Re: [squid-users] Any recommended squid log analyzer?

On 08/09/10 00:29, Kaiwang Chen wrote:
> See inline.
>
> Thanks,
> kc
>
> 2010/9/7 Amos Jeffries<squid3_at_treenet.co.nz>:
>> On Tue, 7 Sep 2010 01:45:46 +0800, Kaiwang Chen<kaiwang.chen_at_gmail.com>
>> wrote:
>>> Hello,
>>>
>>>
>>> Looks like awstats.pl cannot recognize "squid" logformat from
>>> squid3.1.6, as pointed out by LogFormat in awstats.mysite.conf
>>> # Possible values: 1,2,3,4 or "your_own_personalized_log_format"
>>> # 1 - Apache or Lotus Notes/Domino native combined log format (NCSA
>>> combined/XLF/ELF log format)
>>> # 2 - IIS or ISA format (IIS W3C log format). See FAQ-COM115 For ISA.
>>> # 3 - Webstar native log format.
>>> # 4 - Apache or Squid native common log format (NCSA common/CLF log
>> format)
>>>
>>> Its capability for customization is also too limited to understand
>>> logformat directives in squid.conf.documented, such as %tr.
>>>
>>> So any recommendation?
>>
>> Maybe an apache-format log just for awstats?
>> access_log /var/logs/squid-awstats.log common
>
> So I have to keep redundant access log contents, 2 log entries per 1
> access, one for awstats, ther other for other analysis.

No you don't have to. It's a suggestion you can ignore if you like.
Others have posted scripts to convert logs on the fly for processing.

>
>>
>> We used awstats.pl for the wiki.squid-cache.org website under 3.0 and IIRC
>> early 3.1 releases before the log server sponsorship dropped. The native
>> 'squid' format has not been changed since 2.6. Just the text held in some
>> fields has been extended.
>
> So you were using Common Log Format, rather than squid native format?

I'm not sure about that. Possibly. I just know we used awstats.

> Looks like the logformat of 4 (CLF?) in awstats.pl differs from the
> (native?) "squid" logformat...

Ah, I see where the confusion has arrising. AWStats says "Squid native
common". Which in squid is the "common"/CLF format not the "squid"
native format.

Same goes for all the applications it claims to support, ... only if
they output some form of Apache CLF or Apache combined.

Amos

-- 
Please be using
   Current Stable Squid 2.7.STABLE9 or 3.1.8
   Beta testers wanted for 3.2.0.2