[ubuntu] Squid - Log Analysis

[Hightower]

Can anybody recommend some software (for Ubuntu) that allows in depth analysis of Squid3 logs.

 

Thanks,

[Geoff]

SARG.

 

SARG

 

It should be in the Ubuntu Repo.

[Hightower]

Any documentation for configuration?

[Geoff]

Check the readme and the man page. Additionally, the configuration files are well commented.

[Hightower]

Sorry - can't make head nor tail of it. Appreciate any help.

 

P.S. looked at demo logs and its just the thing i'm after

[Geoff]

Some specifics explaining exactly where your having issues would be helpful.

[Hightower]

Some specifics explaining exactly where your having issues would be helpful.

 

It certainly would - my bad. Was busy having a play about with it.

 

I have Squid3 installed and have just installed sarg. Been into the conf and changed some things to suit (and you were right, it is very well documented) when I found the file which was in /etc/squid

 

When I browse to http://IPofSquidServer/squid-reports I just get an empty directory - surely this should be populated already with some information.

 

To be honest, I'm not sure if Squid is set up to produce logs (is this done by default)

[RabbieBurns]

I use SARG via webmin

 

It makes it really simple to use.

[Hightower]

I use SARG via webmin

 

It makes it really simple to use.

 

Don't want to use webmin.

[Geoff]

It certainly would - my bad. Was busy having a play about with it.

 

I have Squid3 installed and have just installed sarg. Been into the conf and changed some things to suit (and you were right, it is very well documented) when I found the file which was in /etc/squid

 

When I browse to http://IPofSquidServer/squid-reports I just get an empty directory - surely this should be populated already with some information.

 

To be honest, I'm not sure if Squid is set up to produce logs (is this done by default)

 

1) Sarg will only produce some reports after it's been run, normally this is done via cron. Have you attempted to run sarg manually?

 

2) Squid spits it's logs out to /var/log/squid/. In particular there should be a human readable access.log in that location. Go check.

[Hightower]

1) Sarg will only produce some reports after it's been run, normally this is done via cron. Have you attempted to run sarg manually?

 

2) Squid spits it's logs out to /var/log/squid/. In particular there should be a human readable access.log in that location. Go check.

 

There is a access log there with plenty of entries.

 

How do I run it manually (sorry for my ignorance)

[Hightower]

Sorry - ran it - sorted!

 

Is a cron job created automatically, or is it something for me to set up.

 

If so, how often should I run this?

[Geoff]

Assuming you've edited the sarg.conf correctly:

/usr/sbin/sarg-reports today

Will produce a report for today.

[Geoff]

There are cron jobs setup by default for daily/weekly/monthly. Your web server folder will be populated with reports automagically. The only thing you need to keep an eye on is the amount of reports, I had my proxy die from the hard drive being full of sarg reports once

[Hightower]

Thanks Geoff - much appreciated.

[Hightower]

There are cron jobs setup by default for daily/weekly/monthly. Your web server folder will be populated with reports automagically. The only thing you need to keep an eye on is the amount of reports, I had my proxy die from the hard drive being full of sarg reports once

 

Ok, for some reason I haven't got these Cron jobs and therefore I'm not getting fresh logs.

 

Can somebody post me their cron jobs for these so I can add them how they should be please.

 

Thanks ,

[RabbieBurns]

as far as im aware the cron just runs the generate.pl script.

 

So locate that (on mine its in /etc/webmin/sarg/)

 

then just create a cron to run that once a day/week whatever ?

[Hightower]

as far as im aware the cron just runs the generate.pl script.

 

So locate that (on mine its in /etc/webmin/sarg/)

 

then just create a cron to run that once a day/week whatever ?

 

Thanks, still a bit unsure so could you send me your cron please?

[RabbieBurns]

as i use webmin it is all configured in there.

 

but to create a cron, I would just use nano to create something like this and call it like sarg.sh or something:

 

#/bin/bash
perl /etc/sarg/generate.pl

 

then chmod +x to make it executable

 

and then stick it in the /etc/cron.daily folder.

 

Youll need to change it to whatever the location of the generate.pl is for you

 

(slocate is a good util i use all the time, if its installed just type "locate generate.pl" and it will show you where it is)

Edited February 24, 2009 by RabbieBurns
to give the .sh file a name

[Geoff]

My mistake, I seem to have this in my crontab instead.

 

# use /bin/bash to run commands, instead of the default /bin/sh
SHELL=/bin/bash
MAILTO="[email protected]"

PATH=/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin

00 08-18/1 * * * /root/sarg-reports today > /dev/null 2>&1
00 00 * * * /root/sarg-reports daily > /dev/null 2>&1
00 01 * * 1 /root/sarg-reports weekly > /dev/null 2>&1
30 02 1 * * /root/sarg-reports monthly > /dev/null 2>&1

 

You can get the sarg-reports script here:

 

$PAGETITLE

[Hightower]

My mistake, I seem to have this in my crontab instead.

 

# use /bin/bash to run commands, instead of the default /bin/sh
SHELL=/bin/bash
MAILTO="[email protected]"

PATH=/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin

00 08-18/1 * * * /root/sarg-reports today > /dev/null 2>&1
00 00 * * * /root/sarg-reports daily > /dev/null 2>&1
00 01 * * 1 /root/sarg-reports weekly > /dev/null 2>&1
30 02 1 * * /root/sarg-reports monthly > /dev/null 2>&1

You can get the sarg-reports script here:

 

$PAGETITLE

 

That's what I was looking for - THANKS!