5 Replies Latest reply on Jun 15, 2011 12:06 PM by eelsasser

    entries in multiple logfiles

      hi,

       

      there is something i don't understand in the loghandler.

      I've an access.log where anything is written to.

      Now i want a rule where a specific URL should be written to a specific logfile and not to the access.log.

      So i build a rule which contains the following and push it as the top log rule:

       

      Rule criteria:

      URL that matches *feeds.store.ovi.com*

       

      Action:

      stop rule set

       

      Events: 

      Set User-Defined.logLine cleanup 2 = DateTime.ToWebReporterString + " "" + Authentication.UserName + "" " + String.ReplaceIfEquals (IP.ToString (Client.IP), "", "-") + " " + String.ReplaceIfEquals (Number.ToString (Response.StatusCode), "", "-") + " "" + Request.Header.FirstLine + "" " + """ + List.OfCategory.ToString (URL.Categories) + "" "" + String.ReplaceIfEquals (URL.ReputationString, "", "-") + "" "" + MediaType.ToString (MediaType.FromHeader) + "" " + String.ReplaceIfEquals (Number.ToString (BytesToClient), "", "-") + " "" + Header.Request.Get ("User-Agent") + "" "" + List.OfString.ToString (Antimalware.VirusNames) + "" "" + Number.ToString (Block.ID) + """ 

       

      FileSystemLogging.WriteLogEntry (User-Defined.logLine cleanup 2)

       

       

      the user-defined.logLine cleanup 2 contains the name of the specific logfile (access-cleanup.log).

       

      Now the problem:

       

      with my browser i go to http://feeds.store.ovi.com to test it and the URL is rewritten by the webserver to http://web.feeds.store.ovi.com (should match by *feeds.store.ovi.com*, "edit criteria test" says it does)

      I get entries in the logfile access-cleanup.log, but after a few seconds there are entries in the access.log too.

      Access-cleanup contains feeds.store.ovi.com and web.feeds.store.ovi.com, access.log only contains web.feeds.store.ovi.com entries.

       

      Now the question:

       

      Where is my mistake?

       

       

      best regards

      Jens