search

darold / squidanalyzer

Squid Analyzer parses Squid proxy access log and reports general statistics about hits, bytes, users, networks, top URLs, and top second level domains. Statistic reports are oriented toward user and bandwidth control.
http://squidanalyzer.darold.net/
125 stars 36 forks source link

SquidAnalyzer.current file generating error #206

Closed cvItvre closed 5 years ago

cvItvre commented 5 years ago

When I run squidanalyzer more than once, this error appears:

this file will not be parsed: /var/log/squid/access.log, line after offset is older than expected: 1559305827.287 < 1559316567.287.

Looking at the SquidAnalyzer.current file we have:

1559316567.287 39991429

Every time I run squidanalyzer, the time in the SquidAnalyzer.current file is always greater than the time in the access.log file. So I have to delete the SquidAnalyzer.current file and run squidanalyzer again. Why is this happening? How does this file work? When I delete and run, all my logs need to be parsed again and it takes a lot of time. How do I fix that?

darold commented 5 years ago

What is the format of your access.log? native, common or combined?

cvItvre commented 5 years ago

I think it's in native format, bellow u can see a line from the access.log file.

1559121904.856 1 10.181.51.142 TCP_DENIED/403 1158 CONNECT splunk-heavyforwarder-public.vtex.com:8088 - HIER_NONE/- text/html

darold commented 5 years ago

I guess that you are using latest development code and you have TimeZone commented out in your configuration file. If you look at your access.log file at offset 39991429, the next line might have a time older than the history time. Using vi you can move to the offset using: :goto 39991429

cvItvre commented 5 years ago

I tested with various log files and in all tests the number in the SquidAnalyzer.current file is the last character of the last line. There is no line after it.

darold commented 5 years ago

Please upgrade to latest development code I have just fixed an other problem with timezone.

cvItvre commented 5 years ago

OK, i'll do that, ty.