Re: [squid-users] oot: about sarg

░▒▓ ɹɐzǝupɐɥʞ ɐzɹıɯ ▓▒░ ha scritto:
> On Wed, Jan 21, 2009 at 2:15 PM, Marcello Romani
> <mromani_at_ottotecnica.com> wrote:
>> ░▒▓ ɹɐzǝupɐɥʞ ɐzɹıɯ ▓▒░ ha scritto:
>>> On Sat, Jan 17, 2009 at 3:51 AM, Chris Robertson <crobertson_at_gci.net>
>>> wrote:
>>>> ░▒▓ ɹɐzǝupɐɥʞ ɐzɹıɯ ▓▒░ wrote:
>>>>> i use crontab
>>>>> */30 * * * * /usr/bin/sarg -f /etc/squid/sarg.conf
>>>>>
>>>>> but the sarg always display 2 lines
>>>>> 16Jan2009-16Jan2009 Fri Jan 16 07:30:01 EST 2009 7 82.28M
>>>>> 11.75M
>>>>> 15Jan2009-16Jan2009 Fri Jan 16 06:30:12 EST 2009 98 3.44G
>>>>> 35.13M
>>>>> 15Jan2009-15Jan2009 Fri Jan 16 00:00:12 EST 2009 98 3.44G
>>>>> 35.12M
>>>>>
>>>> This looks like you have three SARG processes running. One started at
>>>> midnight, one at 06:30 and one at 07:30.
>> I think that was not the output of ps ax|grep -i sarg but rather an ls...
>>
>>> nope
>>> it's only one process
>>> 0 0 * * * /usr/local/squid/sbin/squid -k rotate
>>> */30 * * * * /usr/bin/sarg -f /etc/squid/sarg.conf
>>>
>>>> 1) How large is your access.log?
>>> -rw-r----- 1 proxy proxy 2006857 2009-01-21 08:19 access.log
>>> -rw-r----- 1 proxy proxy 40269121 2009-01-21 06:36 access.log.1
>>> -rw-r----- 1 proxy proxy 6799787 2009-01-20 06:39 access.log.2.gz
>>>
>> You specify that a new sarg process has to be started every 30 minutes.
>> However, you have no control over how much time each sarg process needs to
>> do its job. You could as well have some of the invocations take so long that
>> they end their job i.e. two hours later, thus producing reports that show
>> similar last modification times.
>>
>>>> 2) How often do you rotate it?
>>> 0 0 * * * /usr/local/squid/sbin/squid -k rotate
>>> ---
>>> this is my logrotate.d squid
>>> #
>>> # Logrotate fragment for squid.
>>> #
>>> /var/log/squid/*.log {
>>> daily
>>> compress
>>> delaycompress
>>> rotate 2
>>> missingok
>>> nocreate
>>> sharedscripts
>>> prerotate
>>> test ! -x /usr/sbin/sarg-reports || /usr/sbin/sarg-reports
>>> endscript
>>> postrotate
>>> test ! -e /var/run/squid.pid || /usr/sbin/squid -k rotate
>>> endscript
>>> }
>>>
>>>
>>>
>>>
>>>> You are not specifying that SARG only process data for the current day,
>>>> so
>>>> it's working on the whole data set every time it runs.
>>> actually i need sarg to process every 30 minuetes
>>>
>> You rotate once a day but process log every 30 minutes, i.e. every 30 mintes
>> you process an entire day worth of logs.
>> As the hours pass, every invocation of sarg needs more and more time because
>> the access log grows as time passes.
>> By the end of the day you could have a huge access log that needs more than
>> 30 minutes to be fully analyzed.
>>
>>>
>>>>> how to fix it ?
>>>>> the point 15Jan2009-16Jan2009 is similar with 15Jan2009-15Jan2009
>>>>>
>>>>> i want to set my report
>>>>> everyday with update every 30 min...
>>>>>
>>>> I run SARG on an hourly basis at a lot of my client's sites, so I tell it
>>>> to
>>>> only process the current day's reports, with a script in /etc/cron.hourly
>>>> that looks like...
>>>>
>>>> #!/bin/bash
>>>>
>>>> #Get current date
>>>> TODAY=$(date +%d/%m/%Y)
>>>> /usr/bin/sarg -d $TODAY-$TODAY
>>>> exit $?
>>>>
>>>> # End Script
>>>>
>>>> Chris
>>>>
>>>>
>>>
>>>
>> HTH
>>
>> --
>> Marcello Romani
>>
>
> and the point is
> if i rotate squid by the end of day
> then i need sarg to run not 30 min but 60 min ? every 00:01 AM perhaps ?
> if so... then the case solved
> to prove it i need 1 day from now to test it
>
> thx
> ( i hope it solved :D )
>

Maybe you could monitor how long it takes for sarg to run by touch'ing
special named files before and after its execution, i.e.:

*/30 * * * * touch /tmp/sarg_start_`date +'%F %T'` && /usr/bin/sarg -f
/etc/squid/sarg.conf && touch /tmp/sarg_end_`date +'%F %T'`

ls'ing you should see start,end,start,end, etc. If the sequence is
broken, then you have a process starting before the preceding one ends.

Just my 2 cents...

-- 
Marcello Romani