CR incident reports.

I have a couple of questions from one of the IT people dealing with CR
incidents on and around ASU. I now have a little script that send them
CR attempts grepped from my access and error logs on a daily basis.

One of the people there was asing for more info to make sure they are
intrepreting them correctly. I am writing something rather simple up.
If anyone knows of more detailed HOW-TO interpretation of CR access
logs, etc. please let me know...

Now for my question:

is the "XXXXX....." in the access log an indication of a CR 1 or 2
infection? The other IIRC has a "NNNNN...." in it.

EBo --