Mailing List Archive

Brian Clanton <bclanton@dupagels.lib.il.us> wrote:
> I have two types of log files for a Proxy Server that I am anylyzing
> with Analog:
>
> local 75.149.219.73 - - [18/Jul/2008:13:58:19 -0600] "GET
> http://infotrac.galegroup.com/itweb/caro83221?id=caro83221&db=LitRC
> HTTP/1.1" 301 555
> proxy 67.167.91.241 - fGKzhzjLu6flE6G [18/Jul/2008:14:33:07 -0600]
> "GET http://mldv.permissiontv.com/channels/carol_il HTTP/1.1" 200 0
>
> The logs can either "local" or "proxy". This designates whether or
> not a request is coming from inside of an IP range or outside of an
> IP range.
>
> My question is....
>
> How can I get a report within the Organisations Report to tell me how
> many requests are internal, "local" and how many are remote, "proxy"?

I'm not sure what you mean by "a report within the Organisations Report" but you can use one of the reports that you aren't currently using, and "hijack" it's field to report on how often a specific term turns up in that field.

For instance, if you're not using the User Report, you can create a logformat with %u in the first field, turn on the User Report, and it will show you how many request were made by the user "local" and how many were made by the user "proxy".

If you are using the User Report already, you can also repurpose the Virtual Host report in the same way. (You might be able to do something with the Browser Report too).

Aengus

+------------------------------------------------------------------------
| TO UNSUBSCRIBE from this list:
| http://lists.meer.net/mailman/listinfo/analog-help
|
| Analog Documentation: http://analog.cx/docs/Readme.html
| List archives: http://www.analog.cx/docs/mailing.html#listarchives
| Usenet version: news://news.gmane.org/gmane.comp.web.analog.general
+------------------------------------------------------------------------

2008/8/1 Brian Clanton <bclanton@dupagels.lib.il.us>:
>
> I have two types of log files for a Proxy Server that I am anylyzing with
> Analog:
>
> local 75.149.219.73 - - [18/Jul/2008:13:58:19 -0600] "GET
> http://infotrac.galegroup.com/itweb/caro83221?id=caro83221&db=LitRC
> HTTP/1.1" 301 555
> proxy 67.167.91.241 - fGKzhzjLu6flE6G [18/Jul/2008:14:33:07 -0600] "GET
> http://mldv.permissiontv.com/channels/carol_il HTTP/1.1" 200 0
>
> The logs can either "local" or "proxy". This designates whether or not a
> request is coming from inside of an IP range or outside of an IP range.
>
> My question is....
>
> How can I get a report within the Organisations Report to tell me how many
> requests are internal, "local" and how many are remote, "proxy"?
>

You can't use the Organisation Report because the organisation is
derived from the host of the visitor. However, you could define the
LOGFORMAT to label that field as %u and use the User Report to view
the data (or %v and the Virtual Host Report if you prefer).

--
Stephen Turner
+------------------------------------------------------------------------
| TO UNSUBSCRIBE from this list:
| http://lists.meer.net/mailman/listinfo/analog-help
|
| Analog Documentation: http://analog.cx/docs/Readme.html
| List archives: http://www.analog.cx/docs/mailing.html#listarchives
| Usenet version: news://news.gmane.org/gmane.comp.web.analog.general
+------------------------------------------------------------------------

When I use the User Report for identifying local verses proxy users, I only
get a readout of the proxy users, not local. I've played with some of the
FLOOR commands as they apply to the User report, but I cannot get Analog to
recogize the "local" requests in the log file. The floor command that would
seem to apply is:

USERFLOOR 1r

Which to me would mean "List all users with at least 1 request"

My logformat command is

APACHELOGFORMAT (%u %h %l %w %t "%r" %s %b)

Any input would be appreciated

Brian Clanton
mailto:bclanton@dupagels.lib.il.us
Systems Technician
Dupage Library System
http://www.dupagels.lib.il.us
127 South First Street
Geneva IL, 60134
Voice/Voicemail (630) 232-8457 Ext. 210
Fax: (630) 232 0699

