Do you have 13,000 IP numbers in Excel or 13,000 resolved IP addresses? Which do you have in analog? You could have a bunch of IP numbers in Excel that resolve to a much small number of IP addresses.
Also, what time frame is covered in your logfile and what time frame is covered by your analysis. If your logfile is for a year, and you analyze for a day or a week, the number of distinct hosts served for a day or a week is likely to be less than the total number of hosts contained in the log file.
Maybe you have a HOSTINCLUDE or HOSTEXCLUDE command somewhere that effects your results.
HTH,
-- Duke
John G Doke wrote:
I am having a hard time getting a handle on Hosts..
I took a part of a log file and imported it in to Excel and sorted the IP address's and got 13000+ different IP address's. When I analyzed the file I cannot get over 111 Distinct hosts... the other entries look approximately correct...
Successful requests: 6,724 Successful requests for pages: 4,233 Failed requests: 5,178 Redirected requests: 16 Distinct files requested: 4,893 Distinct hosts served: 111 Unwanted logfile entries: 3,081 Data transferred: 1.02 gigabytes
This snippet, if analyzed should have 6 hosts... All requests are for html files so should be counted...
217.42.138.136 - - [01/Mar/2004:01:00:27 -0600] "GET /raised/ HTTP/1.1" 200 10997 "http://www.myweb.com/index.html"; "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
130.151.45.32 - - [01/Mar/2004:01:00:27 -0600] "GET /support/index.html HTTP/1.0" 200 5431 "-" "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0; RA; .NET CLR 1.0.3705)"
217.42.138.136 - - [01/Mar/2004:01:00:27 -0600] "GET /logic/order.html HTTP/1.1" 200 24904 "http://www.myweb.com/index2.html"; "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
219.166.138.158 - - [01/Mar/2004:01:00:27 -0600] "GET /manuals/1756653.html HTTP/1.1" - 17844 "http://www.myweb.com/manuals/"; "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)"
203.129.207.162 - - [01/Mar/2004:01:00:27 -0600] "GET /catalogs/index.html HTTP/1.0" 200 1125 "http://www.myweb.com/catalogs/dnet.html"; "Mozilla/4.0 (compatible; MSIE 5.01; Windows 98)"
62.190.106.161 - - [01/Mar/2004:01:00:27 -0600] "GET /logic/ HTTP/1.0" 200 13931 "http://www.google.com/search?q=rslogix+5000+demo&ie=UTF-8&oe=UTF-8&hl=nl&lr="; "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 4.0; Q312461; Holec Holland N.V.)"
194.151.13.146 - - [01/Mar/2004:01:00:28 -0600] "GET /industrial/pdf/idc.html HTTP/1.0" 200 32329 "-" "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0) Fetch API Request"
begin:vcard fn:Duke Hillard n:Hillard;Duke org:University of Louisiana at Lafayette;University Computing Support Services adr:;;P.O. Box 42770;Lafayette;LA;70504-2770;USA email;internet:[EMAIL PROTECTED] title:University Webmaster tel;work:337.482.5763 url:http://www.louisiana.edu/ version:2.1 end:vcard
