RE: 1and1 logfile format
"Iain Hunneybell" <iain-Vvd6Z7Soz6DPlRtfX+RAZ1pr/1R2p/[email protected]> Mon, 2 Nov 2009 15:53:41 -0000
| Newsgroups | gmane.comp.web.analog.general |
|---|---|
| Organization | IP Marketing Limited |
| Message-ID | <E15388FBB00C4680A015BE39DC2ADC5B@Iain4> |
This is a multi-part message in MIME format. --===============0864953742== Content-Type: multipart/alternative; boundary="----=_NextPart_000_0203_01CA5BD4.A9739880" This is a multi-part message in MIME format. ------=_NextPart_000_0203_01CA5BD4.A9739880 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Well I've cure one issue but found another... By placing my LOGFORMAT ahead of the LOGFILE directive I've produced a report, but the issues I have are: 1. This odd multi-host combined logfile with it would seem multiple domains owned by a single 1and1 account in the one logfile, and 2. The search engine queries are lost and <errors.txt> reports: analog: Warning R: Turning off empty Search Query Report analog: Warning R: Turning off empty Search Word Report But...I can find the various Google and other referrals with queries so don't yet understand why the search word reports are empty and so switched off. So if anyone has experience of 1and1 logfile format I'd be very grateful :-) Many thanks.../Iain > _____________________________________________ > From: Iain Hunneybell [mailto:iain-Vvd6Z7Soz6DPlRtfX+RAZ1pr/1R2p/[email protected]] > Sent: 02 November 2009 15:17 > To: 'Support for analog web log analyzer' > Subject: 1and1 logfile format > > Has anyone any experience of processing 1and1 logfiles through analog? > They seem to use an unusual format that analog doesn't recognise. The > record layout seems to be: > > Requestor IP > Username > Date/time > "GET requested URL inc HTTP version" > HTTP response > Bytes > Domain to which the request refers <-- This seems to be something > particular to 1and1 and is unquoted > "Referrer" > "User agent" > "-" <-- No idea what this is meant to be! > > So for example: > > 124.115.0.145 - - [07/Sep/2009:00:24:08 +0200] "GET / HTTP/1.1" 200 17616 > www.mydomain.com "http://www.mydomain.com/" "Mozilla/4.0 (compatible; MSIE > 6.0; Windows NT 5.1)" "-" > > I'm presuming a LOGFORMAT would fix it but no luck. I tried: > > LOGFORMAT (%s - %u [%d/%M/%Y:%h:%n:%j %j] "%j %r %j" %c %b %j %f %B %j) > > Which when matched up with the log record wold read as: > > %s - Requestor IP > - > %u - Username > [%d/%M/%Y:%h:%n:%j %j] - Date/time > %j - GET > %r - requested URL > %j - HTTP version > %c - HTTP response > %b - Bytes > %j - Domain to which the request refers > %f - Referrer > %B - Browser/user agent > %j - "-" > > Strangely, despite the LOGFORMAT command <errors.txt> reports: > > analog: Warning F: Can't auto-detect format of logfile > Logs\20090907.log: ignoring it > > Any ideas? > > Many thanks.../Iain ------=_NextPart_000_0203_01CA5BD4.A9739880 Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN"> <HTML> <HEAD> <META HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; = charset=3Dus-ascii"> <META NAME=3D"Generator" CONTENT=3D"MS Exchange Server version = 6.5.7036.0"> <TITLE>RE: 1and1 logfile format</TITLE> </HEAD> <BODY> <!