Readme for analog -- inclusions and exclusions

[ Top | Up | Prev | Next | Map | Index ]

# Analog 6.0: Inclusions and exclusions

After aliasing each item, analog decides whether that item is wanted or not. The whole line is only counted if all the items are wanted. Whether an item is wanted or not is determined by `INCLUDE` and `EXCLUDE` commands specified by the user. These commands can be used to exclude requests from your local users, for example, or to analyse only files in a subdirectory. For example

    HOSTEXCLUDE mycomputer.myisp.com

would exclude all requests by that computer from the statistics. (To exclude lines just from one specific report, see below.)

The rule for determining whether an item is included or excluded is as follows. All the `INCLUDE` and `EXCLUDE` commands for that item are considered one by one in order, and the item is included or excluded according to the last command it matched. Items which don't match any of the `INCLUDE` or `EXCLUDE` commands are included if the first command was an exclusion, and excluded if the first command was an inclusion. For example, the configuration

    FILEINCLUDE /~sret1/*
    FILEEXCLUDE /~sret1/backgammon/*,/~sret1/analog/*
    FILEINCLUDE /~sret1/backgammon/*.gif

would instruct the program to examine only my files, excluding my backgammon and analog files, but including gifs in my backgammon directory. On the other hand,

    FILEEXCLUDE /~sret1/*/img/*

would analyse all files, except for images in my various directories. (If you get confused with all the inclusions and exclusions, remember that you can always use `SETTINGS ON` to see what the options you have specified represent.) Note that inclusions and exclusions can contain any number of wildcards, and can be lists separated by commas (but no spaces).

The full list of these commands is `HOSTINCLUDE` and `HOSTEXCLUDE`; `FILEINCLUDE` and `FILEEXCLUDE`; `BROWINCLUDE` and `BROWEXCLUDE`; `REFINCLUDE` and `REFEXCLUDE`; `USERINCLUDE` and `USEREXCLUDE`; `VHOSTINCLUDE` and `VHOSTEXCLUDE`; and `STATUSINCLUDE` and `STATUSEXCLUDE`.

Some notes on these commands.

Because the inclusions and exclusions take place after the aliasing, the name you must use is the aliased name. (In the absence of output alias commands, this is the name of the item in the output.)

Sometimes a line doesn't contain a particular sort of item, either because there is no field reserved for it on the line, or because the browser didn't send it for that request, or because it was present but corrupt. You can include or exclude these lines by making a special blank entry in the `INCLUDE` or `EXCLUDE` command. For example,

    USERINCLUDE jim
    USERINCLUDE ""

would include lines from user `jim` and lines without any user specified.

The behaviour of `REQINCLUDE` and `REFINCLUDE` can be slightly unintuitive if the file has search arguments.

You can also use regular expressions for the inclusions and exclusions by prefixing the expression with "`REGEXP:`" or "`REGEXPI:`". I've already described this at length in the context of aliases, so you can look there for all the details. A regular expression must be on a line on its own, not within a comma-separated list.

With `HOSTINCLUDE` and `HOSTEXCLUDE`, you have to use numerical addresses if your web server records numerical addresses in the logfile, or names if it records names (or if you're resolving the numerical addresses with analog's DNS resolution). For numerical addresses, you can use some special formats, like this:

    HOSTINCLUDE 131.111.20.18      # simple IP address
    HOSTINCLUDE 131.111.20.*       # wildcard
    HOSTINCLUDE 131.111.20         # the same meaning
    HOSTINCLUDE 131.111.20-23      # a range of class C addresses
    HOSTINCLUDE 131.111.20.18/23   # subnet mask

The `STATUSINCLUDE` and `STATUSEXCLUDE` commands are slightly different from the rest. They work on HTTP status codes. (These codes are defined in the HTTP spec, and viewable in the Status Code Report. But if you don't already know about them, you really don't want to use these commands anyway!) The arguments to the commands are a comma-separated list of ranges. One end of the range can be blank, meaning from the first, or to the last, status code. For example

    STATUSINCLUDE 200-206,304,500-

would mean only look at lines with status codes 200-206, 304 or 500-599.

Some people want to exclude status code 304 (Not Modified) to stop those requests appearing in the Request Report. But there is a better solution. By default, analog counts code 304 as a successful request, because it assumes that the cached version of the document is then presented to the user. But you can count it as a redirected request with the command

    304ISSUCCESS OFF

For most people this is the wrong option, because code 304 is really the same as code 200 to the user. So again, if you don't understand this, stick with the default.

There is also one other pair of commands which belongs in this category, namely the `FROM` and `TO` commands. These specify a time period to restrict the analysis to. The simplest usage of these commands is `FROM yyMMdd` or `FROM yyMMdd:hhmm`, where `yy` represents the last two digits of the year (analog assumes that the year is between 1970 and 2069), `MM` represents the month, `dd` is the date, `hh` the hour, and `mm` the minute. So, for example, to analyse only requests from 1st July 1999 to 1pm on 15th June 2000 I would use the configuration

    FROM 990701
    TO   000615:1300

Alternatively, each of the components can be preceded by `+` or `-` to represent time relative to the time at which the program was invoked. In this case, the date can have more than 2 digits. This allows constructions like

    FROM -01-00+01   # from tomorrow last year
    TO -00-0131  # to the end of last month (OK even if last month
                 # didn't have 31 days)
    FROM -00-00-112
    TO   -00-00-01  # statistics for the last 16 weeks
    FROM -00-00-00:-06+01  # statistics for the last 6 hours

There are command line abbreviations `+F` and `+T` for the `FROM` and `TO` commands; for example, `+T-00-00-01:1800` looks at statistics until 6pm yesterday. `-F` and `-T` turn off the from and to, as do `FROM OFF` and `TO OFF`.

