Advanced
Mailing List Archive

Mailing List Archive

  1. Home >
  2. Analog>
  3. Help
LOGFORMAT assistance please!
ggnkua at gmail
Mar 5, 2009, 1:14 PM
Post #1 of 4 (2777 views)
Permalink
Hi all,

I'm trying to get analog to parse logfiles from a linux server I'm
administering.

The log lines are typically something like this:

axxxxxxxxxx.uk: [13/Feb/2009:00:44:17 +0000] 24.210.252.186 - - "GET
/dbugarchive.png HTTP/1.1" 200 7296 "http://axxxxxxxxxx.uk/" "Mozilla/5.0
(Windows; U; Windows NT 5.1; en-US; rv:1.8.1.18) Gecko/20081029
Firefox/2.0.0.18"

Analog can't parse these logfiles, so I tried to use logformat. After
reading the manual, I came up with this line, which I put into analog.cfg:

LOGFORMAT (%v: [%d/%M/%Y:%h:%n:%j %j] %S - - "%j %r %j" %c - "-" "%B")

However, this resulted in lots of output lines like the following:

analog: Warning L: Large number of corrupt lines in logfile
a8archivelogs\ex090301.log.bz2: turn debugging on or try different
LOGFORMAT
Current logfile format:
%v: [%d/%M/%Y:%h:%n:%j %j] %S - - "%j %r %j" %c - "-" "%B"\n

I really don't know what's happening here. Is my logformat wrong? Are there
lines in the logs that aren't like the one I posted above?

Any help would be appreciated!
--
View this message in context: http://www.nabble.com/LOGFORMAT-assistance-please%21-tp22279385p22279385.html
Sent from the Analog Users mailing list archive at Nabble.com.

+------------------------------------------------------------------------
| TO UNSUBSCRIBE from this list:
| http://lists.meer.net/mailman/listinfo/analog-help
|
| Analog Documentation: http://analog.cx/docs/Readme.html
| List archives: http://www.analog.cx/docs/mailing.html#listarchives
| Usenet version: news://news.gmane.org/gmane.comp.web.analog.general
+------------------------------------------------------------------------
Re: LOGFORMAT assistance please! [ In reply to ]
KlausRusch at atmedia
Mar 5, 2009, 1:28 PM
Post #2 of 4 (2661 views)
Permalink
ggn wrote:
> axxxxxxxxxx.uk: [13/Feb/2009:00:44:17 +0000] 24.210.252.186 - - "GET
> /dbugarchive.png HTTP/1.1" 200 7296 "http://axxxxxxxxxx.uk/" "Mozilla/5.0
> (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.18) Gecko/20081029
> Firefox/2.0.0.18"
>
>
> LOGFORMAT (%v: [%d/%M/%Y:%h:%n:%j %j] %S - - "%j %r %j" %c - "-" "%B")
>
The log format does not match the sample provided:
* The log entry shows a byte count after the status code but the log
format specifies - (should be %b).
* The log entry shows a referring URL enxt but the log format specifies
"-" (should be "%f").

This should work (ECLF plus leading virtual host):

LOGFORMAT (%v: %S %j %u [%d/%M/%Y:%h:%n:%j] "%j%w%r%wHTTP%j" %c %b "%f" "%B")
LOGFORMAT (%v: %S %j %u [%d/%M/%Y:%h:%n:%j] "%j%w%r" %c %b "%f" "%B")
LOGFORMAT (%v: %S %j %u [%d/%M/%Y:%h:%n:%j] "%r" %c %b "%f" "%B")

--
Klaus Johannes Rusch
KlausRusch@atmedia.net
http://www.atmedia.net/KlausRusch/

+------------------------------------------------------------------------
| TO UNSUBSCRIBE from this list:
| http://lists.meer.net/mailman/listinfo/analog-help
|
| Analog Documentation: http://analog.cx/docs/Readme.html
| List archives: http://www.analog.cx/docs/mailing.html#listarchives
| Usenet version: news://news.gmane.org/gmane.comp.web.analog.general
+------------------------------------------------------------------------
Re: LOGFORMAT assistance please! [ In reply to ]
analog07 at eircom
Mar 5, 2009, 3:54 PM
Post #3 of 4 (2660 views)
Permalink
ggn <ggnkua@gmail.com> wrote:
> Hi all,
>
> I'm trying to get analog to parse logfiles from a linux server I'm
> administering.
>
> The log lines are typically something like this:
>
> axxxxxxxxxx.uk: [13/Feb/2009:00:44:17 +0000] 24.210.252.186 - - "GET
> /dbugarchive.png HTTP/1.1" 200 7296 "http://axxxxxxxxxx.uk/"
> "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.18)
> Gecko/20081029 Firefox/2.0.0.18"
>
> LOGFORMAT (%v: [%d/%M/%Y:%h:%n:%j %j] %S - - "%j %r %j" %c - "-" "%B")

As Klaus said, - is not a wildcard, it's a specific string, and 7296 doesn't match -, and neither does http://axxxxxxxxxx.uk/

If you don't care about the byte count, or the referrer, use %j instead of those particular - characters, or use %b for the byte-count field, and %f for the referrer.

Aengus

+------------------------------------------------------------------------
| TO UNSUBSCRIBE from this list:
| http://lists.meer.net/mailman/listinfo/analog-help
|
| Analog Documentation: http://analog.cx/docs/Readme.html
| List archives: http://www.analog.cx/docs/mailing.html#listarchives
| Usenet version: news://news.gmane.org/gmane.comp.web.analog.general
+------------------------------------------------------------------------
Re: LOGFORMAT assistance please! [ In reply to ]
ggnkua at gmail
Mar 7, 2009, 9:00 AM
Post #4 of 4 (2642 views)
Permalink
Hello all and thanks for the replies,

I tried all your suggestions, but I'm afraid that analog still complains
about corrupt lines :/ I guess I should post more log lines, but I don't
want to post a 9k logfile (shortest one I could find!) here.

So if someone would like to take a peek at it, I could send it by email.

P.S. I'm interested in extracting all possible info from the logfiles, to
answer a question.


Thanks for reading,
George
--
View this message in context: http://www.nabble.com/LOGFORMAT-assistance-please%21-tp22279385p22389524.html
Sent from the Analog Users mailing list archive at Nabble.com.

+------------------------------------------------------------------------
| TO UNSUBSCRIBE from this list:
| http://lists.meer.net/mailman/listinfo/analog-help
|
| Analog Documentation: http://analog.cx/docs/Readme.html
| List archives: http://www.analog.cx/docs/mailing.html#listarchives
| Usenet version: news://news.gmane.org/gmane.comp.web.analog.general
+------------------------------------------------------------------------

©2024 GT.net. A Gossamer Threads company.
5th Floor, 455 Granville St., Vancouver, BC V6C 1T1, Canada | Legal