Re: [fwAnalog] Parsing advice for ipf log file

From: Balázs Bárány (balazs~AT~tud.at)
Date: Wed May 15 2002 - 10:32:53 CEST



Hi,

> Does anybody have a simple advice how to deal with multiple log entries
> (2x, 3x, ...).

The 2x, 3x is ignored, this is known. I don't know how to deal with them; it really should be a syslog option to actually log events even if they happen multiple times.

However, you could at least count them one time by changing 793 and 794 (in the freebsd() function) to this:

	#              1             2                         3              4         5          6         7        8         9     
	$perl -pwe "s!^(\d+/\w+/\d+) ([0-9:]+)\.\d+ *[0-9]*x? +(\w+) ~AT~.+ . ([0-9.]+),*(\d*) -\\> ([0-9.]+),*(\d*) PR (\w+) len (\d+).+\$!\$4 - - [\$1:\$2 $timezone] \"GET /$reqhost/\$8/\$7/ HTTP/1.0\" 200 \$9 \"http://\$5/\" \"\" 0 \$3!" \

I've never had large amounts of freebsd logs so I haven't seen 2x in them.

Please inform me if this works.

Regards

-- 
_________________________________________________________________
Balázs Bárány     balazs~AT~tud.at     http://tud.at    ICQ 10747763

Computers. You can't live with them, you can't live without them.



This archive was generated by hypermail 2.1.3 : Mon Jul 29 2002 - 22:22:05 CEST