[Ubuntu] Squid - Log Analysis

[Hightower]

Can anybody recommend some software (for Ubuntu) that allows in depth analysis of Squid3 logs.

Thanks,

[Geoff]

SARG.

SARG

It should be in the Ubuntu Repo.

[Hightower]

Any documentation for configuration?

[Geoff]

Check the readme and the man page. Additionally, the configuration files are well commented.

[Hightower]

Sorry - can't make head nor tail of it. Appreciate any help.

P.S. looked at demo logs and its just the thing i'm after

[Geoff]

Some specifics explaining exactly where your having issues would be helpful.

[Hightower]

Some specifics explaining exactly where your having issues would be helpful.

It certainly would - my bad. Was busy having a play about with it.

I have Squid3 installed and have just installed sarg. Been into the conf and changed some things to suit (and you were right, it is very well documented) when I found the file which was in /etc/squid

When I browse to http://IPofSquidServer/squid-reports I just get an empty directory - surely this should be populated already with some information.

To be honest, I'm not sure if Squid is set up to produce logs (is this done by default)

[RabbieBurns]

I use SARG via webmin

It makes it really simple to use.

[Hightower]

I use SARG via webmin

It makes it really simple to use.

Don't want to use webmin.

[Geoff]

It certainly would - my bad. Was busy having a play about with it.

I have Squid3 installed and have just installed sarg. Been into the conf and changed some things to suit (and you were right, it is very well documented) when I found the file which was in /etc/squid

When I browse to http://IPofSquidServer/squid-reports I just get an empty directory - surely this should be populated already with some information.

To be honest, I'm not sure if Squid is set up to produce logs (is this done by default)

1) Sarg will only produce some reports after it's been run, normally this is done via cron. Have you attempted to run sarg manually?

2) Squid spits it's logs out to /var/log/squid/. In particular there should be a human readable access.log in that location. Go check.

[Hightower]

1) Sarg will only produce some reports after it's been run, normally this is done via cron. Have you attempted to run sarg manually?

2) Squid spits it's logs out to /var/log/squid/. In particular there should be a human readable access.log in that location. Go check.

There is a access log there with plenty of entries.

How do I run it manually (sorry for my ignorance)

[Hightower]

Sorry - ran it - sorted!

Is a cron job created automatically, or is it something for me to set up.

If so, how often should I run this?

[Geoff]

Assuming you've edited the sarg.conf correctly:

/usr/sbin/sarg-reports today

Will produce a report for today.

[Geoff]

There are cron jobs setup by default for daily/weekly/monthly. Your web server folder will be populated with reports automagically. The only thing you need to keep an eye on is the amount of reports, I had my proxy die from the hard drive being full of sarg reports once

[Hightower]

Thanks Geoff - much appreciated.