iPlanet logs for Webtrends?

[tenvalael]

Hello,
I didn't find what I'm looking for with a search...
Can Webtrends analyze iPlanet logs? I performed tests : Webtrends made the analyze but nothing appears in the reports... I guess I have to make something about iPlanet config. Does anyone know anything about analyzing iPlanet logs by Webtrends please?
Thanks in advance

[cgrantski]

I've done it. The problem you're having is *probably* because iPlanet's logs aren't in close chronological order. iPlanet gathers a bunch of requests in memory then dumps them to the log in a clump, out of order within the clump. I think it's 30 seconds or something like that. Anyway, it exceeds WebTrends' threshold for out-of-order lines. The quick fix is to open the logs in something that can handle huge files, like TextPad, and sort on date/time. I think there's a longer-term fix with some versions of WebTrends where you can tell WebTrends to lower its threshold, but it's an .ini file change. Depends on what version you have.

[tenvalael]

hi and thanks for your reply. First of all, I use Webtrends Reporting Center e-business Edition v6.1c. I took a look on iPlanet logs and it's OK : they are correctly sorted by timestamp. When I compare with IIS logs (IIS logs are correctly analyzed by Webtrends) : they don't have the same format (sorry for my bad english). I wonder if I can configure Webtrends to tell it that I am using iPlanet logs or if I must configure iPlanet to build logs that look the same as IIS logs...
Thanks in advance for your advices, ideas,...

[cgrantski]

WebTrends is really good at recognizing and using just about any standard log format. One of our clients uses iPlanet and WT 6.x. If it helps, here's their log's header line:

format=%Req->headers.clientip% - %Req->vars.auth-user% [%SYSDATE%] "%Req->reqpb.clf-request%" %Req->srvhdrs.clf-status% %Req->srvhdrs.content-length% "%Req->headers.referer%" "%Req->headers.user-agent%" cookie:"%Req->headers.cookie%"

and a sample hit:

24.#*$!.xxx.xxx - - [20/Jan/2003:00:01:59 -0500] "GET /favicon.ico HTTP/1.0" 200 1406 "-" "-" cookie:"cookienamehere=11234236215.204320.0004320"

Your logs do contain the header line, don't they? If not, that could be the problem right there.

[tenvalael]

My log file didn't contain the header line! I added it to perform tests (hit example seems to be the same as my log file, except for cookies). I saw I can specify to Webtrends my log format (I use "auto-detect") but "iPlanet log files" is not in the list. I'll ask to NetIQ.

[cgrantski]

It might analyze just fine with "auto-detect" now that you have the header line.