Re: [squid-users] Squid log formats - 2.5->2.6?

On Mon, 16 Jun 2008, JPP wrote:

> On Mon, 16 Jun 2008 16:46:16 -0600, JPP wrote
>> On Tue, 17 Jun 2008 00:26:41 +0200, Henrik Nordstrom wrote
>>> On mån, 2008-06-16 at 11:21 -0400, Mike Diggins wrote:
>>>> Has something changed in the access log format between Squid
> 2.5Stable14
>>>> and 2.6Stable20? I'm just upgrading and noticed my webalizer can no
>> longer
>>>> parse the access.log file. It complains about the date which I believe
> is
>>>> the same on both (seconds since the Epoch).
>>>>
>>>> Error: Skipping record (bad date): [31/dec/1969:19:00:00 -0000] [68]
>>>>
>>>> In squid 2.6, I've picked the default squid format (logformat):
>>>>
>>>> logformat squid %ts.%03tu %6tr %>a %Ss/%03Hs %<st %rm %ru %un %Sh/%<A
> %mt
>>>
>>> Should work.
>>>
>>> Are you sure you told webalizer to parse a Squid access log in Squid
>>> native format, and not a common log format?
>>>
>>> Also try without the logformat directive. The "squid" format is
>>> built-in, and may differ sligtly if you redefine it with a logformat
>>> directive..
>>>
>>> Regards
>>> Henrik
>>
>> Greetings all!
>>
>> To quickly chime in, I had a very similar problem and it turned out to be
> my
>> squid.conf file and the:
>> logformat squid %ts.%03tu %6tr %>a %Ss/%03Hs %<st %rm %ru %un %Sh/%<A %mt
>>
>> line. Believe it or not, there was a SPACE between 'squid' and '%ts' and
> the
>> result was a SPACE in the logs before the date started showing. Made me
> nuts
>> too until I started digging and on a lark, saw it, removed the space and it
>> started working again. I did not report it mainly because I had not seen
> any
>> others mentioning it, and figured it was some bonehead thing I did! Could
>> still be, of course.
>> Hopefully this may be your problem also. And hope it helps if it is!
>>
>> Regards,
>> JPP
>
> Sorry - let me be clearer - there were TWO spaces, the one space that is
> there is necessary, mine had an extra one.

Doh, that was it, two spaces instead of one. The two spaces are in the
default squid.conf file so perhaps that's something that could be fixed.
Funny, I was comparing my old access log and new log file, and never
noticed the leading space!

Thanks for your help!

-Mike
Received on Tue Jun 17 2008 - 20:16:15 MDT