This section lists those commands which existed in older versions of analog,
but which have been changed or abolished in this version. It also lists reasons
why the same input might now produce different output. The new features in this
version are listed in the section What's new in
If you are upgrading from a previous version of analog, you should keep your
old analog.cfg, and your old anlghead.h if you are
compiling your own copy of analog rather than using one of the precompiled
The code to generate the Browser Summary has been completely rewritten.
Apart from now recognising Konqueror and Galeon, and distinguishing
Mozilla and Netscape, this may result in other small changes to the
reported numbers. Also, if you are using a configuration file from an
earlier version, remove the line that reads
BROWOUTPUTALIAS Mozilla Netscape
Similarly, the code to generate the Operating System Report has been
slightly modified, in addition to recognising Windows XP.
Numerical addresses are now included in the Organisation Report, which
will change that report.
Some warnings have moved from category C
to category F or to the new category G.
Previously, when an output
INCLUDE or EXCLUDE command was in operation,
the excluded items were still included in the "not listed"
line at the bottom of the report. This is no longer the case.
Also, percentages of the requests and bytes are now calculated
ignoring the excluded items, which will make those numbers
larger, make their wedges in the pie charts larger, and change what is
included by floors specified in terms of
There are some new files (with names beginning with sq) in
the images/ directory. These will need to be copied into your
*.asp is no longer included in the
default definition of "pages" (which
it was from 4.11 to 4.90beta1) because there are too many other equally
well qualified candidates. But you can easily re-enable it in
Some languages have still not been translated for version 5 yet:
see the list of available languages in the
What's new? section.
All files are now looked for in sensible directories, specified at
compile time, if no other directory is specified. On platforms where
these directories are not known at compile time, analog formerly looked
in the current working directory, but now looks in (its guess at) the
directory of the analog binary. However, filenames specified in command
line arguments are within the current working directory since version
The cache file now includes data on the first-request time of each
item. But if you read a cache file from an older version of analog, this
data will not have been recorded, and so the last-request time will be
used instead. Analog will warn you about this.
If you specify a CACHEFILE command but no LOGFILE
command, analog won't read the default (compile-time) logfile. This is
much more intuitive behaviour, but some users may have been relying on
the old behaviour. The actual rule is given in the documentation on
Some browsers will be rediagnosed as robots in the Operating System
Report. This will mainly reduce the "OS unknown" total, but
may also reduce other categories.
US English now uses the 12-hour clock by default. If you
want to continue to use the 24-hour clock, use the language file
us24.lng instead. (Either use a
LANGFILE command, or
rename us24.lng to us.lng). Conversely, you can
get British English with the 12-hour clock by using uk12.lng.
Because of the twelve new reports, if you use a
you should include the corresponding new
The date codes in the
OUTFILE and CACHEOUTFILE commands now always
produce dates in English.
The REFLINKINCLUDE command now only controls links in the
Referrer Report. Use REDIRREFLINKINCLUDE and
FAILREFLINKINCLUDE for the Redirected and Failed Referrer
When doing a negative floor, items are
no longer included if they have 0 of the criterion in question, even if
there aren't enough items otherwise. For example FLOOR -25p
will list fewer than 25 items if there aren't 25 items with requests for
pages, even if there are other items with 0 requests for pages.
When a logfile line contains bytes but no filename, analog previously
ignored the bytes. It now counts them for other items on the line, but
doesn't put them in the File Size Report or General Summary (to avoid
There are no longer any HTML language files containing HTML entities. So,
for example, the HTML output will always contain a literal é
instead of the code é. This should make no
difference to the reader, but please do tell me about any problems.
The source files have moved to the src/ directory. And there
are new source files in subdirectories of the src/ directory.
Also the header files have different variables in them. This means that
automatic build scripts will have to be rewritten.
There is better parsing of extended format and WebSTAR format logs,
which may cause differences in some cases.
All referrers now count as "pages" irrespective of
any PAGEINCLUDE and PAGEEXCLUDE commands.
Consequently, for example,
"REFLINKINCLUDE pages" is now the
same as "REFLINKINCLUDE *". You can recreate
the previous behaviour with
The default REPORTORDER has changed.
