SAWMILLFORUM

The first screen shot is unchanged. When checking the second screen I got the following error, and when I tried to report the error Sawmill could not connect to my smtp.

Unable to read 112 bytes from LogAnalysisInfo\Databases\knob\main\Tables\_select_result_4140_0\data.tbl.moved; got only 0 bytes (No such file or directory)

Error occurred at: : ........srcutilities.cpp:3156 Error occurred in Salang in subroutine raw_standard_table_setup() at LogAnalysisInfo emplatesstatistics aw_report_elementstandard aw_standard_table_setup.cfv:227 called from Salang subroutine build_raw_report_element() at LogAnalysisInfo emplatesstatistics aw_report_elementbuild_raw_report_element.cfv:275 called from Salang subroutine build_report_elements() at LogAnalysisInfo emplatesstatisticsbuild_report_elements.cfv:123 called from Salang at LogAnalysisInfo emplatesstatisticsbuild_report_elements_init.cfv:55

Lou

Is it possible to run a command at the shell/command prompt to clear the report cache?

If so, I would recommend that you run the command below from the Sawmill install directory....

sawmill.exe -a crc -p profile_name

Where profile_name is the internal name of your profile, or you can put the profile name seen in the GUI in double quotes.

Then attempt to run the log detail report again, and then run the filtered version to see if

I'm going to send this along to development for their review.

I will be glad to provide any other data you need.

Lou

Received the email in our support system, and I've reproduced the issue locally. Thanks for taking the time to send this in, and report it in such detail.

We should have resolution shortly.

Lou

Log detail issue has been resolved, stand by for feedback related to session ordering issue. Still not resolved, but in progress.

Lou

tracked the root of this issue. The log-format plug-in selected was not the format type that this log data was auto-detected as.

I would recommend that you attempt to create a new profile, and detect the format using the log format that's auto-detected. This will show the correct order of pages visited in the sessions report.

Starting a new profile using just the daily log file for 9 Feb 2010 this thread started with.

After a moment the wizard offered the following list of options:

Aventail Web Access (Syslog Required) Log Format
Aventail Web Acess Log Format
Common Access Log Format
Instagate Acess/Secure Access Log Format
Know-how Log Foramt
Tomcat Log Format

My ISP tells me they Common Access Log Format is what the Apache server uses for logs.

The results are the same as before with /ATG/(default) at the end of the session not the beginning.

After the 9th of Feb I ask my ISP to include the referrals in my log. Using a later log file the wizard offers the following 3 options:

Apache/NCSA Combined Log Format
Aventail Web Access (Syslog Required) Log Format
Aventail Web Acess Log Format

Again why would I select an Aventail format? Again when I add the 9 Feb log, results are the same.

When I tried the Aventail Web Acess Log Format, some reports generation end in a error.

Is the error in the Apache/NCSA Combined Log Format plug-in the reason only HTML log entries are analyzed?

Lou

What happens when you attempt to create this profile with Apache/NCSA Combined Log Format?

When I use Apache/NCSA Combined Log Format I get the same result as originally or when I now use Common Access Log Format.

On the Session report, the /ATG/{default} page, time stamp 16:10:54, is shown after /ATG/Org/Mission page, 16:12:17, instead of before /ATG/NewA page, at 16:11:14.

My guess, and that's all it is, is that there is a sorting error due to the difference in file type. The errant /ATG/{default} is the only request without a file type. All the others are HTML files.

Thanks for hanging in there and beating this thing to ground.

Lou

I ran a profile using the "Common Access Log Format" which was the auto-detected format for the sample you sent in.

When I ran the report, The output was correct. Can you try that with the sample you sent us?

I'm not sure I agree. Looking at the date stamps in screen shot in #1 above the order should be:
1. /ATG/{default}
2. /ATG/NewA
3. /ATG/Youth
4. /ATG/ToDo
5. /ATG/Mission

The screen shot you sent me shows the pages in 1, 4, 5, 2, 3 order.
The results shown in #0 above is 2, 3, 4, 5, 1 (with filters)
The results from the test you ask for is 1, 3, 4, 2, 5 (Path-3 emailed to you)
With filtering I now get 2, 3, 4, 5, 1 again (Path-4 emailed to you)

I emailed my step-by-step of building an new profile using the test data, with screen shots of the results.

Lou

97.151.20.83 - - <09/Feb/2010:16:10:54 -0500> "GET /ATG/ HTTP/1.1" 200 6682
97.151.20.83 - - <09/Feb/2010:16:10:56 -0500> "GET /log_analysis_screen_info.gif?width=1280&height=800&depth=32 HTTP/1.1" 404 226
97.151.20.83 - - <09/Feb/2010:16:11:14 -0500> "GET /ATG/NewA.html HTTP/1.1" 200 9432
97.151.20.83 - - <09/Feb/2010:16:11:22 -0500> "GET /log_analysis_screen_info.gif?width=1280&height=800&depth=32 HTTP/1.1" 404 226
97.151.20.83 - - <09/Feb/2010:16:11:24 -0500> "GET /ATG/Youth.html HTTP/1.1" 200 3595
97.151.20.83 - - <09/Feb/2010:16:11:30 -0500> "GET /log_analysis_screen_info.gif?width=1280&height=800&depth=32 HTTP/1.1" 404 226
97.151.20.83 - - <09/Feb/2010:16:11:37 -0500> "GET /ATG/ToDo.html HTTP/1.1" 200 7554
97.151.20.83 - - <09/Feb/2010:16:12:17 -0500> "GET /ATG/Org/Mission.html HTTP/1.1" 200 5105
97.151.20.83 - - <09/Feb/2010:16:12:42 -0500> "GET /log_analysis_screen_info.gif?width=1280&height=800&depth=32 HTTP/1.1" 404 226

Lou

We found the issue, it is indeed a bug, and it's been resolved in the latest pre-release, and will be available in the next release of Sawmill 8.1.5.