-- Converted from text/rtf format --> <P><FONT COLOR=3D"#0000FF" SIZE=3D2 FACE=3D"Arial">Well I've cure one = issue but found another...</FONT> </P> <P><FONT COLOR=3D"#0000FF" SIZE=3D2 FACE=3D"Arial">By placing my = LOGFORMAT ahead of the LOGFILE directive I've produced a report, but the = issues I have are:</FONT> </P> <P><FONT COLOR=3D"#0000FF" SIZE=3D2 FACE=3D"Arial">1. This odd = multi-host combined logfile with it would seem multiple domains owned by = a single 1and1 account in the one logfile, and </FONT></P> <P><FONT COLOR=3D"#0000FF" SIZE=3D2 FACE=3D"Arial">2. The search engine = queries are lost and <errors.txt> reports:</FONT> </P> <P><FONT COLOR=3D"#0000FF" SIZE=3D2 FACE=3D"Arial">analog: Warning R: = Turning off empty Search Query Report</FONT> <BR><FONT COLOR=3D"#0000FF" SIZE=3D2 FACE=3D"Arial">analog: Warning R: = Turning off empty Search Word Report</FONT> </P> <P><FONT COLOR=3D"#0000FF" SIZE=3D2 FACE=3D"Arial">But...I can find the = various Google and other referrals with queries so don't yet understand = why the search word reports are empty and so switched off.</FONT></P> <P><FONT COLOR=3D"#0000FF" SIZE=3D2 FACE=3D"Arial">So if anyone has = experience of 1and1 logfile format I'd be very grateful :-)</FONT> </P> <P><FONT COLOR=3D"#0000FF" SIZE=3D2 FACE=3D"Arial">Many = thanks.../Iain</FONT> </P> <BR> <P><FONT SIZE=3D1 = FACE=3D"Tahoma">_____________________________________________ </FONT> <BR><B><FONT SIZE=3D1 FACE=3D"Tahoma">From: </FONT></B> <FONT = SIZE=3D1 FACE=3D"Tahoma">Iain Hunneybell [</FONT><A = HREF=3D"mailto:iain-Vvd6Z7Soz6DPlRtfX+RAZ1pr/1R2p/[email protected]"><U><FONT COLOR=3D"#0000FF" = SIZE=3D1 = FACE=3D"Tahoma">mailto:iain-Vvd6Z7Soz6DPlRtfX+RAZ1pr/1R2p/[email protected]</FONT></U></A><FONT = SIZE=3D1 FACE=3D"Tahoma">] </FONT> <BR><B><FONT SIZE=3D1 FACE=3D"Tahoma">Sent: </FONT></B> <FONT = SIZE=3D1 FACE=3D"Tahoma">02 November 2009 15:17</FONT> <BR><B><FONT SIZE=3D1 = FACE=3D"Tahoma">To: </FONT></B> <FONT SIZE=3D1 = FACE=3D"Tahoma">'Support for analog web log analyzer'</FONT> <BR><B><FONT SIZE=3D1 = FACE=3D"Tahoma">Subject: </FONT>= </B> <FONT SIZE=3D1 FACE=3D"Tahoma">1and1 logfile format</FONT> </P> <P><FONT SIZE=3D2 FACE=3D"Courier New">Has anyone any experience of = processing 1and1 logfiles through analog? They seem to use an unusual = format that analog doesn't recognise. The record layout seems to = be:</FONT></P> <P><FONT SIZE=3D2 FACE=3D"Courier New">Requestor IP</FONT> <BR><FONT SIZE=3D2 FACE=3D"Courier New">Username</FONT> <BR><FONT SIZE=3D2 FACE=3D"Courier New">Date/time</FONT> <BR><FONT SIZE=3D2 FACE=3D"Courier New">"GET requested URL inc HTTP = version"</FONT> <BR><FONT SIZE=3D2 FACE=3D"Courier New">HTTP response</FONT> <BR><FONT SIZE=3D2 FACE=3D"Courier New">Bytes</FONT> <BR><FONT SIZE=3D2 FACE=3D"Courier New">Domain to which the request = refers <-- This seems to be something particular to 1and1 and is = unquoted</FONT> <BR><FONT SIZE=3D2 FACE=3D"Courier New">"Referrer"</FONT> <BR><FONT SIZE=3D2 FACE=3D"Courier New">"User agent"</FONT> <BR><FONT SIZE=3D2 FACE=3D"Courier New">"-" <-- No idea = what this is meant to be!