On Mon, 16 Jun 2008, JPP wrote:
On Mon, 16 Jun 2008 16:46:16 -0600, JPP wrote
On Tue, 17 Jun 2008 00:26:41 +0200, Henrik Nordstrom wrote
On mån, 2008-06-16 at 11:21 -0400, Mike Diggins wrote:
Has something changed in the access log format between Squid
2.5Stable14
and 2.6Stable20? I'm just upgrading and noticed my webalizer can no
longer
parse the access.log file. It complains about the date which I believe
is
the same on both (seconds since the Epoch).
Error: Skipping record (bad date): [31/dec/1969:19:00:00 -0000] [68]
In squid 2.6, I've picked the default squid format (logformat):
logformat squid %ts.%03tu %6tr %>a %Ss/%03Hs %<st %rm %ru %un %Sh/%<A
%mt
Should work.
Are you sure you told webalizer to parse a Squid access log in Squid
native format, and not a common log format?
Also try without the logformat directive. The "squid" format is
built-in, and may differ sligtly if you redefine it with a logformat
directive..
Regards
Henrik
Greetings all!
To quickly chime in, I had a very similar problem and it turned out to be
my
squid.conf file and the:
logformat squid %ts.%03tu %6tr %>a %Ss/%03Hs %<st %rm %ru %un %Sh/%<A %mt
line. Believe it or not, there was a SPACE between 'squid' and '%ts' and
the
result was a SPACE in the logs before the date started showing. Made me
nuts
too until I started digging and on a lark, saw it, removed the space and it
started working again. I did not report it mainly because I had not seen
any
others mentioning it, and figured it was some bonehead thing I did! Could
still be, of course.
Hopefully this may be your problem also. And hope it helps if it is!
Regards,
JPP
Sorry - let me be clearer - there were TWO spaces, the one space that is
there is necessary, mine had an extra one.
Doh, that was it, two spaces instead of one. The two spaces are in the
default squid.conf file so perhaps that's something that could be fixed.
Funny, I was comparing my old access log and new log file, and never
noticed the leading space!
Thanks for your help!
-Mike
