Mailing List Archive: Help with Log file format

Hello

My log file format is the following:

%vsid% - %Ses->client.ip% - %Req->vars.auth-user% [%SYSDATE%]
"%Req->reqpb.clf-request%" %Req->srvhdrs.clf-status%
%Req->srvhdrs.content-length% %Req->headers.host% "%Req->headers.referer%"
"%Req->headers.user-agent%"

Here is an example entry:

https-www-80 - 127.0.0.1 - - [06/Oct/2008:16:00:01 -0700] "GET
/servlet/SG/update/ucv=1.1&version=9.99&language=enu HTTP/1.0" 404 292 - "-"
"Mozilla/1.22 (Windows; U; 32bit)"

I tried the following two LOGFORMAT settings and an error was flagged at
"GET.

LOGFORMAT (%S - %s - - [%d/%M/%Y:%h:%n:%j %j] "%r" %c %b %S "%f" "%B"
LOGFORMAT (%S - %s - - [%d/%M/%Y:%h:%n:%j %j] "GET %r" %c %b %S "%f" "%B"

Can you please help me to format my LOGFORMAT statement correctly?

Note - I tried the default settings and many log entries were processed but
many were not. This is what led me to craft my own LOGFORMAT statement.

Thanks
Terry

Terry Chambers <terry.chambers@gmail.com> wrote:
>> Hello
>>
>> Here is an example entry:
>>
>> https-www-80 - 127.0.0.1 - - [06/Oct/2008:16:00:01 -0700] "GET
>> /servlet/SG/update/ucv=1.1&version=9.99&language=enu HTTP/1.0" 404
>> 292 - "-" "Mozilla/1.22 (Windows; U; 32bit)"
>>
>> I tried the following two LOGFORMAT settings and an error was
>> flagged at "GET.
>>
>> LOGFORMAT (%S - %s - - [%d/%M/%Y:%h:%n:%j %j] "%r" %c %b %S "%f" "%B"
>> LOGFORMAT (%S - %s - - [%d/%M/%Y:%h:%n:%j %j] "GET %r" %c %b %S "%f"
>> "%B"

LOGFORMAT (%j - %s %j[%d/%M/%Y:%h:%n:%j] "%j %r %j" %c %b %v "%f" "%B")

I'm assuming that https-www-80 is an internal server name, and not terribly relevant (therefor %j), and that the 127.0.0.1 is in fact the IP address that the request came from (therefore %s) and that %Req->headers.host% is the "host header" sent by the browser to allow a single IP address to be used for multiple virtual websites (therefore %v, though you won't see anything from this unless you turn on some of the Virtual Host reports).

The character after the IP address is a space, and then everything until the timestamp is junk, so it's "%s %j[" rather than "%s - - [", but either style will do.

Aengus

+------------------------------------------------------------------------
| TO UNSUBSCRIBE from this list:
| http://lists.meer.net/mailman/listinfo/analog-help
|
| Analog Documentation: http://analog.cx/docs/Readme.html
| List archives: http://www.analog.cx/docs/mailing.html#listarchives
| Usenet version: news://news.gmane.org/gmane.comp.web.analog.general
+------------------------------------------------------------------------