Hi again Indunil
Indunil Jayasooriya wrote:
I can't find a way to narrow down the time window
of the report. I also can't find a way to make it cover further back than
the current squid log file -
What do u mean ? do you need older data than the current report
No. I don't think so. The point I am trying to make here is that the
sarg report starts at the beginning of the current squid log. I can't
get any useful data in the current report from earlier squid logs. Can
sarg take multiple input log files? I guess the problem is exacerbated
by the fact that my squid log is rotating every morning. I probably need
to find out why that is happening.
In any case - the report seems to cover the whole period of the log.
Even though the report is generates every 30 minutes - it appears to
cover the whole squid log period. Is there any way to restrict the
report to a short period (say 1 hour) of within the coverage of the
squid log.
So , pls try below squid.cron
[root@worldnet ~]# cat /var/www/sarg/sarg.cron
#!/bin/sh
/usr/bin/sarg
cd /var/www/sarg/reports
rm -rf *.11
Pls try it out.
I'm not sure this is my problem. The latest report appears to cover the
whole period of the squid log in any case. What I really need is to
either slow down the squid log file rotation - or get sarg to read
multiple squid log files.
I seem to have something in my /etc/cron.daily which rotates the squid
access.log file at 4.02 am every morning.
May I have a look at that?
I am really not sure about this now. The log files did appear to be
rotating daily - but not consistently. I'll have to keep an eye on it.
My logrotate is set for weekly rotation of squids logs - but I haven't
really been running it for a week yet. There appears to have been
several rotations - at 4.02 am on various days - but not a week apart -
and not every day. It seems odd - but I will have to keep an eye on it.
I would love you to look into it - but I'm not sure what I can send you...
And also , have a look at these scrips.
I have not used these.Pls try and see. If you succeed, Pls put a mail
to this mailing list, then others can benifit from them.
http://sarg.sourceforge.net/enhancements.php
http://sarg.sourceforge.net/zhaolei.txt
I did have a look at these - but I don't think they are doing what I am
looking for. What i want to do is produce a report that shows me:
Which clients visited which sites between (say) 18:00 and 19:00. Maybe
this is possible with sarg - but if so I haven't found it.
Thanks again Indunil
Regards
Richard.
