Log file question

[ekkas2]

I'm using Wingate's log files to calculate the IPs on my network's usage. Some people are complaining that their usage is showing more than what they'd expect. Upon closer examination, I see lines like (edited):
0 10.1.3.19 http://profile.ak.facebook.com/profile5 ... 9_7670.jpg 1196 3253 2007/12/06 14:28
0 10.1.3.19 http://profile.ak.facebook.com/profile5 ... 9_7670.jpg 1196 3253 2007/12/06 14:28
0 10.1.3.19 http://profile.ak.facebook.com/profile5 ... 9_7670.jpg 1196 3253 2007/12/06 14:28
0 10.1.3.19 http://profile.ak.facebook.com/profile5 ... 9_7670.jpg 1196 3253 2007/12/06 14:28
0 10.1.3.19 http://profile.ak.facebook.com/profile5 ... 9_7670.jpg 1196 3253 2007/12/06 14:28
1 10.1.3.19 http://profile.ak.facebook.com/profile5 ... 9_7670.jpg 1196 3253 2007/12/06 14:28
1 10.1.3.19 http://profile.ak.facebook.com/profile5 ... 9_7670.jpg 1196 3253 2007/12/06 14:28
0 10.1.3.19 http://profile.ak.facebook.com/profile5 ... 9_7670.jpg 1196 3253 2007/12/06 14:28
0 10.1.3.19 http://profile.ak.facebook.com/profile5 ... 9_7670.jpg 1196 3253 2007/12/06 14:28
0 10.1.3.19 http://profile.ak.facebook.com/profile5 ... 9_7670.jpg 1196 3253 2007/12/06 14:28
0 10.1.3.19 http://profile.ak.facebook.com/profile5 ... 9_7670.jpg 1196 3253 2007/12/06 14:28
0 10.1.3.19 http://profile.ak.facebook.com/profile5 ... 9_7670.jpg 1196 3253 2007/12/06 14:28
0 10.1.3.19 http://profile.ak.facebook.com/profile5 ... 9_7670.jpg 1196 3253 2007/12/06 14:28
0 10.1.3.19 http://profile.ak.facebook.com/profile5 ... 9_7670.jpg 1196 3253 2007/12/06 14:28
0 10.1.3.19 http://profile.ak.facebook.com/profile5 ... 9_7670.jpg 1196 3253 2007/12/06 14:28

Which shows the same jpg, downloaded at the same moment, 15 times!!!
Can this be correct? Any help from QBik to enable me to get some more accurate traffic readings would be great...

Unfortunately, due to the nature of my network (wireless, over three towns, I cannot implement WG usernames or assumed usernames as my software need to automatically read every few minutes. (I roll-over log files every 5 minutes and then my software parse it)

Ekkas

[adrien]

Hi

is that from a log file, or the history database?

We normally log data amounts on a separate line to the request.

Regards

Adrien

[ekkas2]

That was from History... My prog delete unused logfiles, but I'll see if I can extract some without deleting.

[adrien]

One thing.

WinGate strips off the query strings for logging to history, since they may contain sensitive data. the query string is anything after a '?' in the URL

So it's possible those are all different URLs with the same base, but different query part. The logs should show this.

Regards

Adrien