On Thu March 1 2007 08:10, Arthur Sherman wrote:
> > One of our servers is sending me this everyday.
> >
> > /usr/bin/analog: analog version 5.32/Unix
> > /usr/bin/analog: Warning L: Large number of corrupt lines in
> > logfile stdin:
> > turn debugging on or try different LOGFORMAT
> > (For help on all errors and warnings, see docs/errors.html)
> > Current logfile format:
> > %v %S %j %u [%d/%M/%Y:%h:%n:%j] "%j%w%r%wHTTP%j" %c %b
> > "%f" "%B"\n
> > %S %j %u [%d/%M/%Y:%h:%n:%j] "%j%w%r%wHTTP%j" %c %b "%f" "%B"\n
> > %S %j %u [%d/%M/%Y:%h:%n:%j] "%j%w%r" %c %b "%f" "%B"\n
> > %S %j %u [%d/%M/%Y:%h:%n:%j] "%r" %c %b "%f" "%B"\n
> > /usr/bin/analog: analog version 5.32/Unix
> > /usr/bin/analog: Warning L: Large number of corrupt lines in
> > logfile stdin:
> > turn debugging on or try different LOGFORMAT
> > (For help on all errors and warnings, see docs/errors.html)
> > Current logfile format:
> > %v %S %j %u [%d/%M/%Y:%h:%n:%j] "%j%w%r%wHTTP%j" %c %b
> > "%f" "%B"\n
> > %S %j %u [%d/%M/%Y:%h:%n:%j] "%j%w%r%wHTTP%j" %c %b "%f" "%B"\n
> > %S %j %u [%d/%M/%Y:%h:%n:%j] "%j%w%r" %c %b "%f" "%B"\n
> > %S %j %u [%d/%M/%Y:%h:%n:%j] "%r" %c %b "%f" "%B"\n
> >
> > Any one else seen this??
> >
> > Thanks
> > Jason
>
> I have.
> Did you have the basic firewall installed? It might be its leftovers.
> Unfortunatelly, I didn't get an answer how to deal with it.
>
Jason, Arthur, et al.
Ok, just started getting this on a server that I recently updated.
Turns out it appears to be a difference in how Apache (httpd) is logging
versus what analog expects to see. My answer (that appears to have
fixed it) was to edit the /etc/httpd/conf/httpd.conf file and change
the LogFormat line as follows:
<quote>
##LogFormat "%v %h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\""
combined
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\""
combined
</quote>
Note I copied the line, commented the original out, then deleted the %v and a
space from the beginning of the line. Your mileage may vary... but it stopped
my error messages from cron.
--
Larry Smith
lesmith (at mark) ecsis.net