Re: Only include logs that has a certain string
"Aengus" <[email protected]>
| Newsgroups | gmane.comp.web.analog.general |
|---|---|
| Message-ID | <005301c832a5$96372c50$a6041fac@WC515ALawlo> |
Stephen Turner <[email protected]> wrote: > On 28/11/2007, Aengus <[email protected]> wrote: >> On Wednesday, November 28, 2007 6:43 PM [EDT], >> Ridwan <ridwan-YF3rlD7ol/[email protected]> wrote: >> > >> I'm sure that there's a better way, but the first thing that coes to >> mind is a slightly convoluted process using a FILEALIAS. >> >> FILEALIAS *.cgi?*mnphmf* $1.abc?$2mnphmf$3 >> >> will take all calls to your script and convert the script extension >> to .abc, if and only if that particular line includes the string you >> care about. Then if you use >> >> FILEINCLUDE *.abc* >> >> analog will report on just those lines. >> > > I think you're interpreting the question differently from me, Aengus. > For finding a specific user, > FILEINCLUDE *mnphmf* > should work fine. That's what I thought - but it didn't work that way for me. The documenation for REQINCLUDE in http://analog.cx/docs/args.html says "in the Request Report files with arguments are only included if their parent file is included". Even though this shouldn't directly apply to FILEINCLUDE (because the stem of a query is always displayed in the Request Report, even if it only occurs with a query string), it looks as though this is coming into play here. Here's a one line log file: #Software: Microsoft Internet Information Services 6.0 #Version: 1.0 #Date: 2007-09-19 00:00:19 #Fields: date time c-ip cs-method cs-uri-stem cs-uri-query sc-status 2007-09-19 00:16:20 127.0.0.1 GET /test/test.asp PageNo=2&Order=DESC&Display=0 200 If I call analog with these parameters, I get a Request Report that shows the Request, with the args listed on a 2nd line: analog test.log +C"reqfloor 1r" +C"reqargsfloor 1r" If I call analog with this additional parameter, I get an empty report: analog test.log +C"reqfloor 1r" +C"reqargsfloor 1r" +C"FILEINCLUDE *DESC*" Aengus +------------------------------------------------------------------------ | TO UNSUBSCRIBE from this list: | http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +------------------------------------------------------------------------