[Logwatch-Devel] Parsing RealServer Logs

Bjorn L. bl_logwatch at mblmail.net
Thu Dec 8 12:13:36 MST 2005

Pelkey, Jeff wrote:
> Howdy,
> I am trying to configure the RealServer logs into Logwatch and having a time with the LogFormat var.  I used the http.conf files to start with and have tried several things with no success.  It is the last six fields I think I need help getting straightened out.  We are using the default logging style (#5), which looks like this:
> Logging style 5, which is the default style, does not build on the preceding styles. Instead, it copies style 2 and adds a presentation ID that helps you keep track of presentations that contain multiple clips: 
> IP_address - - [timestamp] "GET filename protocol/version" HTTP_status_code
> bytes_sent [client_info] [client_ID] [client_stats_results] file_size file_time
> sent_time resends failed_resends presentation_ID

This indeed looks like the default, with additional fields.  Have you
tried the default settings (i.e., leaving LogFormat, HTTP_FIELDS, and
HTTP_FORMAT commented out?)

As the comments indicate, HTTP_FIELDS and HTTP_FORMAT are there for
backwards compatibility, and should no longer be used once LogFormat
is used.  The LogFormat string can be copied directly from your
httpd.conf file, but in your case that does not appear necessary

The extra fields will not be analyzed and reported in LogWatch.  To do
that you'd need to modify the script file itself.

More information about the Logwatch-Devel mailing list