Here's the code. The only parts I've added were the first two lines, and the last two close braces. So it's basically the Google Analytics script from here on Devcentral.
[ code ]
when HTTP_REQUEST {
if { [HTTP::host] eq "www.domain.com" } {
when RULE_INIT {
replace the value of the _uacct variable with your Google Analytics account.
set analytics "
"
set exist_search "urchinTracker()"
}
when HTTP_REQUEST {
Don't allow data to be chunked
if { [HTTP::version] eq "1.1" } {
if { [HTTP::header is_keepalive] } {
HTTP::header replace "Connection" "Keep-Alive"
}
HTTP::version "1.0"
}
}
when HTTP_RESPONSE {
if { [HTTP::header Content-Type] starts_with "text/html" } {
if { [HTTP::header exists "Content-Length"] } {
log local0. "content length: [HTTP::header {Content-Length}]"
set content_length [HTTP::header "Content-Length"]
} else {
set content_length 1000000000
}
log local0. "Collecting $content_length bytes"
if { $content_length > 0 } {
HTTP::collect $content_length
}
}
}
when HTTP_RESPONSE_DATA {
log local0. "Content Type: [HTTP::header Content-Type]"
if { ! ([HTTP::payload] contains $::exist_search) } {
log local0. "Payload didn't contain $::exist_search!"
set idx [string last "" [HTTP::payload]]
if { -1 == $idx } {
set idx [string last "" [HTTP::payload]]
}
log local0. "html end tag found at $idx"
if { -1 == $idx } {
set offset [HTTP::payload length]
} else {
set offset $idx
}
HTTP::payload replace $offset 0 $::analytics
}
}
}}
[ / code ]