1and1 logfile format
"Iain Hunneybell" <iain-Vvd6Z7Soz6DPlRtfX+RAZ1pr/1R2p/[email protected]> Mon, 2 Nov 2009 15:16:41 -0000
| Newsgroups | gmane.comp.web.analog.general |
|---|---|
| Organization | IP Marketing Limited |
| Message-ID | <0EBDF27535894406BE784F588345EED7@Iain4> |
This is a multi-part message in MIME format. --===============1003548248== Content-Type: multipart/alternative; boundary="----=_NextPart_000_01F9_01CA5BCF.8130B010" This is a multi-part message in MIME format. ------=_NextPart_000_01F9_01CA5BCF.8130B010 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Has anyone any experience of processing 1and1 logfiles through analog? They seem to use an unusual format that analog doesn't recognise. The record layout seems to be: Requestor IP Username Date/time "GET requested URL inc HTTP version" HTTP response Bytes Domain to which the request refers <-- This seems to be something particular to 1and1 and is unquoted "Referrer" "User agent" "-" <-- No idea what this is meant to be! So for example: 124.115.0.145 - - [07/Sep/2009:00:24:08 +0200] "GET / HTTP/1.1" 200 17616 www.mydomain.com "http://www.mydomain.com/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)" "-" I'm presuming a LOGFORMAT would fix it but no luck. I tried: LOGFORMAT (%s - %u [%d/%M/%Y:%h:%n:%j %j] "%j %r %j" %c %b %j %f %B %j) Which when matched up with the log record wold read as: %s - Requestor IP - %u - Username [%d/%M/%Y:%h:%n:%j %j] - Date/time %j - GET %r - requested URL %j - HTTP version %c - HTTP response %b - Bytes %j - Domain to which the request refers %f - Referrer %B - Browser/user agent %j - "-" Strangely, despite the LOGFORMAT command <errors.txt> reports: analog: Warning F: Can't auto-detect format of logfile Logs\20090907.log: ignoring it Any ideas? Many thanks.../Iain ------=_NextPart_000_01F9_01CA5BCF.8130B010 Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN"> <HTML> <HEAD> <META HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; = charset=3Dus-ascii"> <META NAME=3D"Generator" CONTENT=3D"MS Exchange Server version = 6.5.7036.0"> <TITLE>1and1 logfile format</TITLE> </HEAD> <BODY> <!-- Converted from text/rtf format --> <P><FONT SIZE=3D2 FACE=3D"Courier New">Has anyone any experience of = processing 1and1 logfiles through analog? They seem to use an unusual = format that analog doesn't recognise. The record layout seems to = be:</FONT></P> <P><FONT SIZE=3D2 FACE=3D"Courier New">Requestor IP</FONT> <BR><FONT SIZE=3D2 FACE=3D"Courier New">Username</FONT> <BR><FONT SIZE=3D2 FACE=3D"Courier New">Date/time</FONT> <BR><FONT SIZE=3D2 FACE=3D"Courier New">"GET requested URL inc HTTP = version"</FONT> <BR><FONT SIZE=3D2 FACE=3D"Courier New">HTTP response</FONT> <BR><FONT SIZE=3D2 FACE=3D"Courier New">Bytes</FONT> <BR><FONT SIZE=3D2 FACE=3D"Courier New">Domain to which the request = refers <-- This seems to be something particular to 1and1 and is = unquoted</FONT> <BR><FONT SIZE=3D2 FACE=3D"Courier New">"Referrer"</FONT> <BR><FONT SIZE=3D2 FACE=3D"Courier New">"User agent"</FONT> <BR><FONT SIZE=3D2 FACE=3D"Courier New">"-" <-- No idea = what this is meant to be!</FONT> </P> <P><FONT SIZE=3D2 FACE=3D"Courier New">So for example:</FONT> </P> <P><FONT SIZE=3D2 FACE=3D"Courier New">124.115.0.145 - - = [07/Sep/2009:00:24:08 +0200] "GET / HTTP/1.1" 200 17616 = </FONT><A HREF=3D"file://www.mydomain.com"><U><FONT COLOR=3D"#0000FF" = SIZE=3D2 FACE=3D"Courier New">www.mydomain.com</FONT></U></A><FONT = SIZE=3D2 FACE=3D"Courier New"> "</FONT><A = HREF=3D"http://www.mydomain.com/"><U><FONT COLOR=3D"#0000FF" SIZE=3D2 = FACE=3D"Courier New">http://www.mydomain.com/</FONT></U></A><FONT = SIZE=3D2 FACE=3D"Courier New">" "Mozilla/4.0 (compatible; MSIE = 6.0; Windows NT 5.1)" "-"</FONT></P> <P><FONT SIZE=3D2 FACE=3D"Courier New">I'm presuming a LOGFORMAT would = fix it but no luck. I tried:</FONT> </P> <P><FONT SIZE=3D2 FACE=3D"Courier New">LOGFORMAT (%s - %u = [%d/%M/%Y:%h:%n:%j %j] "%j %r %j" %c %b %j %f %B %j)</FONT> </P> <P><FONT SIZE=3D2 FACE=3D"Courier New">Which when matched up with the = log record wold read as:</FONT> </P> <P><FONT SIZE=3D2 FACE=3D"Courier New">%s = = = - Requestor IP</FONT> <BR><FONT SIZE=3D2 FACE=3D"Courier = New">- = = = </FONT> <BR><FONT SIZE=3D2 FACE=3D"Courier New">%u = = = - Username</FONT> <BR><FONT SIZE=3D2 FACE=3D"Courier New">[%d/%M/%Y:%h:%n:%j %j] - = Date/time</FONT> <BR><FONT SIZE=3D2 FACE=3D"Courier New">%j = = = - GET </FONT> <BR><FONT SIZE=3D2 FACE=3D"Courier New">%r = = = - requested URL </FONT> <BR><FONT SIZE=3D2 FACE=3D"Courier New">%j = = = - HTTP version</FONT> <BR><FONT SIZE=3D2 FACE=3D"Courier New">%c = = = - HTTP response</FONT> <BR><FONT SIZE=3D2 FACE=3D"Courier New">%b = = = - Bytes</FONT> <BR><FONT SIZE=3D2 FACE=3D"Courier New">%j = = = - Domain to which the request = refers </FONT> <BR><FONT SIZE=3D2 FACE=3D"Courier New">%f = = = - Referrer</FONT> <BR><FONT SIZE=3D2 FACE=3D"Courier New">%B = = = - Browser/user agent</FONT> <BR><FONT SIZE=3D2 FACE=3D"Courier New">%j = = = - "-" </FONT> </P> <P><FONT SIZE=3D2 FACE=3D"Courier New">Strangely, despite the LOGFORMAT = command <errors.txt> reports:</FONT> </P> <P><FONT SIZE=3D2 FACE=3D"Courier New">analog: Warning F: Can't = auto-detect format of logfile</FONT> <BR><FONT SIZE=3D2 FACE=3D"Courier New"> Logs\20090907.log: = ignoring it</FONT> </P> <P><FONT SIZE=3D2 FACE=3D"Courier New">Any ideas?</FONT> </P> <P><FONT SIZE=3D2 FACE=3D"Courier New">Many thanks.../Iain</FONT> </P> </BODY> </HTML> ------=_NextPart_000_01F9_01CA5BCF.8130B010-- --===============1003548248== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline +------------------------------------------------------------------------ | TO UNSUBSCRIBE from this list: | http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +------------------------------------------------------------------------ --===============1003548248==--