Re: [squid-users] Squid Report Issue

     The day the log was split was actually not the day I had the problem
sorry for the confusion.

     What I am finding is that on days where the log was not split I do
sometimes have many users listed.

     For example we only have several hundred users on the internet but
when this report produces bad data (and I can reproduce the bad report if I
copy the access.log file to any other server running SARG) at that point
the report will list 23801 users but in the user column in the report I see
thousands of entries where IP addresses should be although there are not IP
addresses only numbers like "000000000000007"

I searched access.log and I did find a mention of 000000000000007 although
it is part of a URL. Some how the access.log is different than normal so
then SARG is running against the wrong fields. What do you think is the
best way to fix this log? The log is 121 Meg's. I also have another
failed log with 28 megs.

What is happening is that the report generators get confused and the then
the rest of the report is destroyed because it is a sequential file and now
it is looking at a field like a url and think it is the userid field.

What is the best way to run the logs through a scipt that determines
whether or not each line is a good line of data?

Jim

                                                                                                                   
                    Henrik
                    Nordstrom To: Jim_Brouse/PYT@PASCUAYAQUITRIBE.ORG, squid-users@squid-cache.org
                    <hno@squid-cac cc:
                    he.org> Subject: Re: [squid-users] Squid Report Issue
                                                                                                                   
                    08/19/2003
                    11:23 AM
                                                                                                                   
                                                                                                                   

On Tuesday 19 August 2003 19.07, Jim_Brouse/PYT@PASCUAYAQUITRIBE.ORG
wrote:

> Is it possible for some reason that squid split the acccess.log
> file so now i need to cat them together?

Squid never splits the access.log.

What Squid may do is to rotate access.log into access.log.1,
access.log.2, access.log.3 etc..

If you find other log files then these are either generated by other
software, or extracted logs generated by one of your friends
administrating the server.

Regards
Henrik

--
Donations welcome if you consider my Free Squid support helpful.
https://www.paypal.com/xclick/business=hno%40squid-cache.org
If you need commercial Squid support or cost effective Squid or
firewall appliances please refer to MARA Systems AB, Sweden
http://www.marasystems.com/, info@marasystems.com