Re: [squid-users] Re: Help with sarg usage

Richard Chapman wrote:

> I also can't find a way to make it cover further back than the current
> squid log file - though the daily and weekly reports will presumably
> go further back.

/path/to/sarg -l /var/log/squid/access.log -l
/var/log/squid/access.log.1 -l /var/log/squid/access.log.2.gz

will parse the data from access.log, access.log.1 and (after gunzipping)
access.log.2.gz, and will give you one report for the time covered by
these log files.

> What i want to do is produce a report that shows me:
> Which clients visited which sites between (say) 18:00 and 19:00. Maybe
> this is possible with sarg - but if so I haven't found it.

You have two choices with SARG.

The first is the simplest, but might not meet your needs. Make sure in
your sarg.conf file the "report_type" directive includes "users_sites"
and "date_time" and/or "site_user_time_date". The first will give you a
listing of the sites each username/IP accessed. The second, will show
bandwidth usage per hour for each username/IP (linked from the main
report). The third will give you a listing of the times an individual
accessed a specific website (linked from the users_sites report).

Your second option is to create a report just covering a specific time
period. The following hourly cron job does this:

#!/bin/bash

#Get current date
TODAY=$(date +%d/%m/%Y)
LASTHOUR=$(date +%H -d "1 hour ago")
HOUR=$(date +%H)

/bin/touch /path/to/web/squid-reports/images
# Be careful with this next line, as it recursively removes any files
modified more
# than 30 minutes ago in the path given!
/usr/bin/find /path/to/web/squid-reports -type d -cmin +30 -exec rm -rf
{} \;
/usr/bin/sarg -d $TODAY-$TODAY -t $LASTHOUR:00-$HOUR:00

> Regards
>
> Richard.

Chris
Received on Wed Jun 18 2008 - 20:53:09 MDT