------------------------------------
>
+------------------------------------------------------------------------
| TO UNSUBSCRIBE from this list:
| http://lists.meer.net/mailman/listinfo/analog-help
|
| Analog Documentation: http://analog.cx/docs/Readme.html
| List archives: http://www.analog.cx/docs/mailing.html#listarchives
| Usenet version: news://news.gmane.org/gmane.comp.web.analog.general
+------------------------------------------------------------------------

On 6/5/2008 7:01 AM, Joe wrote:
> Thanks for that.
>
> However, I have run it and got this message via the command prompt window:
> C:\Program Files\analog 6.0>analog.exe
> analog.exe: analog version 6.0/Win32
> analog.exe: Warning L: Large number of corrupt lines in logfile
> H:\Work\WebLearn_Analog\logs\webserver.log: turn debugging on or try
> different LOGFORMAT
> (For help on all errors and warnings, see docs/errors.html)
> Current logfile format:
> %y-%m-%d%w%h:%n:%j%w%j%w%S%w%j%w%c%w%j%w%r%w%q%w%b%w%j\n

Oops, a typo on my part. the year field is a 4 digit field, so it's %Y
rather than %y.

LOGFORMAT (%Y-%m-%d%w%h:%n:%j%w%j%w%S%w%u%w%c%w%j%w%r%w%q%w%b%w%j)

(I had corrected that in my breakdown of the fields, but I forgot to fix
it in the LOGFORMAT string).

Aengus
+------------------------------------------------------------------------
| TO UNSUBSCRIBE from this list:
| http://lists.meer.net/mailman/listinfo/analog-help
|
| Analog Documentation: http://analog.cx/docs/Readme.html
| List archives: http://www.analog.cx/docs/mailing.html#listarchives
| Usenet version: news://news.gmane.org/gmane.comp.web.analog.general
+------------------------------------------------------------------------

Thank you very much.

That is now working.

On 05/06/2008, Aengus <analog07@eircom.net> wrote:
> On 6/5/2008 7:01 AM, Joe wrote:
>
> > Thanks for that.
> >
> > However, I have run it and got this message via the command prompt window:
> > C:\Program Files\analog 6.0>analog.exe
> > analog.exe: analog version 6.0/Win32
> > analog.exe: Warning L: Large number of corrupt lines in logfile
> > H:\Work\WebLearn_Analog\logs\webserver.log: turn
> debugging on or try
> > different LOGFORMAT
> > (For help on all errors and warnings, see docs/errors.html)
> > Current logfile format:
> >
> %y-%m-%d%w%h:%n:%j%w%j%w%S%w%j%w%c%w%j%w%r%w%q%w%b%w%j\n
> >
>
> Oops, a typo on my part. the year field is a 4 digit field, so it's %Y
> rather than %y.
>
> LOGFORMAT
> (%Y-%m-%d%w%h:%n:%j%w%j%w%S%w%u%w%c%w%j%w%r%w%q%w%b%w%j)
>
> (I had corrected that in my breakdown of the fields, but I forgot to fix it
> in the LOGFORMAT string).
>
>
> Aengus
> +------------------------------------------------------------------------
> | TO UNSUBSCRIBE from this list:
> | http://lists.meer.net/mailman/listinfo/analog-help
> |
> | Analog Documentation: http://analog.cx/docs/Readme.html
> | List archives:
> http://www.analog.cx/docs/mailing.html#listarchives
> | Usenet version:
> news://news.gmane.org/gmane.comp.web.analog.general
> +------------------------------------------------------------------------
>
+------------------------------------------------------------------------
| TO UNSUBSCRIBE from this list:
| http://lists.meer.net/mailman/listinfo/analog-help
|
| Analog Documentation: http://analog.cx/docs/Readme.html
| List archives: http://www.analog.cx/docs/mailing.html#listarchives
| Usenet version: news://news.gmane.org/gmane.comp.web.analog.general
+------------------------------------------------------------------------