Ok, the following is probably only useful to you if you're a real unix head, but eh, if you insist, there you go. Output looks like this: 03/May/2004:13:33:52: myblog NCbeatware | MSIE 5.2 1.1.4322 | from: - 03/May/2004:13:43:35: myblog NCsparks1 | MSIE 5.0 AT&T | from: gg 03/May/2004:14:03:05: myblog NCsjsu | MSIE 6.0 5.0) | from: - 03/May/2004:14:03:10: myblog NCsjsu | MSIE 6.0 5.0) | from: - 03/May/2004:14:03:16: myblog NCsjsu | MSIE 6.0 5.0) | from: - 03/May/2004:15:08:23: myblog NCsjsu | MSIE 6.0 5.0) | from: gg 03/May/2004:15:08:25: myblog NCsjsu | MSIE 6.0 5.0) | from: gg 03/May/2004:15:08:30: myblog NCsjsu | MSIE 6.0 5.0) | from: gg 03/May/2004:15:27:51: myblog NCsparks1 | MSIE 5.0 AT&T | from: gg 03/May/2004:15:28:02: myblog NCsparks1 | MSIE 5.0 AT&T | from: gg 03/May/2004:16:03:06: myblog NCsjsu | MSIE 6.0 5.0) | from: - 03/May/2004:16:18:07: myblog NCbeatware | MSIE 5.2 1.1.4322 | from: - 03/May/2004:17:34:22: myblog NCbeatware | MSIE 5.2 1.1.4322 | from: - 03/May/2004:18:36:04: myblog NCbeatware | MSIE 5.2 1.1.4322 | from: - 03/May/2004:19:06:44: myblog adsl-69-107-70-53.PB | MSIE 5.0 1.1.4322 | from: gg 03/May/2004:22:30:08: myblog xav | MSIE 5.1 1.1.4322/1.0.3705 | from: - The way it works is as follows: magic:~# cat /etc/cron.d/apachelogs */5 * * * * root grep "`date "+\%d/\%b/\%Y:\%H"`:[0-9][0-9]:[0-9][0-9] " /var/log/apache/access_marc.log | egrep '"GET /BLOGURLHERE' | grep -v Pix | grep -v media | grep -v -f /var/log/apache/myblog.seen > /var/log/apache/myblog.tmp ; /var/local/adm/parseblog /var/log/apache/myblog.tmp; ( cat /var/log/apache/myblog.seen ; cat /var/log/apache/myblog.tmp | sed 's/\[/\\\\[/g; s/\]/\\\\]/g' ) | tail -100 > /var/log/apache/myblog.seen.new; /bin/mv /var/log/apache/myblog.seen{.new,} magic:~# cat /var/local/adm/parseblog #!/usr/bin/perl -w use strict; #daniel - - [05/Apr/2004:16:56:52 -0700] "GET /BLOGURLHERE/ HTTP/1.0" 200 142113 "" "Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en) AppleWebKit/124 (KHTML, like Gecko) Safari/125.1" - #foo - - [05/Apr/2004:16:28:11 -0700] "GET /BLOGURLHERE/ HTTP/1.1" 304 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR 1.1.4322; .NET CLR 1.0.3705)" - my $file="/var/log/apache/myblog"; my $showcookies=0; if ($ARGV[0] and $ARGV[0] eq "--showcookies") { $showcookies=1; shift (@ARGV); } $file=$ARGV[0] if ($ARGV[0]); if ($file) { open(LOG, $file) or die "$file: $!"; } else { open(LOG, ) or die "Can't dupe STDIN"; } while(defined ($_=)) { my $oldstr; my $str; $_ =~ /(.+) \S+ \S+ \[(.+?)\] "(.+?)" \S+ \S+ "(.*?)" "(.*?)" *(.*)/; my ($hostname, $date, $url, $ref, $browser, $cookie) = ($1, $2, $3, $4, $5, $6); $date =~ s/ .*//; $cookie="-" unless ($cookie); $url =~ s/GET //; $url =~ s/ HTTP.*//; $str="$date: $url $cookie/$hostname | $browser | from: $ref\n"; $str =~ s#/BLOGURLHERE/#main blog#; $str =~ s#from: http://url.blogspot.com/?#from: gg#; $str =~ s#from: http://www.livejournal.com/users/user/?#from: userlv#; $str =~ s#Mozilla/5.0 \(X11; U; Linux i686; en-US; rv:1.6\) Gecko/20040324#Linux Firefox 0.8/03#; $str =~ s#Mozilla/5.0 \(X11; U; Linux i686; en-US; rv:1.6\) Gecko/20040116#Linux Firefox 0.8/01#; $str =~ s#Mozilla/5.0 \(X11; U; Linux i686; en-US; rv:1.6#Linux Mozilla 1.6#; $str =~ s#Mozilla/5.0 \(Windows; U; Windows NT 5.1; en-US; rv:1.6\) Gecko/20040206 Firefox/0.8#Windows Firefox 0.8/02#; $str =~ s#Mozilla/5.0 \(Macintosh; U; PPC Mac OS X; en\) AppleWebKit/124 (KHTML, like Gecko) Safari/125.1#Safari/125.1#; $str =~ s#Mozilla/4.0 \(compatible; MSIE 6.0; Windows NT 5.2; .NET CLR 1.1.4322; .NET CLR 1.0.3705\)#MSIE 6.0/5.2 1.1.4322#; $str =~ s#Mozilla/4.0 \(compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322\)#MSIE 6.0/5.1 1.1.4322/1.0.3705#; $str =~ s#Mozilla/4.0 \(compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.0.3705\)#MSIE 6.0/5.1 1.0.3705#; $str =~ s#Mozilla/4.0 \(compatible; MSIE 6.0; Windows NT 5.1 #MSIE 6.0/5.1#; $str =~ s#Mozilla/4.0 \(compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322\)#MSIE 6.0/5.0 1.1.4322#; $str =~ s#Mozilla/4.0 \(compatible; MSIE 6.0; Windows NT 5.0; AT&T CSM6.0; T312461\)#MSIE 6.0/5.0 AT&T#; $str =~ s#Mozilla/4.0 \(compatible; MSIE 6.0; Windows NT 5.0#MSIE 6.0 5.0#; $str =~ s#Mozilla/4.0 \(compatible; MSIE 6.0; Windows NT 4.0#MSIE 6.0 4.0#; $str =~ s#Mozilla/4.0 \(compatible; MSIE 5.5; Windows NT 5.0; T312461\)#MSIE 5.5 5.0 T312461#; $str =~ s#Mozilla/4.0 \(compatible; MSIE 5.5; Windows NT 5.0#MSIE 5.5 5.0#; $oldstr=$str; $str =~ s#dsl.pltn13.pacbell.net.\d+/.+.dsl.pltn13.pacbell.net#PB#; $str =~ s#x130-65-109-204.sjsu.edu.\d+/x130-65-109-204.sjsu.edu#NCsjsu#; $str =~ s#\S+.ca-sanfranc0.sa.earthlink.net.\d+/\S+.ca-sanfranc0.sa.earthlink.net#NCDYNsfoearthlink1#; $str =~ s#-/ca0.-ch0.-bl0..ca-sanfranc0.sa.earthlink.net#DYNsfoearthlink2#; $str =~ s#google-ext.263861082394488234/google-ext#merlin-google#; if (not $showcookies) { $str =~ s#(\S+) (\S+) \S+/#$1 $2 #; } if ($str eq $oldstr) { $str =~ s#(\S+) (\S+) (\S+)#$1 $2 --new-->$3#; } print $str; }