This section lists all the errors and warnings which analog can produce,
together with a short explanation.
First, you should understand the difference between a crash, an error, a
warning, and a debugging message. First, a crash is when analog exits
prematurely, without producing the whole output file. The system might give a
message, but analog will not give one of its own messages. Analog should never
crash. If it does crash, please tell me about it.
An error is something which stops analog finishing its job. Whenever
an error is detected, analog gives a message starting something like
analog: Fatal error: and will then tell you what type of thing went
wrong before quitting.
A warning is a problem which is not fatal to analog: it will keep on
with its processing. These vary from the possibly serious, such as files which
could not be found, to purely informational. They produce a message starting
analog: Warning. You can turn warnings off using the
Finally, a debugging message gives information on the state of the
program. They just begin with a single code letter followed by a colon. You
don't get any debugging messages unless you've
asked for them.
If you want to send these messages to a file instead of to the screen, you can
use the ERRFILE command.
To tell analog the width of your screen for these messages, you can use the
Remember that warnings are not fatal: in fact some are rarely even serious.
You can turn them off using the
WARNINGS command. The possible
warnings come in several different categories, shown by a letter in the warning
message. The categories are as follows.
This category indicates an incorrect configuration. Analog will either ignore
what you said, or try and do the best it can with it. There are too many
warnings in this category to list completely. You will have to consult the
documentation for the particular configuration
command that gave an error. If you get an error for a command which used
to work in a previous version of analog, have a look in the section
Updating from older versions.
This is for configurations which might be intended, but which look suspicious.
Analog will not override what you've specified in this case.
LOGFORMAT with no subsequent logfile
You have specified a LOGFORMAT command, but no
subsequent logfile to which it could be applied. Most likely
you put the LOGFORMAT after the LOGFILE command.
You must put the LOGFORMAT before the LOGFILE
command or use DEFAULTLOGFORMAT instead. See the section on
Specifying a log format for
Offset not a multiple of 30
Offset more than 25 hours
The time offsets are meant to be for
correcting between differences in time zones. These differences are
usually multiples of 30 minutes between -25 and +25 hours. Maybe you
specified the offset in hours instead of minutes by mistake, or
something like that.
FROM time is later than the present
Usually this will mean that no entries are counted. Analog doesn't
try and correct it in case the clock on your computer or your server is
wrong -- but you would be better using
LOGTIMEOFFSET to correct
SORTBY doesn't match FLOOR SORTBY doesn't match SUBSORTBY
SORTBY (or FLOOR or GRAPH) isn't
included in COLS
Within one report, it's helpful to your readers to have the sort methods
and the floors compatible, and all included in the COLS.
(See the section on Non-time
Column N with SORTBY ALPHABETICAL/RANDOM
Numbering off the items when they're not in order of busyness is
probably a mistake.
Time reports have not all got same value of BACK
It's usually helpful to have all the time
reports running in the same direction.
Report contains no COLS
You've got an empty COLS list for one report, so you'll just
get a list of names, not any information about them.
LOWMEM 3 prevents that item being cached
You're making a cache file, but one item is
not being recorded because of a
LOWMEM command, and will therefore
not be saved in the cache file.
This category is for diagnosing files which couldn't be opened or read
successfully. These can be serious, but most of the messages should be
self-explanatory. There are a few worth mentioning specifically.
Can't auto-detect format of logfile
The LOGFORMAT is set to automatic
detection, but the first line of the logfile is not in any of the
standard formats. This error can often be generated when you try and
specify your own LOGFORMAT but put it after the
LOGFILE command so that it is not in effect for that logfile.
Logfile with ambiguous dates
Some servers, notably IIS and WebSite, record dates in their logfiles
according to local conventions. Then if analog encounters 2/1/99, for
example, it doesn't know whether it's the 2nd January or 1st February.
This problem, and what to do about it, is described in more detail in the
Choosing a logfile.
Logfile seems to be in Microsoft format
The most common cause of this message is that your IIS logfile uses local
conventions for listing dates which analog doesn't know about -- e.g.
25.12.98 instead of 25/12/98. Again, see the section on
Choosing a logfile for help.
Ignoring corrupt format line in logfile
The format line within a W3 extended log, Netscape log or WebSTAR log is
invalid in some way. Analog will always tell you what's wrong with it. The
most common problem is that the date only appears at the top of the
logfile, not on every line, which is not allowed. The reason for this, and
what to do about it, are in the section on
Choosing a logfile.
Failed to open domains file
In this case, all domains will be counted as "unknown domains".
Failed to open DNS input file
The first time you use DNS lookups, you don't have a DNS cache file, so
you get this warning. Assuming you are using DNS WRITE, the
message will go away next time you run analog.
DNS lock file already exists
To stop two copies of analog trying to write the DNS file at the same
time, an empty "lock file" is created, which tells the second
copy of analog to use DNS LOOKUP instead of DNS
WRITE. If analog crashes, it may not delete its lock file. So if you
get the "already exists" message even though no other copy of
analog is running, you may need to delete the lock file yourself.
When analog finishes reading a logfile, it checks whether there might have
been something wrong with it.
Large number of corrupt lines
This could indicate a problem with the logfile, or with the
The possible causes are described in the section on
Choosing a logfile.
If you specify DEBUG ON,
analog will report where each line was corrupt.
Logfiles overlap: possible double counting
This means that two logfiles which were counting the same type of item
overlapped in time. Because it's only based on the time period of the
logfiles, not the actual entries, this may or may not indicate a genuine
problem. It is a problem if you read the same logfile twice. Or maybe
you used the cache file feature
Or maybe your web server produces several logfiles, and your
should have told analog to ignore some of the items in some of the
logfiles. It is not a problem if the logfiles are in fact completely
disjoint; for example if you analyse logfiles from two different virtual
hosts. In this case, the statistics produced will still be correct.
This category is for warnings about logfile formats which might make analog
produce unexpected results.
Logfile contains lines with no [whatevers], which are being
This is usually harmless. It is perhaps best explained by
example. Suppose you are excluding certain
files from the analysis, but that you are also analysing a browser log
which just contains information about the browsers used, not which files
they read. Then we can't exclude the browsers which read the excluded
files, because we don't know which they were, so all browsers will be
Logfile contains lines with no file names (or bytes): page (or byte)
counts may be low
If a logfile line doesn't contain a file name, analog will assume that
the request wasn't for a page. Similarly, if it doesn't give the number
of bytes transferred, analog will make the bytes zero. So the number of
page requests or bytes credited to the other items on that line will
then be too low.
Old-style cache file doesn't contain data on first-request times of
items; so these may be overestimated
Cache files now contain the first-request time of each item. But if you
read a cache file from an older version of analog, this data will not
have been recorded, and so the last-request time will be used instead.
This is used when analog turns off an empty report. This could be because none
of the relevant items were included in any of the logfiles, or perhaps
beacause a LOWMEM command stopped them
being recorded. It is also used when analog turns off a pie chart which would
have contained only one wedge.
This warning is not generated by analog, but it can occur when analog decides
that it doesn't need a logfile which it's uncompressing, and so doesn't finish
reading it. It's harmless.
Go to the analog home page.