Re: Problems with log analysis scripts

From: Andrew Kemp <>
Date: Thu, 23 Jan 1997 16:15:36 +1100 (GMT+1100)


Many thanks to Neil Murray (
and Ed Knowles (

for their help in trying to rectify this problem.

Neil hit the nail on the head here :

> The only difference that may matter is the colon (:) in the TCP_*
> section. In the line that pulls apart the log format is
> (note this may be different to yours, I have played with this at times);
> unless (/^([\d\.]+) \S+ \S+ \[([^\]]+)\] "(\w+) ([^"]+)"+ (\w+) (\d+)$/)
> From this I'd say that the last (\w)+ is the problem as \w only
> handles [0-9a-z_A-Z] so the ':' is causing problems. Change the line to
> unless (/^([\d\.]+) \S+ \S+ \[([^\]]+)\] "(\w+) ([^"]+)"+ (\w+):\w+ (\d+)$/)
> and see if that helps you.

I tried this suggestion from Neil and now the script works !! There is a
new 'histogram' feature in the summary that I have to work out, and the
Top 25 ICP requests section is still blank, but at least I have the majority
of the report now. Thanks.

Neil, could you please explain the extra '+' that you have added :

   unless (/^([\d\.]+) \S+ \S+ \[([^\]]+)\] "(\w+) ([^"]+)" (\w+) (\d+)$/)
   unless (/^([\d\.]+) \S+ \S+ \[([^\]]+)\] "(\w+) ([^"]+)"+ (\w+):\w+ (\d+)$/)

The top line is as per the latest from I didn't
add it to the version that I ran. Thanks.


Andrew Kemp

Unix Systems Administrator Phone : 61 +3 9214-8252
Computer and Network Services Fax : 61 +3 9214-8944
Swinburne University of Technology E-Mail: andrew@swin.EDU.AU
Hawthorn, Victoria, Australia 3122 URL:
Received on Wed Jan 22 1997 - 21:29:42 MST

This archive was generated by hypermail pre-2.1.9 : Tue Dec 09 2003 - 16:34:09 MST