[ Top | Up |
Prev | Next |
Map | Index ]
Upgrading from earlier versions
This section lists those commands which existed in older versions of analog,
but which have been changed or abolished in this version. It also lists reasons
why the same input might now produce different output. The new features in this
version are listed in the section What's new in
If you are upgrading from a previous version of analog, you should keep your
old analog.cfg, and your old anlghead.h if you are
compiling your own copy of analog rather than using one of the precompiled
- There will be small changes to the browser and operating system reports
thanks to better parsing of recent Netscape and Mozilla browsers.
- In version 5.23 and earlier, earlier UNCOMPRESS commands took
precedence over later ones. This has been corrected in 5.24.
- As a side-effect of the security fix in version 5.22, the
JAPANESE-JIS character set no longer works from the form
- The language files have all changed, so don't try and use the old ones.
- The rules for generating "organisations" from numerical
addresses have changed, which will change the Organisation Report.
- Filenames given on the command line, as opposed to in configuration
commands, are now relative to the current directory, not the analog
directory. This will probably only affect Unix users.
- The order of the lines in the report descriptions files has changed, so
don't try to use the old versions.
- LANGUAGE JAPANESE now selects the JIS character set instead
of EUC. (Four Japanese character sets can be chosen explicitly through
the LANGUAGE command.)
- The language files have all changed, so don't try and use the old ones.
- Organisations in Belgium are now considered to be at depth 3, which will
change the Organisation Report.
- There are some new images in the images/ directory, which you
will have to copy into your IMAGEDIR if you want to use the
new PNGIMAGES command.
- LOCALCHARTDIR and DESCFILE can no longer be
specified from the form interface, for
- Previously, when an output
INCLUDE or EXCLUDE command was in operation,
the excluded items were still included in the "not listed"
line at the bottom of the report. This is no longer the case.
Also, percentages of the requests and bytes are now calculated
ignoring the excluded items, which will make those numbers
larger, make their wedges in the pie charts larger, and change what is
included by floors specified in terms of
- The Operating System Report, Browser Report & Browser Summary are now
sorted by page requests instead of raw requests by default.
- There are some new files (with names beginning with sq) in
the images/ directory. These will need to be copied into your
- *.asp is no longer included in the
default definition of "pages" (which
it was from 4.11 to 4.90beta1) because there are too many other equally
well qualified candidates. But you can easily re-enable it in
- The format of the "busiest time" and floor/sortby lines has
changed in the computer-readable output.
- The default DNSGOODHOURS and
DNSBADHOURS have been increased. In particular, the
default DNSGOODHOURS is now as near infinity as makes no
- Some languages have still not been translated for version 5 yet:
see the list of available languages in the
What's new? section.
- All files are now looked for in sensible directories, specified at
compile time, if no other directory is specified. On platforms where
these directories are not known at compile time, analog formerly looked
in the current working directory, but now looks in (its guess at) the
directory of the analog binary. However, filenames specified in command
line arguments are within the current working directory since version
- The cache file now includes data on the first-request time of each
item. But if you read a cache file from an older version of analog, this
data will not have been recorded, and so the last-request time will be
used instead. Analog will warn you about this.
- If you specify a CACHEFILE command but no LOGFILE
command, analog won't read the default (compile-time) logfile. This is
much more intuitive behaviour, but some users may have been relying on
the old behaviour. The actual rule is given in the documentation on
- Some browsers will be rediagnosed as robots in the Operating System
Report. This will mainly reduce the "OS unknown" total, but
may also reduce other categories.
- US English now uses the 12-hour clock by default. If you
want to continue to use the 24-hour clock, use the language file
us24.lng instead. (Either use a
LANGFILE command, or
rename us24.lng to us.lng). Conversely, you can
get British English with the 12-hour clock by using uk12.lng.
- Because of the twelve new reports, if you use a
you should include the corresponding new
- Computer readable output now has an extra
line reporting the busiest time period for the time reports.
