search

darold / squidanalyzer

Squid Analyzer parses Squid proxy access log and reports general statistics about hits, bytes, users, networks, top URLs, and top second level domains. Statistic reports are oriented toward user and bandwidth control.
http://squidanalyzer.darold.net/
125 stars 36 forks source link

User report #187

Closed 9acca9 closed 5 years ago

9acca9 commented 6 years ago

Hi. Im having trouble to config the include file.

I have this kind of log from squid

`[root@proxy2 ~]# tail -f /var/log/squid/access.log 1533566855.748 61592 192.168.6.77 TCP_TUNNEL/200 6007 CONNECT live.rezync.com:443 user1 HIER_DIRECT/52.37.220.187 -

1533566855.925 2644 192.168.1.8 TCP_TUNNEL/200 18172 CONNECT mail.google.com:443 user2 HIER_DIRECT/172.217.30.165 - ` I just want that the report show this: user1 user2

I have this in my configs files:

`[root@proxy2 squidanalyzer]# cat included NETWORK 192.168.0.0/16

[root@proxy2 squidanalyzer]# cat network-aliases MYDOMAIN 192.168.0.0/16 ` Whit that config i just see ip. Can somebody give me a hand?? i cant see the report as i want. thanks!

darold commented 6 years ago

Hi,

If you want to filter on users do not set network addresses unless you want to filter users connecting from some networks only. If you just want to see report about user1 and user2 set the following in file /etc/squidanalyzer/included:

USER     user1 user2

Regards,

9acca9 commented 6 years ago

Hi. thanks. sorry, i explain bad... i want include ALL the users. I have to name all??? i mean users like "hmorales" "kbrian" "jlennon" ,etc. because i have too many users... there is no USER * Thanks!

darold commented 6 years ago

ALL is the default, that mean that you don't have to set USER entries in the included file. If you keep

NETWORK 192.168.0.0/16

in the included file then only entries from this network mask will be reported.

9acca9 commented 6 years ago

Hi, Thanks. But, with that config i just get the ip in the report and no the user name. Also, the values are empty in the others category... (request, bytes, etc.)

darold commented 6 years ago

I do not understand the problem, can you send to my private email a representative part of your log file (around 1000 lines) and a tarball of your /etc/squidanalyzer/ repository?