When pen is used to load balance web servers, the web server log file
lists all accesses as coming from the host running pen. This makes it
more difficult to analyze the log file.
To solve this, pen creates its own log file, which contains the real
client address, the time of the access, the target server address
and the first few bytes of the requests.
Mergelogs reads pens log file and the log files of all load balanced
web servers, compares each entry and creates a combined log file
that looks as if the web server cluster were a single physical server.
Client addresses are replaced with the real client addresses.
In the event that no matching client address can be found in
the pen log, the server address is used instead. This should never
happen, and is meant as a debugging tool. A large number of these
indicates that the server system date needs to be set, or that
the jitter value is too small.
You probably dont want to use this program. Penlog is a much more
elegant and functional solution.