Re: Customizing LOGFORMAT to accept "Account Number"
Jeremy Wadsack <[email protected]> Thu, 19 Nov 2009 16:29:39 -0800
| Newsgroups | gmane.comp.web.analog.general |
|---|---|
| Message-ID | <[email protected]> |
--===============0014993218== Content-Type: multipart/alternative; boundary=00163649a6f34091860478c292f3 --00163649a6f34091860478c292f3 Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: quoted-printable You can do one of two things, depending on what you want. To see a report of all traffic for the account 'A-35815', just use that in your log format instead of %j. Analog will ignore all other lines in the report. LOGFORMAT (%S %Y-%m-%d %h:%n:%j %j %u 'A-35815' %j %r %c %t %b '%B') To see a report of all accounts on the system, you can 'hijack' a variable for a report you are not using. In your example you could use %v (Virtual Hosts) and then turn on the Virtual Host report to see results for top accounts. LOGFORMAT (%S %Y-%m-%d %h:%n:%j %j %u %v %j %r %c %t %b '%B') VHOST ON -- Jeremy Wadsack On Thu, Nov 19, 2009 at 4:10 PM, David Paul <david.paul-NYnJyUtGVOFWk0Htik3J/[email protected]> wrote= : > Is there a way to setup the LOGFORMAT, such that it can accept an > =93unrecognized type=94, such as an account number. Currently, I have th= e > following log format setup, but want to be able to run reports utilizing = the > account number =91A-35815' instead of ignoring it.. > > > > LOGFORMAT (%S %Y-%m-%d %h:%n:%j %j %u %j %j %r %c %t %b '%B') > > > > 172.17.16.198 2009-09-04 18:31:20 '25368CAA5FF08DE4855FA7E1A8BDAD7D' > 'WINDERA' 'A-35815' POST /nextthing/start.seam/ 200 0.563 107470 > 'Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.13) > Gecko/2009073022 Firefox/3.0.13 (.NET CLR 3.5.30729)' > > > > Thanks for the Help > > > > David > The information contained in this email is intended only for the > individual to whom it is addressed. It may contain privileged and/or > confidential information.If you have received this message in error pleas= e > notify the sender immediately and delete the message from your computer. = The > unauthorised use, disclosure, copying or alteration of this message is > forbidden. The sender will not be liable for direct, special, indirect or > consequential damage as a result of any virus being passed on, or arising > from alteration of the contents of this message by a third party. > www.vertexna.com > > +------------------------------------------------------------------------ > | TO UNSUBSCRIBE from this list: > | http://lists.meer.net/mailman/listinfo/analog-help > | > | Analog Documentation: http://analog.cx/docs/Readme.html > | List archives: http://www.analog.cx/docs/mailing.html#listarchives > | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general > +------------------------------------------------------------------------ > > --00163649a6f34091860478c292f3 Content-Type: text/html; charset=windows-1252 Content-Transfer-Encoding: quoted-printable You can do one of two things, depending on what you want.<br><br>To see a r= eport of all traffic for the account 'A-35815', just use that in yo= ur log format instead of %j. Analog will ignore all other lines in the repo= rt.<br> <br><div style=3D"margin-left: 40px;"><p class=3D"MsoNormal"><font face=3D"= Arial" size=3D"2"><span style=3D"font-size: 10pt; font-family: Arial;">LOGF= ORMAT (%S %Y-%m-%d %h:%n:%j %j %u 'A-35815' %j %r %c %t %b '%B')</span></font></p> <font face=3D"Arial" size=3D"2"><span style=3D"font-size: 10pt; font-family= : Arial;"></span></font></div>To see a report of all accounts on the system= , you can 'hijack' a variable for a report you are not using. In yo= ur example you could use %v (Virtual Hosts) and then turn on the Virtual Ho= st report to see results for top accounts.<br> <br><div style=3D"margin-left: 40px;"><font face=3D"Arial" size=3D"2"><span= style=3D"font-size: 10pt; font-family: Arial;">LOGFORMAT (%S %Y-%m-%d %h:%= n:%j %j %u %v %j %r %c %t %b '%B')<br>VHOST ON<br></span></font></div><br>--<br clear=3D"all">Je= remy Wadsack<br> <br><br><div class=3D"gmail_quote">On Thu, Nov 19, 2009 at 4:10 PM, David P= aul <span dir=3D"ltr"><<a href=3D"mailto:david.paul-NYnJyUtGVOFWk0Htik3J/[email protected]">david.