How to read Access.log codes

[andyjohnson]

I am trying to learn how to read my Access.log.

I see things like "GET /md/ HTTP/1.1" 200 4572

What does the 200 mean? What does the 4572 mean?

Then I see "POST /md/FMPro HTTP/1.1" 0

Does the 0 tell me whether the post was successful or not?

Is there any way of knowing what was posted?

Has anyone tried using software to compile FM access logs? I searched and found out about "sawmill". Anyone used it? Is something else better for troubleshooting and monitoring for security reasons?

[Garry Claridge]

The "GET" and "POST" are http (Hypertext Transfer Protocol) operations commands. The "GET" is sent by a browser and a "POST" is sent by the server.

The "/md" is the Request-URI (Uniform Resource Identifier) This is like a URL.

The "200" is the http staus code of the operations result. "200" being "success".

The "0" after the "POST" operation is a Filemaker code for "success" (I think)

The "4572" after the "GET" operation has me stumped!

All the best.

Garry

[Will]

I recently decided to purchase Sawmill and it works with Filemaker logs. I also tried 123Loganalyzer and Faststats by Mach 5 - all three have trial versions. At the high end range there is Webtrends by NetIQ but the price could be prohibitve. All of them seem to have a feature or two I liked that is missing on the respective others. I ultimately chose Sawmill due to price and the fact that it serves up the statisitics via a webpage.

As for the 4-digit number at the end of each FileMaker log entry, could it be the port number???

Will

[jamesducker]

Possibly, just possibly, the 4572 refers to the number of bytes that were transferred in the "GET" operation.

Have a look through the rest of the log - if, on various different "GET" operations, this number is always exactly 4572 then I'm probably wrong ... otherwise try doing something that involves a larger/smaller amount of data (eg in a DB of postal addresses, "GET" a record with a very long address) and see if the number in the log rises and falls accordingly.

Let us know!

James

[Anatoli]

RE: The "GET" and "POST" are http (Hypertext Transfer Protocol) operations commands. The "GET" is sent by a browser and a "POST" is sent by the server.

I don't think so. Both are from submit operations from browser. The difference is that GET is sending data as part of URL and it is limited in length.

POST is send within the HTTP protocol -- hidden and if there is length limit I didn't found it yet.

[Garry Claridge]

The "Post" and "Get" here are http "methods" which are slightly different to the Form methods (even though related). It can be confusing!

Garry

[Anatoli]

Form can be only GET or POST. You are still confusing me, but that's OK

[andyjohnson]

Thanks for the replies.

I'm surprised that there doesn't seem to be a standard reference on this. It would have only taken a page or two in the Filemaker manual. Back in January I searched for a web page and found nothing.

I found out that the numbers (such as 4572 above) are always different. They might be data size or they might be clock cycles to complete an operation, for all I know. Or a checksum?

I was hoping to glean useful information about:

1) If I can ever tell whether someone is trying to do something bad to the server

and

2) what's going on right before it crashes.

But I've decided my problems are more likely related to something wrong in one or more databases. When I close them FM is happy for weeks at a time. So I'm back to scrutinizing relationships and calculations, etc.

If anyone ever finds a reasonble guide to FM logs, I'd appreciate hearing about it.

[andyjohnson]

PS.

I'd like to get Sawmill, but first I have to get a new computer.