░▒▓ ɹɐzǝupɐɥʞ ɐzɹıɯ ▓▒░ ha scritto:
On Sat, Jan 17, 2009 at 3:51 AM, Chris Robertson <crobertson@xxxxxxx> wrote:
░▒▓ ɹɐzǝupɐɥʞ ɐzɹıɯ ▓▒░ wrote:
i use crontab
*/30 * * * * /usr/bin/sarg -f /etc/squid/sarg.conf
but the sarg always display 2 lines
16Jan2009-16Jan2009 Fri Jan 16 07:30:01 EST 2009 7 82.28M
11.75M
15Jan2009-16Jan2009 Fri Jan 16 06:30:12 EST 2009 98 3.44G
35.13M
15Jan2009-15Jan2009 Fri Jan 16 00:00:12 EST 2009 98 3.44G
35.12M
This looks like you have three SARG processes running. One started at
midnight, one at 06:30 and one at 07:30.
I think that was not the output of ps ax|grep -i sarg but rather an ls...
nope
it's only one process
0 0 * * * /usr/local/squid/sbin/squid -k rotate
*/30 * * * * /usr/bin/sarg -f /etc/squid/sarg.conf
1) How large is your access.log?
-rw-r----- 1 proxy proxy 2006857 2009-01-21 08:19 access.log
-rw-r----- 1 proxy proxy 40269121 2009-01-21 06:36 access.log.1
-rw-r----- 1 proxy proxy 6799787 2009-01-20 06:39 access.log.2.gz
You specify that a new sarg process has to be started every 30 minutes.
However, you have no control over how much time each sarg process needs
to do its job. You could as well have some of the invocations take so
long that they end their job i.e. two hours later, thus producing
reports that show similar last modification times.
2) How often do you rotate it?
0 0 * * * /usr/local/squid/sbin/squid -k rotate
---
this is my logrotate.d squid
#
# Logrotate fragment for squid.
#
/var/log/squid/*.log {
daily
compress
delaycompress
rotate 2
missingok
nocreate
sharedscripts
prerotate
test ! -x /usr/sbin/sarg-reports || /usr/sbin/sarg-reports
endscript
postrotate
test ! -e /var/run/squid.pid || /usr/sbin/squid -k rotate
endscript
}
You are not specifying that SARG only process data for the current day, so
it's working on the whole data set every time it runs.
actually i need sarg to process every 30 minuetes
You rotate once a day but process log every 30 minutes, i.e. every 30
mintes you process an entire day worth of logs.
As the hours pass, every invocation of sarg needs more and more time
because the access log grows as time passes.
By the end of the day you could have a huge access log that needs more
than 30 minutes to be fully analyzed.
how to fix it ?
the point 15Jan2009-16Jan2009 is similar with 15Jan2009-15Jan2009
i want to set my report
everyday with update every 30 min...
I run SARG on an hourly basis at a lot of my client's sites, so I tell it to
only process the current day's reports, with a script in /etc/cron.hourly
that looks like...
#!/bin/bash
#Get current date
TODAY=$(date +%d/%m/%Y)
/usr/bin/sarg -d $TODAY-$TODAY
exit $?
# End Script
Chris
HTH
--
Marcello Romani
