Apache logs and webtrends

Can't get new log format to resolve IP's correctly

[John]

Since moving site on to Bluhill.com servers I cannot get Webtrends to resolve the IP addresses (DNS look up?) correctly.
I am no expert on this so please forgive me if I get any techie bits wrong here.

The log format is Apache ( not extended Apache) and I have elected to look up/ resolve IP addresses in web trends.

The reports that I really want are the referers and keywords.

These give what look like the numerical IP and then part of the next two fieds, see below, in the Webtrends report.

194.143.192.225 - - [18/

If I openthe log file the early part of the data string looks like this'

www.nitmix.com¦216.98.68.173 - - [22/Apr/2001:10:24:10 -0400] "GET / HTTP/1.1" 200 17413 "http://google.yahoo.com/bin/query?p=how+to+get+rid+of+head+lice&hc=0&hs=2" "Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; Win 9x 4.90)"

I dont understand the vertical bar symbol after the URL should it be there?

If any one can help I would be eally pleased.

Webtrends were very unhelpful and Bluehill said they have re structured the log to remove the bar but it's still there.

Sorry it's a long post.

John

PS Is any one usind Adminder?

[mark_roach]

John I suspect if you could remove the www.nitmix.com¦ from the log record then Webtrends could handle it OK. Does webtrends give you the option of defining the format of the log records ?

[John]

I am really not sure on that. I could open in wordpad and find replace but i am not sure what to re save as, the original apache log is call access_log and doesn't respond to a ricght click/properties so I don't know waht to save as.

Iam very frustrated that Bluehill.com aren't familiar withthis problem.

thanks for the reply

John

[mark_roach]

John, sorry for the slow response, downloading the webtrends manual and adobe @ 56K takes some time :)

It looks to me as if your log records are in extended Apache format, plus the additional infomation at the start of the record (www.nitmix.com¦).

Try creating a file with just one record in it, don't worry about the file extension, webtrends should just read it asis, strip out the "www.nitmix.com¦" bit:

eg.

216.98.68.173 - - [22/Apr/2001:10:24:10 -0400] "GET / HTTP/1.1" 200 17413 "http://google.yahoo.com/bin/query?p=how+to+get+rid+of+head+lice&hc=0&hs=2" "Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; Win 9x 4.90)"

Run that through webtrends and see if the output makes sense. If it does go back to your host and ask them to remove the extraneous info at the start of the record from your logs.

If they do not produce the goods a simple half-dozen line perl script could chop off the unwanted info, alternatively find and replace will probably do the job.

Mark