- The date codes in the
OUTFILE and CACHEOUTFILE commands now always
produce dates in English.
- The REFLINKINCLUDE command now only controls links in the
Referrer Report. Use REDIRREFLINKINCLUDE and
FAILREFLINKINCLUDE for the Redirected and Failed Referrer
- When doing a negative floor, items are
no longer included if they have 0 of the criterion in question, even if
there aren't enough items otherwise. For example FLOOR -25p
will list fewer than 25 items if there aren't 25 items with requests for
pages, even if there are other items with 0 requests for pages.
- When a logfile line contains bytes but no filename, analog previously
ignored the bytes. It now counts them for other items on the line, but
doesn't put them in the File Size Report or General Summary (to avoid
- There are no longer any HTML language files containing HTML entities. So,
for example, the HTML output will always contain a literal é
instead of the code é. This should make no
difference to the reader, but please do tell me about any problems.
- The source files have moved to the src/ directory. And there
are new source files in subdirectories of the src/ directory.
Also the header files have different variables in them. This means that
automatic build scripts will have to be rewritten.
- Regular expressions in an INCLUDE or EXCLUDE
command must now occur on a line on their own, not within a
- The search terms reported in the Search Word and Search Query Reports
are no longer converted to lower case if you are using a multibyte
- Unprintable characters in the output are now replaced by '?', except for
multibyte character sets.
- *INCLUDE "" and *EXCLUDE "" (see
documentation) now apply to items
which were present but corrupt. This may have the effect of including or
excluding some new lines.
- There has been a tiny change in computer-readable
output style. Previously if a time was blank, it took up only one
column. Now it takes up as many columns as if it had been present.
- There is better parsing of extended format and WebSTAR format logs,
which may cause differences in some cases.
- All referrers now count as "pages" irrespective of
any PAGEINCLUDE and PAGEEXCLUDE commands.
Consequently, for example,
"REFLINKINCLUDE pages" is now the
same as "REFLINKINCLUDE *". You can recreate
the previous behaviour with
- The default REPORTORDER has changed.
- New anchor names are used internally to the output page.
- There may be slight differences in the results in this version owing to
stripping anchors off filenames.
- Some of the default paths have changed in anlghead.h.
- It is now recommended that you don't run analog as a CGI program, or put
it in the directory with your CGI programs, for
- Each browser in the Browser Summary is now sorted by major version
number then minor version number. So SUBBROW */* will now
only show the major versions. To get all the minor versions, you need
- PAGEWIDTH has been replaced by
- PRINTVARS has been renamed
- The form interface has been completely rewritten, and old versions of
anlgform.html will not work with this version.
- The Browser Summary now diagnoses MSIE, Opera and WebTV browsers
better. This will cause differences in output from previous versions.
- With RAWBYTES OFF, bytes are now listed as, for example,
47.68 Mbytes instead of 48,832 kbytes. This should be less confusing.
- The DNS file has a new time encoding. It's only a
few hours different, so I haven't made any special provision for it. The
effect is that the DNSGOODHOURS and
DNSBADHOURS may be a few hours out
for existing entries (but not for new ones).
- There is a new set of graphics in the images directory, which
you will have to move to your web directory.
- In the Mac version, if a configuration file is dragged onto the analog
icon, it is used instead of, not as well as, the default configuration
- In the computer-readable output style, the
line L7, the time the last seven days begins after, has been
replaced by E7, the time the last seven days ends. This is
for consistency with the other output styles.
- Also in the computer-readable output, there is a new line reporting the
floor and the SORTBY for the report. In 3.11 and earlier,
this didn't exist, and in 3.2 it only reported the floor, not the
- %R (Mac-style filename) has been abolished in the
LOGFORMAT. Just use plain %r instead.
- It is no longer allowed to set the CACHEOUTFILE to be the
same as a previous cache file.
- The definition of the common log format and related formats changed
between 3.11 & 3.2, and again between 3.2 & 3.3. This could
cause differences in output, but they are likely to be only very minor.
