cookies

but nothing in logfiles

[chewy]

Hi,

I am working on a new site that has this cookie thang happening, or so I surmise.

I know, from using LYNX, that there is a cookie being set.

Yet, when I look at the logfiles, there is nothing resembling a cookie there.

Is this possible?

Sign me clueless,

Chewy

[mnorton]

Cookies are not usually recorded in server logs unless you secifically tell them to do so. In apache you can do this if you check out the apache documentation this should help you.

Mike

[chewy]

What seems odd is that if I turn on "cookies" in Web Trends (Log Analyzer 7.0), it shows some odd stuff, things that acually look like cookies in the visitors sections.

If these aren't in the logs, how can WT see them?

Thanks,

Chew

[chewy]

Um, me again...

This is what WebTrends reports in the Top Visitors section - sometimes occasionally and sometimes frequently.

SITESERVER=ID=645b0518042c0acf204163151bc7251e

It also obscures the IP.

and, no, I cannot see these in "log views" however it appears they are supposed to be there - and WT can see them -- please, where would they be?

Perhaps I have WebTrends misconfigure as to log type?

Will randomly trying different log types yeild any clues for our hapless Chew-master?

Still somewhat clueless....

Thanks,

Chew

[mnorton]

SiteServer ID is a line that is automatically placed in the log by IIS and you should see it when browsing the logfiles you should see lines as follows :-

2002-01-01 01:49:54 xxx.xxx.xxx.xxx - GET /resources/images/main/bg.gif - 200 300 Mozilla/2.0+(compatible;+MSIE+3.02;+AK;+Windows+NT) ASPSESSIONIDGQQGQGAD=IIHCBIFDIECKPAPGICDEOJII;+
SITESERVER=ID=22e0a17296b8c2ed1f77460cde75c27f [exploit-lib.org...]

Could you post a couple of lines from your log so that I can see?

Mike

[chewy]

Mike,

Thanks - yes, if I look at raw logfiles, say using notepad, I can see the cookies.

Perhaps this is a fine point - I am used to using WT Log Analyzer 7 and I use the File - View Log File menu to look at the files, and this is where I don't see the cookie.

There is a "Detailed Log Report" choice however I can't get it to work.

Other than using this "feature" in Log Analyzer, is there another way to view raw logs? I googled for a logfile viewer but found little in the way of more than I already know.

Here is a chunk of logfile data:

#Software: Microsoft Internet Information Services 5.0
#Version: 1.0
#Date: 2001-12-04 18:29:07
#Fields: date time c-ip cs-username s-ip s-port cs-method cs-uri-stem cs-uri-query sc-status sc-bytes cs(User-Agent) cs(Cookie) cs(Referer)

SITESERVER=ID=6bf52a45ddc78f74fe8bfb444774b6c2;+ASPSESSIONIDQQGQQOXC=FHMIANJACAALOCMCIANBMNHJ -
2001-12-04 18:50:12 204.57.38.202 - 209.6.222.136 80 GET /images/abdclogo.gif - 304 141 Mozilla/4.0+(compatible;+MSIE+5.5;+Windows+NT+5.0) SITESERVER=ID=6bf52a45ddc78f74fe8bfb444774b6c2;+ASPSESSIONIDQQGQQOXC=FHMIANJACAALOCMCIANBMNHJ;+ASPSESSIONIDGQGGGXCK=FCGBDNICKGPEHFCHLBICGLPE [domainname.org...]
2001-12-04 18:50:12 204.57.38.202 - 209.6.222.136 80 GET /images/lmnopLogo.gif - 304 141 Mozilla/4.0+(compatible;+MSIE+5.5;+Windows+NT+5.0) SITESERVER=ID=6bf52a45ddc78f74fe8bfb444774b6c2;+ASPSESSIONIDQQGQQOXC=FHMIANJACAALOCMCIANBMNHJ;+ASPSESSIONIDGQGGGXCK=FCGBDNICKGPEHFCHLBICGLPE [domainname.org...]
2001-12-04 18:50:12 204.57.38.202 - 209.6.222.136 80 GET /images/qrst.gif - 304 141

More and more clueful a bit at a time!

Chewy

[mnorton]

I would recommend using something such as TextPad or Programmers File editor, sticky me for adddresses but basically any text editor should allow you to view the raw logs

Thanks

Mike

[chewy]

Thanks - very helpful.

Does a plain cookie (like my server is issuing) do anything different than a WebTrends cookie?

When I turn "cookies on" in WT, I get all these siteserver ID's (in the visitor tab) which seem virtually useless.

What happens with those issued by WT?

C.