Re: Problems with log analysis scripts

Greetings,

Many thanks to Neil Murray (Neil.Murray@aone.com.au)
and Ed Knowles (ed@fatboy.geog.unsw.edu.au)

for their help in trying to rectify this problem.

Neil hit the nail on the head here :

> The only difference that may matter is the colon (:) in the TCP_*
> section. In squid-logs.pl the line that pulls apart the log format is
> (note this may be different to yours, I have played with this at times);
>
> unless (/^([\d\.]+) \S+ \S+ \[([^\]]+)\] "(\w+) ([^"]+)"+ (\w+) (\d+)$/)
>
> From this I'd say that the last (\w)+ is the problem as \w only
> handles [0-9a-z_A-Z] so the ':' is causing problems. Change the line to
>
> unless (/^([\d\.]+) \S+ \S+ \[([^\]]+)\] "(\w+) ([^"]+)"+ (\w+):\w+ (\d+)$/)
>
> and see if that helps you.

I tried this suggestion from Neil and now the script works !! There is a
new 'histogram' feature in the summary that I have to work out, and the
Top 25 ICP requests section is still blank, but at least I have the majority
of the report now. Thanks.

Neil, could you please explain the extra '+' that you have added :

   unless (/^([\d\.]+) \S+ \S+ \[([^\]]+)\] "(\w+) ([^"]+)" (\w+) (\d+)$/)
   unless (/^([\d\.]+) \S+ \S+ \[([^\]]+)\] "(\w+) ([^"]+)"+ (\w+):\w+ (\d+)$/)
 
                                                           ^
                                                           |

The top line is as per the latest squid-logs.pl from squid.nlanr.net. I didn't
add it to the version that I ran. Thanks.

Regards,

Andrew Kemp

Unix Systems Administrator Phone : 61 +3 9214-8252
Computer and Network Services Fax : 61 +3 9214-8944
Swinburne University of Technology E-Mail: andrew@swin.EDU.AU
Hawthorn, Victoria, Australia 3122 URL: http://opax.swin.edu.au/andrew
Received on Wed Jan 22 1997 - 21:29:42 MST