Weird log format

[2004mark]

We are dealing with a site that is hosted with Demon. The log files generated are not readable by our analyzer software (Webtrends Log Analyzer 7).

I have always had "Auto-detect log file type" selected with no problem for logs from 10s of other servers.

This log file has all the required fields but in the wrong order.

Here is an example line (domain and ip details changed):

www.domain.co.uk 111.111.111.111 - - [25/Nov/2007:07:46:25 +0000] "GET / HTTP/1.1" 200 8730 "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.9) Gecko/20071025 Firefox/2.0.0.9" "http://www.google.co.uk/search?hl=en&q=QUERY&btnG=Search&meta=" "-"

The first thing that jumps out is the domain name is at the start of every line which I have never seen.

The referrer and the browser also seem to be the wrong way around.

Webtrends has around 30 specific log file formats I could select but no idea which one. Is this format familiar to anyone?

Demon say it is a "Demon Internet" format, they can change the format to a standard one, but this will not help for previous months.

Any advice would be greatly appreciated.

[cgrantski]

As I recall, WebTrends Log Analyzer also has an "auto select" log format choice, or something like that. That would be the first one to try if you haven't already.

Also, it shouldn't take too long to go through all 30 formats. WebTrends will give you a pretty quick idea of whether each one is going to generate an error or not.

If none of them work, you could ask Demon to change the format to something standard and then change all your old logs to match with a script or possibly a command line function that tokenizes all the fields and then reorganizes each line according to a specific token list.

Shame on Demon making up their own willy-nilly format. What were they thinking?

[2004mark]

Well I just spoke with Demon again, this time to someone who was very helpful. He said that it is there own 'version' of NCSA which is out the ark (this is an old domain, I doubt they use it now with new accounts anymore) and he will switch it to NCSA common tonight.

This is great but I still cant read the logs previous to today.

I have tried specifying all the different NCSA formats in Webtrends but with no luck.

I hope somebody can help, I'm sure you can understand how curious I am to see the stats for this domain pre re-design!

[cuiyj]

www.domain.co.uk : virtual domain
111.111.111.111: remote ip
- -: authenticated user name and remote log file name
[25/Nov/2007:07:46:25 +0000]: time
GET : http method
/ : requested file
HTTP/1.1 : protocol
200: http status code
8730: bytes transferred
"Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.9) Gecko/20071025 Firefox/2.0.0.9" : user agent
"http://www.google.co.uk/search?hl=en&q=QUERY&btnG=Search&meta=": referrer
"-": I don't know, maybe cookie

The log format can be recognized by Nihuo log analyzer [loganalyzer.net]