AnaloG

The most popular logfile analyser in the world.

Pointers

• http://www.analog.cx/
  • http://www.analog.cx/docs/Readme.html - 6.0 docs
  • http://www.analog.cx/how-to/index.html
• ApachE - apache webserver
• ReportMagic - build prettier graphs from analog reports

• UnixGeekTools - other great tools for unix geeks

Basics

LOGFILE /path/to/access_log
OUTFILE /path/to/analog/reports/report.html
HOSTNAME "geekfarm.org"
HOSTURL "http://www.geekfarm.org/"
IMAGEDIR "http://www.geekfarm.org/images/"
LOGO "mylogo.jpg"
STYLESHEET myanalogstyle.css

• use my config instead of global config:

        analog -G +myconfig.cfg

Subdirs Report

    # expand subdirs of /wu/
    SUBDIR /wu/*

Request Report

    # collapse all GET variations of a cgi
    FILEALIAS /cgi-bin/script.pl* /cgi-bin/script.pl

Excluding addresses from report

    HOSTEXCLUDE 207.224.86.76

Caching

from http://www.analog.cx/docs/cache.html

Analog has the ability to archive some of the data in your logfile into a cache file so that the logfile can be thrown away without losing the most important data. (This is sometimes known as incremental processing.)

For most people, the cache file will not be needed: compressing the logfile using a standard compression utility such as gzip will be sufficient. Compressing a logfile is very efficient owing to the large number of repeated strings: I find about 12 times compression in practice. That in itself may solve your filespace problems, without needing to throw away any information.

The cache file is also not the best format for post-processing the data or feeding it into a spreadsheet. For that you should use the computer-readable output style.