Re: What's next after the common log format?

>> We ended up using a Tcl list-based format for the entries, that look like
>> this (wrapped for the reader's benefit):
>> log {start 803173054.917815} {method GET} {url /~payne/link.html} \
>>     {bytes 0} {error {file not found}} {status 404} {end 803173054.930446} \
>>     {host localhost}
>
>30% expansion I could live with. However:
>
>Your example doesn't balance curlies; the line ends with the {error
>.. } element open.

Are you talking about this entry?

    {error {file not found}}

The braces are balanced:  two left and two right.  This is a side-effect of 
how Tcl does quoting (see below).

>Hmm - maybe a tool that ate NLF (New Log Format) files and a config
>and spat out CLF files???

We've developed a tool for exactly this.  It got incorporated into our 
WebReporter product (for log analysis and reporting).

>So, do you have a formal proposal written up? Want to cooperate on one
>(might not work well - I want to use "("'s for the seperator :-)?

I'm working on one.

By the way, the '{' seperators came from Tcl; the Tcl C library has 
built-in routines to put together and tear apart lists in this string 
format.  The curly-braces are pretty ugly, but we rarely look at the log 
format directly anyway (instead, we depend on filters and analysis 
programs).  We wanted something that was robust, easy to parse, but human 
readable for those parsing emergencies.

Of course, the fastest way to get everyone to agree would be to publish the 
C and Perl source code to read and write the log format.

-andy

Received on Wednesday, 28 June 1995 21:26:48 UTC