trying to filter out internal traffic in our Urchin reports

We are currently using Urchin 5.5.01 for our web traffic reporting, but are having a problem in removing our internal traffic.  According to the information I can find online, I am supposed to setup a filter on the profile with the following specifics: type = exclude; filter field is c_ip (RAW); and pattern is 192\.168\.1\., which I have done (I thought successfully, but facts say otherwise!).

The logs are originating from a Win2003 server and set up in W3SVC1 format. Looking at the raw logs, I noticed that the field names established in the opening line of the log file labels the field as c-ip - would that make a difference?  Here is the line from the file:

#Fields: date time s-sitename s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) sc-status sc-substatus sc-win32-status

To double check if the filter is functioning, I set up a page on the site that can only be accessed if you know the direct address and hit it a couple of times internally.  Sure enough, the page results appear in our reports.  The computer I used to access appears in the log with the following line:

2008-02-27 20:36:40 W3SVC852654211 192.168.1.53 GET /test/test-1.asp |1|ASP_0126|Include_file_not_found 80 - 192.168.1.71 Mozilla/4.0+(compatible;+MSIE+7.0;+Windows+NT+5.1;+.NET+CLR+1.1.4322;+InfoPath.1;+.NET+CLR+2.0.50727;+.NET+CLR+3.0.04506.30) 500 0 0

Thanks in advance for any help!Start Free Trial