One last call for help (chock full of information of what I am trying and what I have tried...)

Well, 

I sincerely wish I could recall what the analog config line was that I used
to produce this analog output but, if you look here:

http://www.columbia.edu/~jf2412/test_report.html

You'll see that analog was able to parse most of the 6,846,761 lines in the
one logfile I'm using for testing. Unfortunately, I overwrote the LOGFORMAT
string I used, but this LOGFORMAT determined that only 50,735 lines of the
logfile were corrupted.

So.. Here's an update.  It seems that the logfiles I have to work with are
actually being written to using two different apache logformats.  Here they
are:

LogFormat "%h %l %u %t \"(%r)\" %>s %b \"(ref %{Referer}i)\" \"(client
%{User-agent}i)\" \"(elapsed %D)\"" mainserver


LogFormat "%h %l %u %t \"(%r)\" %>s %b \"(ref %{Referer}i)\" \
\"(client %{User-agent}i)\" \"vhost %v\" \"(elapsed %D)\"" virtualhost

Both of those formats are being used to write to the same apache logfile.

It is that logfile that I'm trying to analyze using Analog.

Among many experiments I tried this:

LOGFORMAT '%S - - [%d/%M/%Y:%h:%n:%j %j] "(%j %r %j)" %c %b "(%j %f)"
"(%B)"'  and it kinda worked as you can see here:

http://www.columbia.edu/~jf2412/test6.html

Which complains that 6,394,424 lines of the logfile are corrupted.


And I tried this:

APACHELOGFORMAT '%h %l %u %t \"(%r)\" %>s %b \"(%{Referer}i)\"
\"(%{User-agent}i)\" \"%v\"'  which is ALMOST an exact replica of the
'virtualhost' version of the apache logformat...

The results if this analysis are here:
http://www.columbia.edu/~jf2412/test10.html

This analysis says that 6,878,070  lines are corrupted....

At this point, I would love it if someone really smart could provide me a
LOGFORMAT format or an APACHELOGFORMAT format that I could try that would
get me the least worst results.

:-)

Meanwhile, I'll keep reading, learning and experimenting.

Best wishes,

Joshua 


+------------------------------------------------------------------------
|  TO UNSUBSCRIBE from this list:
|    http://lists.meer.net/mailman/listinfo/analog-help
|
|  Analog Documentation: http://analog.cx/docs/Readme.html
|  List archives:  http://www.analog.cx/docs/mailing.html#listarchives
|  Usenet version: news://news.gmane.org/gmane.comp.web.analog.general
+------------------------------------------------------------------------