Automation Department direct line:

Voice/Voicemail (630) 232-4674


> -----Original Message-----
> From: analog-help-bounces@lists.meer.net
> [mailto:analog-help-bounces@lists.meer.net] On Behalf Of Aengus
> Sent: Friday, August 01, 2008 5:00 PM
> To: Support for analog web log analyzer
> Subject: Re: [analog-help] Special Organisation Report
>
> Brian Clanton <bclanton@dupagels.lib.il.us> wrote:
> > I have two types of log files for a Proxy Server that I am
> anylyzing
> > with Analog:
> >
> > local 75.149.219.73 - - [18/Jul/2008:13:58:19 -0600] "GET
> > http://infotrac.galegroup.com/itweb/caro83221?id=caro83221&db=LitRC
> > HTTP/1.1" 301 555
> > proxy 67.167.91.241 - fGKzhzjLu6flE6G [18/Jul/2008:14:33:07 -0600]
> > "GET http://mldv.permissiontv.com/channels/carol_il HTTP/1.1" 200 0
> >
> > The logs can either "local" or "proxy". This designates whether or
> > not a request is coming from inside of an IP range or
> outside of an IP
> > range.
> >
> > My question is....
> >
> > How can I get a report within the Organisations Report to
> tell me how
> > many requests are internal, "local" and how many are
> remote, "proxy"?
>
> I'm not sure what you mean by "a report within the
> Organisations Report" but you can use one of the reports that
> you aren't currently using, and "hijack" it's field to report
> on how often a specific term turns up in that field.
>
> For instance, if you're not using the User Report, you can
> create a logformat with %u in the first field, turn on the
> User Report, and it will show you how many request were made
> by the user "local" and how many were made by the user "proxy".
>
> If you are using the User Report already, you can also
> repurpose the Virtual Host report in the same way. (You might
> be able to do something with the Browser Report too).
>
> Aengus
>
> +-------------------------------------------------------------
> ----------
> +-
> | TO UNSUBSCRIBE from this list:
> | http://lists.meer.net/mailman/listinfo/analog-help
> |
> | Analog Documentation: http://analog.cx/docs/Readme.html List
> | archives: http://www.analog.cx/docs/mailing.html#listarchives
> | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general
> +-------------------------------------------------------------
> ----------
> +-
>

+------------------------------------------------------------------------
| TO UNSUBSCRIBE from this list:
| http://lists.meer.net/mailman/listinfo/analog-help
|
| Analog Documentation: http://analog.cx/docs/Readme.html
| List archives: http://www.analog.cx/docs/mailing.html#listarchives
| Usenet version: news://news.gmane.org/gmane.comp.web.analog.general
+------------------------------------------------------------------------

Brian Clanton <bclanton@dupagels.lib.il.us> wrote:
> When I use the User Report for identifying local verses proxy users,
> I only get a readout of the proxy users, not local. I've played with
> some of the FLOOR commands as they apply to the User report, but I
> cannot get Analog to recogize the "local" requests in the log file.
> The floor command that would seem to apply is:
>
> USERFLOOR 1r
>
> Which to me would mean "List all users with at least 1 request"
>
> My logformat command is
>
> APACHELOGFORMAT (%u %h %l %w %t "%r" %s %b)
>
> Any input would be appreciated

If all the "local" entries have a 301 status code (Permanent Redirection), then you'll need to look at the
User Redirection Report to see the "local" users.

REDIRUSER ON

Aengus

+------------------------------------------------------------------------
| TO UNSUBSCRIBE from this list:
| http://lists.meer.net/mailman/listinfo/analog-help
|
| Analog Documentation: http://analog.cx/docs/Readme.html
| List archives: http://www.analog.cx/docs/mailing.html#listarchives
| Usenet version: news://news.gmane.org/gmane.comp.web.analog.general
+------------------------------------------------------------------------