= paul-NYnJyUtGVOFWk0Htik3J/[email protected]</a>></span> wrote:<br><blockquote class=3D"gmail_quote= " style=3D"border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0= .8ex; padding-left: 1ex;"> <div link=3D"blue" vlink=3D"purple" lang=3D"EN-US"> <div> <p class=3D"MsoNormal"><font face=3D"Arial" size=3D"2"><span style=3D"font-= size: 10pt; font-family: Arial;">Is there a way to setup the LOGFORMAT, suc= h that it can accept an =93unrecognized type=94, such as an account number.=A0 Currently, I have the following log format setup, but want to be able to ru= n reports utilizing the account number =91A-35815' instead of ignoring it= ..</span></font></p> <p class=3D"MsoNormal"><font face=3D"Arial" size=3D"2"><span style=3D"font-= size: 10pt; font-family: Arial;">=A0</span></font></p> <p class=3D"MsoNormal"><font face=3D"Arial" size=3D"2"><span style=3D"font-= size: 10pt; font-family: Arial;">LOGFORMAT (%S %Y-%m-%d %h:%n:%j %j %u %j %= j %r %c %t %b '%B')</span></font></p> <p class=3D"MsoNormal"><font face=3D"Arial" size=3D"2"><span style=3D"font-= size: 10pt; font-family: Arial;">=A0</span></font></p> <p class=3D"MsoNormal"><font face=3D"Arial" size=3D"2"><span style=3D"font-= size: 10pt; font-family: Arial;">172.17.16.198 2009-09-04 18:31:20 '25368CAA5FF08DE4855FA7E1A8BDAD7D' 'WINDERA' 'A-35815&#= 39; POST /nextthing/start.seam/ 200 0.563 107470 'Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.= 9.0.13) Gecko/2009073022 Firefox/3.0.13 (.NET CLR 3.5.30729)'</span></font></p> <p class=3D"MsoNormal"><font face=3D"Arial" size=3D"2"><span style=3D"font-= size: 10pt; font-family: Arial;">=A0</span></font></p> <p class=3D"MsoNormal"><font face=3D"Arial" size=3D"2"><span style=3D"font-= size: 10pt; font-family: Arial;">Thanks for the Help</span></font></p> <p class=3D"MsoNormal"><font face=3D"Arial" size=3D"2"><span style=3D"font-= size: 10pt; font-family: Arial;">=A0</span></font></p> <p class=3D"MsoNormal"><font face=3D"Arial" size=3D"2"><span style=3D"font-= size: 10pt; font-family: Arial;">David</span></font></p> </div> The information contained in this email is intended only for the individual= to whom it is addressed. It may contain privileged and/or confidential inf= ormation.If you have received this message in error please notify the sende= r immediately and delete the message from your computer. The unauthorised u= se, disclosure, copying or alteration of this message is forbidden. The sen= der will not be liable for direct, special, indirect or consequential damag= e as a result of any virus being passed on, or arising from alteration of t= he contents of this message by a third party. <a href=3D"http://www.vertexna.com" target=3D"_blank">www.vertexna.com</a> </div> <br>+----------------------------------------------------------------------= --<br> | =A0TO UNSUBSCRIBE from this list:<br> | =A0 =A0<a href=3D"http://lists.meer.net/mailman/listinfo/analog-help" tar= get=3D"_blank">http://lists.meer.net/mailman/listinfo/analog-help</a><br> |<br> | =A0Analog Documentation: <a href=3D"http://analog.cx/docs/Readme.html" ta= rget=3D"_blank">http://analog.cx/docs/Readme.html</a><br> | =A0List archives: =A0<a href=3D"http://www.analog.cx/docs/mailing.html#li= starchives" target=3D"_blank">http://www.analog.cx/docs/mailing.html#listar= chives</a><br> | =A0Usenet version: news://<a href=3D"http://news.gmane.org/gmane.comp.web= .analog.general" target=3D"_blank">news.gmane.org/gmane.comp.web.analog.gen= eral</a><br> +------------------------------------------------------------------------<b= r> <br></blockquote></div><br> --00163649a6f34091860478c292f3-- --===============0014993218== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline +------------------------------------------------------------------------ | TO UNSUBSCRIBE from this list: | http://lists.meer.net/mailman/listinfo/analog-help | | Analog Documentation: http://analog.cx/docs/Readme.html | List archives: http://www.analog.cx/docs/mailing.html#listarchives | Usenet version: news://news.gmane.org/gmane.comp.web.analog.general +------------------------------------------------------------------------ --===============0014993218==--