Re: [squid-users] Squid Report Issue
On Wednesday 20 August 2003 19.52, Jim_Brouse/[EMAIL PROTECTED] wrote: > I searched access.log and I did find a mention of 007 > although it is part of a URL. Some how the access.log is different > than normal so then SARG is running against the wrong fields. What > do you think is the best way to fix this log? The log is 121 > Meg's. I also have another failed log with 28 megs. Try isolating a number of lines you think are the cause to this confusion and then run a SARG report on these. If the probelem is reporoducible contact the SARG maintainers and give them the test data to reproduce the error. Regards Henrik
Re: [squid-users] Squid Report Issue
The day the log was split was actually not the day I had the problem sorry for the confusion. What I am finding is that on days where the log was not split I do sometimes have many users listed. For example we only have several hundred users on the internet but when this report produces bad data (and I can reproduce the bad report if I copy the access.log file to any other server running SARG) at that point the report will list 23801 users but in the user column in the report I see thousands of entries where IP addresses should be although there are not IP addresses only numbers like "007" I searched access.log and I did find a mention of 007 although it is part of a URL. Some how the access.log is different than normal so then SARG is running against the wrong fields. What do you think is the best way to fix this log? The log is 121 Meg's. I also have another failed log with 28 megs. What is happening is that the report generators get confused and the then the rest of the report is destroyed because it is a sequential file and now it is looking at a field like a url and think it is the userid field. What is the best way to run the logs through a scipt that determines whether or not each line is a good line of data? Jim Henrik NordstromTo: Jim_Brouse/[EMAIL PROTECTED], [EMAIL PROTECTED] <[EMAIL PROTECTED] cc: he.org> Subject: Re: [squid-users] Squid Report Issue 08/19/2003 11:23 AM On Tuesday 19 August 2003 19.07, Jim_Brouse/[EMAIL PROTECTED] wrote: > Is it possible for some reason that squid split the acccess.log > file so now i need to cat them together? Squid never splits the access.log. What Squid may do is to rotate access.log into access.log.1, access.log.2, access.log.3 etc.. If you find other log files then these are either generated by other software, or extracted logs generated by one of your friends administrating the server. Regards Henrik -- Donations welcome if you consider my Free Squid support helpful. https://www.paypal.com/xclick/business=hno%40squid-cache.org If you need commercial Squid support or cost effective Squid or firewall appliances please refer to MARA Systems AB, Sweden http://www.marasystems.com/, [EMAIL PROTECTED]
Re: [squid-users] Squid Report Issue
On Tuesday 19 August 2003 19.07, Jim_Brouse/[EMAIL PROTECTED] wrote: > Is it possible for some reason that squid split the acccess.log > file so now i need to cat them together? Squid never splits the access.log. What Squid may do is to rotate access.log into access.log.1, access.log.2, access.log.3 etc.. If you find other log files then these are either generated by other software, or extracted logs generated by one of your friends administrating the server. Regards Henrik -- Donations welcome if you consider my Free Squid support helpful. https://www.paypal.com/xclick/business=hno%40squid-cache.org If you need commercial Squid support or cost effective Squid or firewall appliances please refer to MARA Systems AB, Sweden http://www.marasystems.com/, [EMAIL PROTECTED]
Re: [squid-users] Squid Report Issue
I think I might have found part of the problem. I have a access.log file for that date that is 514 megs and I also have a bk.access.log file for that date that is only 150 megs. The two files are only separated by Is it possible for some reason that squid split the acccess.log file so now i need to cat them together? How can I tell which one I need to cat to which one? if I use filename >> filename how can I tell which one should be >> into the other one? They are only separated by a minute. What I am thinking happened is that while SARG was running then there was another cron job that did a /us/sbin/squid -k shutdown Below is their output from an ls -alht -rwxr--r--1 root root 514M Jul 31 15:14 access-07-25-03.log -rwxr--r--1 root root 150M Jul 31 15:13 bk.access-07-25-03.log Jim Jim_Brouse/[EMAIL PROTECTED] ITRIBE.ORG To: [EMAIL PROTECTED] cc: 08/18/2003 10:51 AM Subject: [squid-users] Squid Report Issue Currently, I am having a problem I can not resolve at this point though. I have tried looking everywhere for information on this particular squid report issue. I am using SARG for these reports. I do not always get these errors. There is a cron job every night and sometimes I get reports that list about 7000 userid's. We have less than 500 users that have Internet access and the data for all of the 500 users is not in report with the 7000 users which do not show correct ip addresses they are just a set of zeros here is an example of one of the userids "007" normally it is an IP address that makes in the userid field. Jim
[squid-users] Squid Report Issue
Currently, I am having a problem I can not resolve at this point though. I have tried looking everywhere for information on this particular squid report issue. I am using SARG for these reports. I do not always get these errors. There is a cron job every night and sometimes I get reports that list about 7000 userid's. We have less than 500 users that have Internet access and the data for all of the 500 users is not in report with the 7000 users which do not show correct ip addresses they are just a set of zeros here is an example of one of the userids "007" normally it is an IP address that makes in the userid field. Jim
