Re: [squid-users] oot: about sarg

░▒▓ ɹɐzǝupɐɥʞ ɐzɹıɯ ▓▒░ ha scritto:
> On Sat, Jan 17, 2009 at 3:51 AM, Chris Robertson <crobertson_at_gci.net> wrote:
>> ░▒▓ ɹɐzǝupɐɥʞ ɐzɹıɯ ▓▒░ wrote:
>>> i use crontab
>>> */30 * * * * /usr/bin/sarg -f /etc/squid/sarg.conf
>>>
>>> but the sarg always display 2 lines
>>> 16Jan2009-16Jan2009 Fri Jan 16 07:30:01 EST 2009 7 82.28M
>>> 11.75M
>>> 15Jan2009-16Jan2009 Fri Jan 16 06:30:12 EST 2009 98 3.44G
>>> 35.13M
>>> 15Jan2009-15Jan2009 Fri Jan 16 00:00:12 EST 2009 98 3.44G
>>> 35.12M
>>>
>> This looks like you have three SARG processes running. One started at
>> midnight, one at 06:30 and one at 07:30.

I think that was not the output of ps ax|grep -i sarg but rather an ls...

>
> nope
> it's only one process
> 0 0 * * * /usr/local/squid/sbin/squid -k rotate
> */30 * * * * /usr/bin/sarg -f /etc/squid/sarg.conf
>
>> 1) How large is your access.log?
> -rw-r----- 1 proxy proxy 2006857 2009-01-21 08:19 access.log
> -rw-r----- 1 proxy proxy 40269121 2009-01-21 06:36 access.log.1
> -rw-r----- 1 proxy proxy 6799787 2009-01-20 06:39 access.log.2.gz
>

You specify that a new sarg process has to be started every 30 minutes.
However, you have no control over how much time each sarg process needs
to do its job. You could as well have some of the invocations take so
long that they end their job i.e. two hours later, thus producing
reports that show similar last modification times.

>
>> 2) How often do you rotate it?
>
> 0 0 * * * /usr/local/squid/sbin/squid -k rotate
> ---
> this is my logrotate.d squid
> #
> # Logrotate fragment for squid.
> #
> /var/log/squid/*.log {
> daily
> compress
> delaycompress
> rotate 2
> missingok
> nocreate
> sharedscripts
> prerotate
> test ! -x /usr/sbin/sarg-reports || /usr/sbin/sarg-reports
> endscript
> postrotate
> test ! -e /var/run/squid.pid || /usr/sbin/squid -k rotate
> endscript
> }
>
>
>
>
>> You are not specifying that SARG only process data for the current day, so
>> it's working on the whole data set every time it runs.
>
> actually i need sarg to process every 30 minuetes
>

You rotate once a day but process log every 30 minutes, i.e. every 30
mintes you process an entire day worth of logs.
As the hours pass, every invocation of sarg needs more and more time
because the access log grows as time passes.
By the end of the day you could have a huge access log that needs more
than 30 minutes to be fully analyzed.

>
>
>>> how to fix it ?
>>> the point 15Jan2009-16Jan2009 is similar with 15Jan2009-15Jan2009
>>>
>>> i want to set my report
>>> everyday with update every 30 min...
>>>
>>
>> I run SARG on an hourly basis at a lot of my client's sites, so I tell it to
>> only process the current day's reports, with a script in /etc/cron.hourly
>> that looks like...
>>
>> #!/bin/bash
>>
>> #Get current date
>> TODAY=$(date +%d/%m/%Y)
>> /usr/bin/sarg -d $TODAY-$TODAY
>> exit $?
>>
>> # End Script
>>
>> Chris
>>
>>
>
>
>

HTH

-- 
Marcello Romani