</FONT> </P> <P><FONT SIZE=3D2 FACE=3D"Courier New">So for example:</FONT> </P> <P><FONT SIZE=3D2 FACE=3D"Courier New">124.115.0.145 - - = [07/Sep/2009:00:24:08 +0200] "GET / HTTP/1.1" 200 17616 = </FONT><A HREF=3D"file://www.mydomain.com"><U><FONT COLOR=3D"#0000FF" = SIZE=3D2 FACE=3D"Courier New">www.mydomain.com</FONT></U></A><FONT = SIZE=3D2 FACE=3D"Courier New"> "</FONT><A = HREF=3D"http://www.mydomain.com/"><U><FONT COLOR=3D"#0000FF" SIZE=3D2 = FACE=3D"Courier New">http://www.mydomain.com/</FONT></U></A><FONT = SIZE=3D2 FACE=3D"Courier New">" "Mozilla/4.0 (compatible; MSIE = 6.0; Windows NT 5.1)" "-"</FONT></P> <P><FONT SIZE=3D2 FACE=3D"Courier New">I'm presuming a LOGFORMAT would = fix it but no luck. I tried:</FONT> </P> <P><FONT SIZE=3D2 FACE=3D"Courier New">LOGFORMAT (%s - %u = [%d/%M/%Y:%h:%n:%j %j] "%j %r %j" %c %b %j %f %B %j)</FONT> </P> <P><FONT SIZE=3D2 FACE=3D"Courier New">Which when matched up with the = log record wold read as:</FONT> </P> <P><FONT SIZE=3D2 FACE=3D"Courier New">%s = = = - Requestor IP</FONT> <BR><FONT SIZE=3D2 FACE=3D"Courier = New">- = = = </FONT> <BR><FONT SIZE=3D2 FACE=3D"Courier New">%u = = = - Username</FONT> <BR><FONT SIZE=3D2 FACE=3D"Courier New">[%d/%M/%Y:%h:%n:%j %j] - = Date/time</FONT> <BR><FONT SIZE=3D2 FACE=3D"Courier New">%j = = = - GET </FONT> <BR><FONT SIZE=3D2 FACE=3D"Courier New">%r = = = - requested URL </FONT> <BR><FONT SIZE=3D2 FACE=3D"Courier New">%j = = = - HTTP version</FONT> <BR><FONT SIZE=3D2 FACE=3D"Courier New">%c = = = - HTTP response</FONT> <BR><FONT SIZE=3D2 FACE=3D"Courier New">%b = = = - Bytes</FONT> <BR><FONT SIZE=3D2 FACE=3D"Courier New">%j = = = - Domain to which the request = refers </FONT> <BR><FONT SIZE=3D2 FACE=3D"Courier New">%f = = = - Referrer</FONT> <BR><FONT SIZE=3D2 FACE=3D"Courier New">%B = = = - Browser/user agent</FONT> <BR><FONT SIZE=3D2 FACE=3D"Courier New">%j = = = - "-" </FONT> </P> <P><FONT SIZE=3D2 FACE=3D"Courier New">Strangely, despite the LOGFORMAT = command <errors.txt> reports:</FONT> </P> <P><FONT SIZE=3D2 FACE=3D"Courier New">analog: Warning F: Can't = auto-detect format of logfile</FONT> <BR><FONT SIZE=3D2 FACE=3D"Courier New"> Logs\20090907.log: = ignoring it</FONT> </P> <P><FONT SIZE=3D2 FACE=3D"Courier New">Any ideas?</FONT> </P> <P><FONT SIZE=3D2 FACE=3D"Courier New">Many thanks.../Iain</FONT> </P> </BODY> </HTML> ------=_NextPart_000_0203_01CA5BD4.A9739880-- --===============0864953742== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline +------------------------------------------------------------------------ | TO UNSUBSCRIBE from this list: | http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +------------------------------------------------------------------------ --===============0864953742==--