New anchor names are used internally to the output page.
It is now recommended that you don't run analog as a CGI program, or put
it in the directory with your CGI programs, for
Each browser in the Browser Summary is now sorted by major version
number then minor version number. So SUBBROW */* will now
only show the major versions. To get all the minor versions, you need
The form interface has been completely rewritten, and old versions of
anlgform.html will not work with this version.
The Browser Summary now diagnoses MSIE, Opera and WebTV browsers
better. This will cause differences in output from previous versions.
With RAWBYTES OFF, bytes are now listed as, for example,
47.68 Mbytes instead of 48,832 kbytes. This should be less confusing.
The DNS file has a new time encoding. It's only a
few hours different, so I haven't made any special provision for it. The
effect is that the DNSGOODHOURS and
DNSBADHOURS may be a few hours out
for existing entries (but not for new ones).
In the computer-readable output style, the
line L7, the time the last seven days begins after, has been
replaced by E7, the time the last seven days ends. This is
for consistency with the other output styles.
Also in the computer-readable output, there is a new line reporting the
floor and the SORTBY for the report. In 3.11 and earlier,
this didn't exist, and in 3.2 it only reported the floor, not the
%R (Mac-style filename) has been abolished in the
LOGFORMAT. Just use plain %r instead.
It is no longer allowed to set the CACHEOUTFILE to be the
same as a previous cache file.
The definition of the common log format and related formats changed
between 3.11 & 3.2, and again between 3.2 & 3.3. This could
cause differences in output, but they are likely to be only very minor.
Lines without a particular item now work properly with
INCLUDE and EXCLUDE commands. For example, if
you do an INCLUDE to look at only certain lines, then lines
without that type of item at all will not now be included, whereas
previously they would have been. This can make the results lower than in
these earlier versions.
I have reluctantly removed support for NetPresenz logs. This hasn't
worked for some time, and I have already been advising NetPresenz users
not to use newer versions of analog because they could get wrong
results. Unfortunately, fixing it would require a complete rewrite of
the entire parsing code, which isn't going to happen any time soon. So
my advice remains the same: continue to use version 2.11 or (even
better) pre-process your logfiles into a form which analog can handle
The English domains file has changed name from domains.tab
It is possible that there may be small discrepancies between the results
from previous versions and the results from this version because the
parsing code has changed, but any such differences should be minor.
If you used to use REFEXCLUDE or BROWEXCLUDE, you
most likely now want
instead, or you will exclude lots of lines that were previously included.
It is possible that this version may not automatically parse a logfile
that previous versions could parse, because it checks more carefully
that the logfile is in the format claimed. If so, you will have to use a
Approximate host counting has been abolished, unless there's a
significant demand for it.
Count of number of new hosts in last seven days abolished. It was too
confusing because it depended on which old logfiles you analysed.
The Error Report has been abolished (together with the configuration
commands ERROR, ERRLOG and ERRMINOCCS).
See the What's new? page.
The BROWLOG and REFLOG commands have also been
abolished: just use LOGFILE
The HASHSIZE commands have been abolished: analog now chooses
the size of the hash tables itself.
The MINREQS and similar options have been replaced by the
Only one * is now allowed on the left-hand side of aliases,
to avoid ambiguities.
Automatic detection of log type is now on a per-file rather than a
The UNIT commands have been abolished. They weren't very
useful, and they didn't make much sense with the different ways of
displaying the time report bar charts. The unit is now always chosen
DIRLEVEL has been abolished, because the
SUBDIR command is more general.
Use SUBDIR */* or whatever instead.
Comments aren't allowed in the domains file.
I don't think this should cause a problem.
GRAPHICAL is abolished. Instead, use lower case letters with
the GRAPH commands.
DNS cache files from previous versions are not compatible with this
You can't use PAGES in the columns or SORTBY or
FLOOR for the Request Report. Use REQINCLUDE pages
- as a synonym for none has been abolished in some
places, e.g., HOSTURL.
The following command line arguments have been abolished from earlier
versions, many of the letters getting new meanings: 7,
l, n, p, s, u,
v, w. (-v has moved to
-settings.) Others have been changed since version 1.2 as