Missing protocol in access logs

Question

Hello.
I'm running iPlanet 4.1 on an HP UX box.
My site in configured to use a WebLogic proxy plugin for JSPs..
The problem I'm having right now is that iPlanet seems to have trouble writting my access logs.
My current log format is:
"%Ses->client.ip% - %Req->vars.auth-user% [%SYSDATE%] \"%Req->reqpb.clf-request%\" %Req->srvhdrs.clf-status% %Req->srvhdrs.content-length% \"%Req->headers.referer%\"
Sometimes, it logs the HTTP protocol (with %Req->reqpb.clf-request%), sometimes it just ommits it!
(the server is used ONLY with the WL proxy right now, and I haven't found anything on WebLogic's side!)
This causes me problems when I try to compile statisttics for the site. Each line with NO PROTOCOL, seems to be like a corrupted line for the analyser, therfor makes my stats invalid! This is true with Analog and Awstats!
Here's an example of request WITHOUT the protocol:
64.230.121.24 - - [29/Jun/2003:00:00:12 -0400] "GET /psr/applicant/applicant.LoginMenu;PsrSessionID=22jy9aECcAhKZN61qH10RjccuUKg!-604367722!natux33!8010!-1?action=AcademicQualifications" 302 - "http://psjobs-emploisfp.psc-cfp.gc.ca/psr/applicant/applicant.LoginMenu;PsrSessionID=22jy9aECcAhKZN61qH10RjccuUKg!-604367722!natux33!8010!-1"
Has anyone else had this problem or a similar one?
Any help is greatly appreciated!
Patrick.

Answer 1

The only other way I found would be to use :
%Req->reqpb.method% %Req->reqpb.uri% instead of %Req->reqpb.clf-request%, that way the protocol just wouldn't be logged! My log analyser (Awstats 5.6) would then be able to crunch them by NOT checking for a protocol with the %methodurlnoproto parameter in awstats.
This is causing me yet another problem. With only the URI, I don't have the querystring. Of course, it is possible to use %Req->reqpb.query%, but this isn't linked to the URI in the log. I need to hardcode a '?' between the two. Therefor, I would also get requests such as '/foo.htm?' logged.
Another problem I seem to be having when using just the URI is that iPlanet seems to get only the first 128 caracteres from the request. After that numbers, it cuts off the URI.
I'm a bit confused here on what's the best solution...
Pat.