[Gllug] Apache log files

[william pink]

On Wed, Apr 8, 2009 at 4:11 PM, Peter Corlett <abuse at cabal.org.uk> wrote:

> On Wed, Apr 08, 2009 at 04:01:40PM +0100, damion.yates at gmail.com wrote:
> [...]
> > Maybe I'm missing something but it looks like this will blat a file of
> > name $path every time it changes (back), so if a log entry contains
> > 05/Mar/2009 and then 06/Mar/2009, but later returns to 05/Mar/2009, you
> > wipe all previously logged 05/Mar/2009 entries.
>
> > It might sound a little unlikely, but perhaps the user-fed-in data (the
> > <>), might contain some multiple, overlapping logs, maybe part of a pipe
> > from zcat, or apache processes/threads might write either side of
> > midnight?
>
> Yes, this is a bug I spotted after posting. Use '>>' instead of '>'.
>
> > Maybe your regex (which should use \d and \w where necessary and be bound
> > by \s), will match a referrer (user's browser supplied), which isn't
> > escaped and so could contain the [ and / around the right number of
> > characters?
>
> That shouldn't matter in this specific case because the regex will only
> match the *first* matching string, which will always be the date field.
> Whether \d and \w "should" be used is very much a matter of taste.
>
> --
> Gllug mailing list  -  Gllug at gllug.org.uk
> http://lists.gllug.org.uk/mailman/listinfo/gllug
>

Thats great, thanks for explaining the script also gives me a much better
understanding and I hope I will be writing similar in the not to distant
future.

Will
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.lug.org.uk/pipermail/gllug/attachments/20090408/6a727dae/attachment.html>
-------------- next part --------------
-- 
Gllug mailing list  -  Gllug at gllug.org.uk
http://lists.gllug.org.uk/mailman/listinfo/gllug