Binary Log Format
The Binary Log Format (BLF) is very similar to the NCSA Common Log Format, except that it is more streamlined and generates smaller log files.
In order to read the BLF log files and process them with log analysis tools, there is a supplied program called blf2clf which will convert from BLF to CLF format. The blf2clf program can be found in the $ZEUSHOME/web/bin directory.
blf2clf takes an optional argument, '-d' and an optional filename. If '-d' is specified, then blf2clf will not perform DNS lookups of the client IP addresses; if the filename is not specified, blf2clf will read from stdin.
Examples :
$ blf2clf /tmp/log.20000801 phaedra.cam.zeus.com - - [01/Aug/2000:14:00:28 +0100] "GET / HTTP/1.0" 200 4790 phaedra.cam.zeus.com - - [01/Aug/2000:14:00:28 +0100] "GET /images/google.gif HTTP/1.0" 200 4047 phaedra.cam.zeus.com - - [01/Aug/2000:14:00:28 +0100] "GET /images/zeus.gif HTTP/1.0" 200 1804 phaedra.cam.zeus.com - - [01/Aug/2000:14:00:28 +0100] "GET /images/altavista.gif HTTP/1.0" 200 992 phaedra.cam.zeus.com - - [01/Aug/2000:14:00:28 +0100] "GET /images/tux.gif HTTP/1.0" 200 6058 phaedra.cam.zeus.com - - [01/Aug/2000:14:00:28 +0100] "GET /images/yahoo.gif HTTP/1.0" 200 655 $ blf2clf -d /tmp/log.20000801 10.100.1.122 - - [01/Aug/2000:14:00:28 +0100] "GET / HTTP/1.0" 200 4790 10.100.1.122 - - [01/Aug/2000:14:00:28 +0100] "GET /images/google.gif HTTP/1.0" 200 4047 10.100.1.122 - - [01/Aug/2000:14:00:28 +0100] "GET /images/zeus.gif HTTP/1.0" 200 1804 10.100.1.122 - - [01/Aug/2000:14:00:28 +0100] "GET /images/altavista.gif HTTP/1.0" 200 992 10.100.1.122 - - [01/Aug/2000:14:00:28 +0100] "GET /images/tux.gif HTTP/1.0" 200 6058 10.100.1.122 - - [01/Aug/2000:14:00:28 +0100] "GET /images/yahoo.gif HTTP/1.0" 200 655 $ tail -f /tmp/log.20000801 | blf2clf phaedra.cam.zeus.com - - [01/Aug/2000:14:00:28 +0100] "GET / HTTP/1.0" 200 4790 phaedra.cam.zeus.com - - [01/Aug/2000:14:00:28 +0100] "GET /images/google.gif HTTP/1.0" 200 4047 phaedra.cam.zeus.com - - [01/Aug/2000:14:00:28 +0100] "GET /images/zeus.gif HTTP/1.0" 200 1804 phaedra.cam.zeus.com - - [01/Aug/2000:14:00:28 +0100] "GET /images/altavista.gif HTTP/1.0" 200 992 phaedra.cam.zeus.com - - [01/Aug/2000:14:00:28 +0100] "GET /images/tux.gif HTTP/1.0" 200 6058 phaedra.cam.zeus.com - - [01/Aug/2000:14:00:28 +0100] "GET /images/yahoo.gif HTTP/1.0" 200 655Defining BLF in the logging module
The definition of BLF in the logging module is as follows :%BEquivalent format string
The output from blf2clf is equivalent to the following format string :%h %l - %t "%r" %s %b