- Lines without a particular item now work properly with
INCLUDE and EXCLUDE commands. For example, if
you do an INCLUDE to look at only certain lines, then lines
without that type of item at all will not now be included, whereas
previously they would have been. This can make the results lower than in
these earlier versions.
- I have reluctantly removed support for NetPresenz logs. This hasn't
worked for some time, and I have already been advising NetPresenz users
not to use newer versions of analog because they could get wrong
results. Unfortunately, fixing it would require a complete rewrite of
the entire parsing code, which isn't going to happen any time soon. So
my advice remains the same: continue to use version 2.11 or (even
better) pre-process your logfiles into a form which analog can handle
- The English domains file has changed name from domains.tab
- If using the form interface on Windows, it is now necessary to put the
analog executable at \analog\analog.exe instead of
- LOGFORMAT MICROSOFT has been replaced by
LOGFORMAT MICROSOFT-NA and LOGFORMAT MICROSOFT-INT;
and similarly for LOGFORMAT NETPRESENZ.
- It is possible that there may be small discrepancies between the results
from previous versions and the results from this version because the
parsing code has changed, but any such differences should be minor.
- If you used to use REFEXCLUDE or BROWEXCLUDE, you
most likely now want
instead, or you will exclude lots of lines that were previously included.
- It is possible that this version may not automatically parse a logfile
that previous versions could parse, because it checks more carefully
that the logfile is in the format claimed. If so, you will have to use a
- Approximate host counting has been abolished, unless there's a
significant demand for it.
- Count of number of new hosts in last seven days abolished. It was too
confusing because it depended on which old logfiles you analysed.
- The Error Report has been abolished (together with the configuration
commands ERROR, ERRLOG and ERRMINOCCS).
See the What's new? page.
- The BROWLOG and REFLOG commands have also been
abolished: just use LOGFILE
- The HASHSIZE commands have been abolished: analog now chooses
the size of the hash tables itself.
- The MINREQS and similar options have been replaced by the
- Only one * is now allowed on the left-hand side of aliases,
to avoid ambiguities.
- Automatic detection of log type is now on a per-file rather than a
- ISPAGE is now called
- WITHARGS and REFWITHARGS are now called
- MONTHLYBACK is now called MONTHBACK.
- FULLHOSTS is now just called HOST.
- LOGOURL is now called LOGO.
- The UNIT commands have been abolished. They weren't very
useful, and they didn't make much sense with the different ways of
displaying the time report bar charts. The unit is now always chosen
- DIRLEVEL has been abolished, because the
SUBDIR command is more general.
Use SUBDIR */* or whatever instead.
- Comments aren't allowed in the domains file.
I don't think this should cause a problem.
- GRAPHICAL is abolished. Instead, use lower case letters with
the GRAPH commands.
- NUMLOOKUP has been replaced by
DNS, and DNSFRESHHOURS
by the commands DNSGOODHOURS and
- DNS cache files from previous versions are not compatible with this
- You can't use PAGES in the columns or SORTBY or
FLOOR for the Request Report. Use REQINCLUDE pages
- - as a synonym for none has been abolished in some
places, e.g., HOSTURL.
- The following command line arguments have been abolished from earlier
versions, many of the letters getting new meanings: 7,
l, n, p, s, u,
v, w. (-v has moved to
-settings.) Others have been changed since version 1.2 as
- Filenames for logfiles etc. should now be given DOS-style, with
backslashes, rather than Unix-style with forward slashes.
- There is no longer an automatic progress report. Use the
- Use *INCLUDE and
*EXCLUDE instead of *ONLY and
- The syntax of the *FLOOR commands has changed.
- Use *SORTBY REQUESTS or BYTES instead of
*SORTBY BYREQUESTS or BYBYTES.
Go to the analog home page.
25 June 2002
Need help with analog? Use the analog-help
[ Top | Up |
Prev | Next |
Map | Index ]