Re: Only include logs that has a certain string

On 29/11/2007, Aengus <[email protected]> wrote:
>
> Here's a one line log file:
> #Software: Microsoft Internet Information Services 6.0
> #Version: 1.0
> #Date: 2007-09-19 00:00:19
> #Fields: date time c-ip cs-method cs-uri-stem cs-uri-query sc-status
> 2007-09-19 00:16:20 127.0.0.1 GET /test/test.asp PageNo=2&Order=DESC&Display=0 200
>
> If I call analog with these parameters, I get a Request Report that shows the Request, with the args listed on a 2nd line:
> analog test.log +C"reqfloor 1r" +C"reqargsfloor 1r"
>
> If I call analog with this additional parameter, I get an empty report:
> analog test.log +C"reqfloor 1r" +C"reqargsfloor 1r" +C"FILEINCLUDE *DESC*"
>

It turns out this is a problem with case insensitivity, though it's
less clear what to do about it. If you're on a case insensitive
filesystem (such as Windows), all the filenames are lower-cased, and
so all the FILEINCLUDEs are lower-cased too to match. That way *test*
and *TEST* will both match.

The problem is that the lower casing only applies to the stem of the
URL, not the query string; but analog doesn't know that the
FILEINCLUDE is targetted at the query string, so it's looking for
"desc" and not finding it.

A workaround is to use
  FILEINCLUDE REGEXP:DESC
That still does a case insensitive match, but the case insensitivity
is handled by the regexp engine not by folding the specification to
lower case, so it will match.

--
Stephen Turner
+------------------------------------------------------------------------
|  TO UNSUBSCRIBE from this list:
|    http://lists.meer.net/mailman/listinfo/analog-help
|
|  Analog Documentation: http://analog.cx/docs/Readme.html
|  List archives:  http://www.analog.cx/docs/mailing.html#listarchives
|  Usenet version: news://news.gmane.org/gmane.comp.web.analog.general
+------------------------------------------------------------------------