> On Thu March 1 2007 08:10, Arthur Sherman wrote:
> > > One of our servers is sending me this everyday.
> > >
> > > /usr/bin/analog: analog version 5.32/Unix
> > > /usr/bin/analog: Warning L: Large number of corrupt lines
> in logfile
> > > stdin:
> > > turn debugging on or try different LOGFORMAT
> > > (For help on all errors and warnings, see docs/errors.html)
> > > Current logfile format:
> > > %v %S %j %u [%d/%M/%Y:%h:%n:%j] "%j%w%r%wHTTP%j" %c %b "%f"
> > > "%B"\n
> > > %S %j %u [%d/%M/%Y:%h:%n:%j] "%j%w%r%wHTTP%j" %c %b
> "%f" "%B"\n
> > > %S %j %u [%d/%M/%Y:%h:%n:%j] "%j%w%r" %c %b "%f" "%B"\n
> > > %S %j %u [%d/%M/%Y:%h:%n:%j] "%r" %c %b "%f" "%B"\n
> > > /usr/bin/analog: analog version 5.32/Unix
> > > /usr/bin/analog: Warning L: Large number of corrupt lines
> in logfile
> > > stdin:
> > > turn debugging on or try different LOGFORMAT
> > > (For help on all errors and warnings, see docs/errors.html)
> > > Current logfile format:
> > > %v %S %j %u [%d/%M/%Y:%h:%n:%j] "%j%w%r%wHTTP%j" %c %b "%f"
> > > "%B"\n
> > > %S %j %u [%d/%M/%Y:%h:%n:%j] "%j%w%r%wHTTP%j" %c %b
> "%f" "%B"\n
> > > %S %j %u [%d/%M/%Y:%h:%n:%j] "%j%w%r" %c %b "%f" "%B"\n
> > > %S %j %u [%d/%M/%Y:%h:%n:%j] "%r" %c %b "%f" "%B"\n
> > >
> > > Any one else seen this??
> > >
> > > Thanks
> > > Jason
> >
> > I have.
> > Did you have the basic firewall installed? It might be its
> leftovers.
> > Unfortunatelly, I didn't get an answer how to deal with it.
> >
>
> Jason, Arthur, et al.
>
> Ok, just started getting this on a server that I recently updated.
> Turns out it appears to be a difference in how Apache (httpd)
> is logging versus what analog expects to see. My answer
> (that appears to have fixed it) was to edit the
> /etc/httpd/conf/httpd.conf file and change the LogFormat line
> as follows:
>
> <quote>
> ##LogFormat "%v %h %l %u %t \"%r\" %>s %b \"%{Referer}i\"
> \"%{User-Agent}i\""
> combined
> LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\"
> \"%{User-Agent}i\""
> combined
> </quote>
>
> Note I copied the line, commented the original out, then
> deleted the %v and a space from the beginning of the line.
> Your mileage may vary... but it stopped my error messages from cron.
>
> --
> Larry Smith
> lesmith (at mark) ecsis.net
Thanks! I'll give it a try a inform the ML.
Best,
--
Arthur Sherman