Closed cvItvre closed 5 years ago
What is the format of your access.log? native, common or combined?
I think it's in native format, bellow u can see a line from the access.log file.
1559121904.856 1 10.181.51.142 TCP_DENIED/403 1158 CONNECT splunk-heavyforwarder-public.vtex.com:8088 - HIER_NONE/- text/html
I guess that you are using latest development code and you have TimeZone commented out in your configuration file. If you look at your access.log file at offset 39991429, the next line might have a time older than the history time. Using vi you can move to the offset using: :goto 39991429
I tested with various log files and in all tests the number in the SquidAnalyzer.current file is the last character of the last line. There is no line after it.
Please upgrade to latest development code I have just fixed an other problem with timezone.
OK, i'll do that, ty.
When I run squidanalyzer more than once, this error appears:
this file will not be parsed: /var/log/squid/access.log, line after offset is older than expected: 1559305827.287 < 1559316567.287.
Looking at the SquidAnalyzer.current file we have:
1559316567.287 39991429
Every time I run squidanalyzer, the time in the SquidAnalyzer.current file is always greater than the time in the access.log file. So I have to delete the SquidAnalyzer.current file and run squidanalyzer again. Why is this happening? How does this file work? When I delete and run, all my logs need to be parsed again and it takes a lot of time. How do I fix that?