readme

来自「一百个病毒的源代码 包括熊猫烧香等 极其具有研究价值」· 代码 · 共 178 行

                   Modular Log Analyzer (modlogan) - 0.6.x

                  Last edited: $Date: 2000/12/23 11:41:21 $

Overview
========
Modlogan is a modluar logfile analyzer which is currently able to parse
ftp-, webserver and squid logs. The generated output can be viewed by a
webbrowser (->moglogan, webalizer) or your favorite text editor (->text).

The different input and output modes are provided by some surrounding
plugins. For example the modlogan output plugin provides three different
menu structure for the same colourfull output while the output which is 
generated by the webalizer output plugin looks similar to the output 
generated by the original Webalizer known from 
http://www.mrunix.net/webalizer/. 

The input is handled the same way. One plugin is for the web server logs,
the next is for xferlog from FTP-servers like WuFTP and the third input
plugin is a NULL plugin which does nothing (but this perfectly :).

Installation
------------

Read INSTALL for installation instructions.

Incompatible Changes
--------------------
Modlogan 0.6.0
..............
the state file format has changed again. use the supplied 
script to fix it. -> ./doc/convert_to_060.pl

call it on every state file:
 
$ mv modlogan.state.gz modlogan.state.gz.old
$ gzip -cd modlogan.state.gz.old | perl convert_to_060.pl | gzip -c > \
  modlogan.state.gz

Modlogan 0.5.5
..............
some keys of the configfile have changed there layout. use the convert
script to fix it. -> ./doc/convert_to_055.pl


Configuration
-------------

Read INSTALL for a quickstart and doc/using-plugins.txt for more detailed
instructions.

Mailinglists
------------
It is recommend to subscribe to the mailinglist of modlogan. It covers the
announces of new releases, some of the hotfixes which are regulary posted as
soon as a major bug is found and the normal discussion.

[You have to subscribe to the list before you can post to the list.]

Send a mail to (body and subject don't matter)
  [e-mail]

The mailinglist-adress is 
  [e-mail]

Updates
-------
You can get the latest source from
  http://www.kneschke.de/projekte/modlogan/download/

Pre-releases for testers are located at
  http://www.kneschke.de/projekte/modlogan/download/pre/

Please make sure that you're using the lastest release if you find bug as
a new version of modlogan is released multiple times a month.

New versions are announced on the mailinglist.

For the experienced
===================

Some parts of modlogan are tied to the fast moving internet. Especially the
searchengine detection and the country strings will never be complete. You
could tell that the number of countries on earth is limited but watch out
for the new top level domain that will come up in the near future. 
  To be able to stay tuned modlogan has some special debug option that print
out the neccessary information.

Searchengines
-------------

If you enable the configfile option

debug_searchengines=1

or for more output

debug_searchengines=2

you can help to find more searchengine strings. modlogan will output every
referrer that is not a already known searchengine and which contains a url
part and some variables after the http-get-var seperator (?). 
  These string are printed to stderr and start with 

o SK ... (http-get-var and a matching searchkey found, 
	  but not a searchengine matched)
o SE ... (http-get-var found, but no searchkey)

the SE will only come up if debug_searchengines is set to '2'.

To find new searchengines grep for these pattern and prepare the gathered
data for further examination:

$ modlogan 2> possible_searchengines.1
$ grep "^o S[EK] " possible_searchengines.1 | sort | uniq > possible_searchengines

I encourage you to send your detected string to me for the inclusion in one
of the next releases.

Read ./doc/manual.txt for information about how to add them
on your own.

Country Strings
---------------

If you get a message like

unknown country code: pa -> 0x70610000

appears on your screen, you discovered a new country in the world out there.
please, feel happy ... NOW.

ney, it's not a new country. it's just a country that isn't recognised by
modlogan, yet. just send me the line and i'll add it the list of detected
countries. 

currently, modlogan knowns 236 countries by it's TLD. 

please forward your country(string)s to Jan Kneschke <[e-mail]>.

Input Parser
------------

modlogan supportes currently the following logfile types:
= processor web =
- clf (Common Logfile Format)
  + Apache (common and combined)
  + Squid (emulate_http_logs = 1)
  + Netscape Web Server
- msiis
  + MS IIS 5.0
- wuftpd
  + WuFTPd
  + ProFTPd
- squid
  + Squid (native logfiles)
- realserver
  + RealServer Suite
- shoutcast
  + Shoutcast
= processor telecom =
- hicom116
  + Siemens Hicom 116 (PABX)
- elmeg
  + unknown Elmeg (PABX)
- isdnlog
  + IsdnLog (logfile format 3.1)

there is no limitation in the number of different input types. if want that
the logfiles of your servers should be parsed by modlogan, send me the
logfile format definition and a sample logfile. this will enable me to write
the corresponding plugin. 

it would be nice if you allow me to include the sample logfile into the CVS 
which will ease the test process for external developers.