There are also `INCLUDE` and `EXCLUDE` commands for most of the reports. Unlike the `INCLUDE` and `EXCLUDE` commands discussed above, these don't exclude logfile lines but individual lines from particular reports.

So, for example, the command

    REFREPEXCLUDE http://your.site.com/*

would exclude your internal referrers from the Referrer Report. However, it would not exclude them from the Failed Referrer Report, the Referring Site Report, etc. (you need to use `FAILREFEXCLUDE`, `REFSITEEXCLUDE` etc. for that); nor would it prevent other analysis of logfile lines with those referrers, as `REFEXCLUDE` would.

The full list of these commands is `REQINCLUDE` and `REQEXCLUDE`; `REDIRINCLUDE` and `REDIREXCLUDE`; `FAILINCLUDE` and `FAILEXCLUDE`; `TYPEINCLUDE` and `TYPEEXCLUDE`; `DIRINCLUDE` and `DIREXCLUDE`; `HOSTREPINCLUDE` and `HOSTREPEXCLUDE`; `REDIRHOSTINCLUDE` and `REDIRHOSTEXCLUDE`; `FAILHOSTINCLUDE` and `FAILHOSTEXCLUDE`; `DOMINCLUDE` and `DOMEXCLUDE`; `ORGINCLUDE` and `ORGEXCLUDE`; `REFREPINCLUDE` and `REFREPEXCLUDE`; `REFSITEINCLUDE` and `REFSITEEXCLUDE`; `SEARCHQUERYINCLUDE` and `SEARCHQUERYEXCLUDE`; `SEARCHWORDINCLUDE` and `SEARCHWORDEXCLUDE`; `INTSEARCHQUERYINCLUDE` and `INTSEARCHQUERYEXCLUDE`; `INTSEARCHWORDINCLUDE` and `INTSEARCHWORDEXCLUDE`; `REDIRREFINCLUDE` and `REDIRREFEXCLUDE`; `FAILREFINCLUDE` and `FAILREFEXCLUDE`; `BROWSUMINCLUDE` and `BROWSUMEXCLUDE`; `BROWREPINCLUDE` and `BROWREPEXCLUDE`; `OSINCLUDE` and `OSEXCLUDE`; `VHOSTREPINCLUDE` and `VHOSTREPEXCLUDE`; `REDIRVHOSTREPINCLUDE` and `REDIRVHOSTREPEXCLUDE`; `FAILVHOSTREPINCLUDE` and `FAILVHOSTREPEXCLUDE`; `USERREPINCLUDE` and `USERREPEXCLUDE`; `REDIRUSERREPINCLUDE` and `REDIRUSERREPEXCLUDE`; and `FAILUSERINCLUDE` and `FAILUSEREXCLUDE`.

The inclusion or exclusion applies to the unaliased name, if you are doing any output aliases. (This contrasts with the behaviour of normal `INCLUDE` and `EXCLUDE` commands, which apply to the aliased name.)

All directory names end in slashes, so `DIRINCLUDE` and `DIREXCLUDE`, and `REFSITEINCLUDE` and `REFSITEEXCLUDE`, implicitly add a trailing slash even if you don't give one. This sometimes catches people out in the following situation.

    REFSITEEXCLUDE http://my.host.com/*     # probably not what you want

means not to list subdirectories of the referring site `http://my.host.com/`, but to keep the site itself in the list. To exclude the site completely, just use

    REFSITEEXCLUDE http://my.host.com/

You can also use the symbolic word `pages` in suitable `INCLUDE` and `EXCLUDE` commands; one very common command is

    REQINCLUDE pages

to include only pages in the Request Report.

There are some miscellaneous `INCLUDE` and `EXCLUDE` commands which I'll describe now. First, analog determines which files should count as pages (and thus which requests count as page requests) using an `INCLUDE`/`EXCLUDE` pair called `PAGEINCLUDE` and `PAGEEXCLUDE`. By default, (case insensitive) `*.html` and `*.htm`, and directories (`*/`) count as pages. But you change the list by commands like

    PAGEINCLUDE *.asp
    PAGEEXCLUDE /sret1.html

I.e., `*.asp` are pages, but `/sret1.html` isn't. (If the file has search arguments, the `PAGEINCLUDE` and `PAGEEXCLUDE` are reckoned just on the part of the filename before the question mark.)

In some of the reports, analog can link to the files which it's listing. You can specify exactly which files are linked to with the `LINKINCLUDE` family of commands. For example,

    REQLINKINCLUDE pages,*.pdf

would link to pages and PDF files in the Request Report. The full set of these commands is `REQLINKINCLUDE` and `REQLINKEXCLUDE` (Request Report), `REDIRLINKINCLUDE` and `REDIRLINKEXCLUDE` (Redirection Report), `FAILLINKINCLUDE` and `FAILLINKEXCLUDE` (Failure Report), `REFLINKINCLUDE` and `REFLINKEXCLUDE` (Referrer Report), `REDIRREFLINKINCLUDE` and `REDIRREFLINKEXCLUDE` (Redirected Referrer Report), and `FAILREFLINKINCLUDE` and `FAILREFLINKEXCLUDE` (Failed Referrer Report). Note that the target of the links is also affected by the `BASEURL` command.

Finally, there is a pair of commands called `ROBOTINCLUDE` and `ROBOTEXCLUDE`, which determine which browsers count as "robots" in the Operating System Report. For example,

    ROBOTINCLUDE Googlebot/*

There is one final set of `INCLUDE` and `EXCLUDE` commands to include or exclude the search arguments at the end of URLs. But there are some slightly complicated issues surrounding those, so they deserve a new section.

Go to the analog home page.

Need help with analog? Use the analog-help mailing list.

[ Top | Up | Prev | Next | Map | Index ]