Re: Reliable combined log sorting

[Jason Nunnelley <jason@xxxxxxxxxx>]

On 5/9/10 10:36 AM, Eike Frost wrote:

Hi Jason,

On Sun, May 9, 2010 at 5:41 AM, Jason Nunnelley <jason@xxxxxxxxxx> wrote:

In our configuration of Apache we push all logs to a single file via syslog-ng. I need to create some basic log analysis (like AWstats style) for a single domain out of several domains that post to that file. Any suggestions on a simple solution?

What LogFormat are you using, precisely ? And what, precisely, is the problem you are having (you mention sorting in the subject, but nothing related to it in the body).

I decided to punt and just grep out the lines I needed. It does have the %v config in the Apache conf. Most of what I'm dealing with are old logs, so I'm not so much looking (yet) to create better logs in the future (which seems to me would be best to split out by virtual host).

This is the config I have for cranking out some AWstats. My lazy punt solution was to just grep out the lines that relate to my vhost of choice, perhaps I could set a simple perl script to split those into appropriate segregated logs.

My log config:
LogFormat = "%other %other %other %other %virtualname %host %other %logname %time1 %methodurl %code %bytesd


This is an actual log example for one vhost in the combined file.

2010-05-09T16:18:44-0400 <local3.info> domID-XX-XX-XX-XX-XX-XX http: www.domain.com 10.10.10.XX - - [09/May/2010:16:18:43 -0400] "GET /galleries/image.jpg HTTP/1.1" 200 28553 "http://www.domain.com/swf/include/nav.swf" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET CLR 2.0.50727)"

I have two sets of log types to deal with: historical logs; future logs.

-- 

Jason A. Nunnelley
+1 2562971652

http://www.google.com/profiles/imjasonn

[Member Tekany, LLC]