Mailing-List: contact users-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@httpd.apache.org
Content-Type: text/plain;
  charset="iso-8859-1"
From: Ben Spencer <ben.spencer@moody.edu>
To: users@httpd.apache.org
Subject: I want to mimic an IIS log file, how?
Date: Tue, 15 Jan 2002 11:20:06 -0600
MIME-Version: 1.0
Message-Id: <0201151120060E.10043@genesis.moody.edu>
Content-Transfer-Encoding: 8bit

We are running an apache server and an IIS server on another system with a 
single site split between the two. We want to process the logs through a log 
analyzer at the same time, so that the site stats can contain the states from 
both sites at the same time. For this to happen, the log files must be in the 
same format. Fortunately Apache allows for a very flexible log format. I am 
98% there, and am wondering if someone can verify Apache logging as the same 
format as IIS.

With IIS, I am logging the following fields: date, time, c-ip, cs-username, 
cs-method, cs-uri-stem, cs-uri-query, cs-status, cs-bytes, time-taken, 
cs-version, cs-host, cs(User-Agent), cs(Cookies), cs(Referer)

My Apache log format looks like this:
LogFormat "%{%Y-%m-%d %H:%M:%S}t %h %u %m %U %q %>s %b %T %H %{Host}i 
%{User-Agent}i %{Cookie}i %{Referer}i" iis

things look pretty good...

example IIS log:
2002-01-15 16:52:05 66.185.253.15 - GET /pagerror.gif - 304 483 0 HTTP/1.0 
bspencer2.moody.edu Mozilla/4.76+[en]+(X11;+U;+Linux+2.4.9+i686) 
ASPSESSIONIDQGGSMTFC=KPOHKMCCLJFNCCIFDAEEGNCN http://bspencer2.moody.edu/

example Apache log:
2002-01-15 11:02:22 66.185.253.15 - GET /3.php  200 115 0 HTTP/1.0 
genesis.moody.edu:8000 Mozilla/4.76 [en] (X11; U; Linux 2.4.9 i686) 
ASPSESSIONID=66.185.253.15.92671011114122775 http://genesis.moody.edu:8000/

the problem that I am left with, is the spaces in the User Agent (IIS seems 
to replace spaces with a "+"). Cookies might have the same issue (need to 
find out yet). with the spaces, it makes parsing the log files really head. 
Is there a way for Apache logging to replace the spaces with a "+" also?

I am running Apache 1.3.12 (as the one module we are using will not work on a 
newer version).

thanks
benji


---

Ben Spencer

Web Support

bspencer@moody.edu

x 2288

---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org