░▒▓ ɹɐzǝupɐɥʞ ɐzɹıɯ ▓▒░ ha scritto:
On Wed, Jan 21, 2009 at 2:15 PM, Marcello Romani
<mromani@xxxxxxxxxxxxxxx> wrote:
░▒▓ ɹɐzǝupɐɥʞ ɐzɹıɯ ▓▒░ ha scritto:
On Sat, Jan 17, 2009 at 3:51 AM, Chris Robertson <crobertson@xxxxxxx>
wrote:
░▒▓ ɹɐzǝupɐɥʞ ɐzɹıɯ ▓▒░ wrote:
i use crontab
*/30 * * * * /usr/bin/sarg -f /etc/squid/sarg.conf
but the sarg always display 2 lines
16Jan2009-16Jan2009 Fri Jan 16 07:30:01 EST 2009 7 82.28M
11.75M
15Jan2009-16Jan2009 Fri Jan 16 06:30:12 EST 2009 98 3.44G
35.13M
15Jan2009-15Jan2009 Fri Jan 16 00:00:12 EST 2009 98 3.44G
35.12M
This looks like you have three SARG processes running. One started at
midnight, one at 06:30 and one at 07:30.
I think that was not the output of ps ax|grep -i sarg but rather an ls...
nope
it's only one process
0 0 * * * /usr/local/squid/sbin/squid -k rotate
*/30 * * * * /usr/bin/sarg -f /etc/squid/sarg.conf
1) How large is your access.log?
-rw-r----- 1 proxy proxy 2006857 2009-01-21 08:19 access.log
-rw-r----- 1 proxy proxy 40269121 2009-01-21 06:36 access.log.1
-rw-r----- 1 proxy proxy 6799787 2009-01-20 06:39 access.log.2.gz
You specify that a new sarg process has to be started every 30 minutes.
However, you have no control over how much time each sarg process needs to
do its job. You could as well have some of the invocations take so long that
they end their job i.e. two hours later, thus producing reports that show
similar last modification times.
2) How often do you rotate it?
0 0 * * * /usr/local/squid/sbin/squid -k rotate
---
this is my logrotate.d squid
#
# Logrotate fragment for squid.
#
/var/log/squid/*.log {
daily
compress
delaycompress
rotate 2
missingok
nocreate
sharedscripts
prerotate
test ! -x /usr/sbin/sarg-reports || /usr/sbin/sarg-reports
endscript
postrotate
test ! -e /var/run/squid.pid || /usr/sbin/squid -k rotate
endscript
}
You are not specifying that SARG only process data for the current day,
so
it's working on the whole data set every time it runs.
actually i need sarg to process every 30 minuetes
You rotate once a day but process log every 30 minutes, i.e. every 30 mintes
you process an entire day worth of logs.
As the hours pass, every invocation of sarg needs more and more time because
the access log grows as time passes.
By the end of the day you could have a huge access log that needs more than
30 minutes to be fully analyzed.
how to fix it ?
the point 15Jan2009-16Jan2009 is similar with 15Jan2009-15Jan2009
i want to set my report
everyday with update every 30 min...
I run SARG on an hourly basis at a lot of my client's sites, so I tell it
to
only process the current day's reports, with a script in /etc/cron.hourly
that looks like...
#!/bin/bash
#Get current date
TODAY=$(date +%d/%m/%Y)
/usr/bin/sarg -d $TODAY-$TODAY
exit $?
# End Script
Chris
HTH
--
Marcello Romani
and the point is
if i rotate squid by the end of day
then i need sarg to run not 30 min but 60 min ? every 00:01 AM perhaps ?
if so... then the case solved
to prove it i need 1 day from now to test it
thx
( i hope it solved :D )
Maybe you could monitor how long it takes for sarg to run by touch'ing
special named files before and after its execution, i.e.:
*/30 * * * * touch /tmp/sarg_start_`date +'%F %T'` && /usr/bin/sarg -f
/etc/squid/sarg.conf && touch /tmp/sarg_end_`date +'%F %T'`
ls'ing you should see start,end,start,end, etc. If the sequence is
broken, then you have a process starting before the preceding one ends.
Just my 2 cents...
--
Marcello Romani
