[Support] Analog und cronjob-Emails mit Warnungen

[Christian Glass]

Habe bei mir Analog konfiguriert und bekomme seit Monaten Emails vom 
cronjob, die sich immer wieder um eine Warnung verlängern:


------------------ schanipp ------------------
Subject: Cron <xyz00-abc at pomo> /usr/bin/analog -G +g./analog_example.cfg

/usr/bin/analog: analog version 5.32/Unix
/usr/bin/analog: Warning L: logfiles
  
/home/pacs/xyz00/users/abc/doms/example.org/var/web-example.org-20050712-0004.log.gz
  and
  
/home/pacs/xyz00/users/abc/doms/example.org/var/web-httpwww.example.org-20050712-0004.log.gz
  overlap: possible double counting
/usr/bin/analog: Warning L: logfiles
  
/home/pacs/xyz00/users/abc/doms/example.org/var/web-example.org-20051007-0003.log.gz
  and
  
/home/pacs/xyz00/users/abc/doms/example.org/var/web-httpwww.example.org-20051007-0003.log.gz
  overlap: possible double counting
/usr/bin/analog: Warning F: Can't auto-detect format of logfile
  
/home/pacs/xyz00/users/abc/doms/example.org/var/web-lsoecvalaapf.example.org-20060714-0005.log.gz:
  ignoring it
/usr/bin/analog: Warning L: logfiles
  
/home/pacs/xyz00/users/abc/doms/example.org/var/web-example.org-20060530-0004.log.gz
  and
  
/home/pacs/xyz00/users/abc/doms/example.org/var/web-wew.example.org-20060530-0004.log.gz
  overlap: possible double counting
/usr/bin/analog: Warning L: logfiles
  
/home/pacs/xyz00/users/abc/doms/example.org/var/web-example.org-20050303-0003.log.gz
  and
  
/home/pacs/xyz00/users/abc/doms/example.org/var/web-ww.example.org-20050303-0003.log.gz
  overlap: possible double counting
/usr/bin/analog: Warning L: logfiles
  
/home/pacs/xyz00/users/abc/doms/example.org/var/web-example.org-20050304-0003.log.gz
  and
  
/home/pacs/xyz00/users/abc/doms/example.org/var/web-ww.example.org-20050304-0003.log.gz
  overlap: possible double counting
/usr/bin/analog: Warning L: logfiles
  
/home/pacs/xyz00/users/abc/doms/example.org/var/web-example.org-20050324-0003.log.gz
  and
  
/home/pacs/xyz00/users/abc/doms/example.org/var/web-ww.example.org-20050324-0003.log.gz
  overlap: possible double counting
/usr/bin/analog: Warning L: logfiles
  
/home/pacs/xyz00/users/abc/doms/example.org/var/web-example.org-20050503-0004.log.gz
  and
  
/home/pacs/xyz00/users/abc/doms/example.org/var/web-ww.example.org-20050503-0004.log.gz
  overlap: possible double counting
/usr/bin/analog: Warning L: logfiles
  
/home/pacs/xyz00/users/abc/doms/example.org/var/web-example.org-20050714-0004.log.gz
  and
  
/home/pacs/xyz00/users/abc/doms/example.org/var/web-ww.example.org-20050714-0004.log.gz
  overlap: possible double counting

[...] und viele weitere dieser Warnung L "overlap"

------------------ schanipp ------------------

aus der DOKU:
"Logfiles overlap: possible double counting
This means that two logfiles which were counting the same type of item
overlapped in time. Because it's only based on the time period of the
logfiles, not the actual entries, this may or may not indicate a genuine
problem. It is a problem if you read the same logfile twice. Or maybe
you used the cache file feature incorrectly.
Or maybe your web server produces several logfiles, and your
LOGFORMAT specification should have told analog to ignore some
of the items in some of the logfiles. It is not a problem if the 
logfiles are
in fact completely disjoint; for example if you analyse logfiles from two
different virtual hosts. In this case, the statistics produced will 
still be correct."


...ich vermute jetzt mal bei mir sind die logs wie geschrieben aus 
versch. "virtual hosts"
und daher ist die Statistik also noch korrekt?





Außerdem ist mir auch hier nicht klar woher die folgenden ungewöhnlichen 
Logfile-Namen kommen (s.o.):

web-httpwww.example.org-20050712-0004.log.gz
web-wew.example.org-20060530-0004.log.gz
web-lsoecvalaapf.example.org-20060714-0005.log.gz
web-ww.example.org-20050503-0004.log.gz


ich dachte web-Logfiles sind stets in dieser Form benannt:
web-www.example.org-JJJJMMTT-NNNN.log.gz
bzw.
web-example.org-JJJJMMTT-NNNN.log.gz


...warum liegen in /var eigentlich beide Versionen?
Ich glaube bei mir lasse ich beide anlegen...
Ist dies denn nötig um alle Zugriffe zu erfassen oder würde

web-example.org-JJJJMMTT-NNNN.log.gz

alleine auch reichen um die Aufrufe von www.example.org auch mitzuloggen?