Hi again Indunil - and many thanks.
I think I have sarg working - at least to the point of generating
regular report files as suggested in your step by step instructions. I
had already set execute bit on sarg.cron. I set the cron job to run
every 30 minutes - and it appears to be doing just that. However - I
can't find a way to filter the data within a time window. The cron job
seems to create a new report every 30 minutes - and delete the old one.
The new report covers the full period (presumably) covered by the
current squid log file - until the time the report is generated. I can't
find a way to narrow down the time window of the report. I also can't
find a way to make it cover further back than the current squid log file
- though the daily and weekly reports will presumably go further back.
I seem to have something in my /etc/cron.daily which rotates the squid
access.log file at 4.02 am every morning. I'm not sure whether this is
normal (logrotate) - or whether another web statistics package (possible
webalizer) is doing this, and thereby interfering with sarg. From what I
can see - logrotate is set to rotate weekly rather than daily. Does
anyone have any thoughts on this?
Thanks again.
Richard.
Indunil Jayasooriya wrote:
Yes. That did help quite a bit. I had actually seen the link before from a
google search - but hadn't studied it properly. It certainly explains my
"forbidden" problem. I think I found a missing step though. The step by step
instructions do not tell you to make sarg.cron executable - so the cron job
wouldn't run until I corrected this.
Yeah, sarg.cron should be executable. So, Pls execute it in following way.
chmod 755 /var/www/sarg/sarg.cron
It still leaves me with a few queries though:
1) I would like to be able to see what traffic flowed between (say) 13.00 on
13 June 2008 and 14:00 on 13th June 2008.
I think that it depends on the crontab. my crontab @ step by steb doc
displays every 5 minute execution. So , Then, It has every 5 miniute
data.
For example, crontab executes every 5 minutes. Let's say 13 hrs ,
13.05 hrs, 13.10 hrs ans so on.
I haven't found a way to do this yet. Is it possible with Sarg? I am trying
to find out what causes occasional large traffic bursts.
First, Pls get Sarg woking. Then, begin to analyse.
2) Is there some more complete documentation somewhere? The man page refers
to documentation in the "GNU info format". Where could I find this
Difficult to say.
