Re: [squid-users] log server

Hi, George...

On Sat, Aug 21, 2004 at 11:55:53PM +0800, George Hong wrote:
> I have several squid cache servers setting us as reversed proxy for a
> large website. We need to provide a single log file everyday. Instead of
> spending hours on combining several huge access.log files into one, I'm
> wondering whether I can use a log server and point the log file to it so
> that the log file is already well organized. If I want to implement it,
> where should I start?

Well, built-in syslog only works for the cache.log so this is not an
option. I wrote a Perl script called "tail2syslog" (which I provide as a
Debian package but which is useful on other systems as well) which
follows the changes in the access.log (like a "tail -f") and forwards
them to a syslog server.

Advantage:
 - you probably already have a syslog server in your network

Disadvantages:
 - the script sucks a lot of CPU on busy systems (we have 60 requests
   per second and the script produces much higher load than Squid)
 - the output will not be plain access.log output as syslog adds some
   data before each line (so automated statistics tools won't work
   without some conversion)
 - long log lines may get cut (if you log mime headers or have very
   long URLs)

If you are interested I'll put it online.

> One way to solve the issue I can think of is to mount the log server's
> disk on the cache servers. But mount is not reliable and I don't like
> it. It might have write lock issues since multiple servers are writing
> to it at the same time.

I like the idea of an NFS mount. Probably a nice idea for our servers.
:)

 Christoph

-- 
~
~
".signature" [Modified] 3 lines --100%--                3,41         All