search

darold / squidanalyzer

Squid Analyzer parses Squid proxy access log and reports general statistics about hits, bytes, users, networks, top URLs, and top second level domains. Statistic reports are oriented toward user and bandwidth control.
http://squidanalyzer.darold.net/
126 stars 36 forks source link

crash: Unmatched [ in regex; line 206649 #89

Closed dtouzeau closed 9 years ago

dtouzeau commented 9 years ago 
Unmatched [ in regex; marked by <-- HERE in m/^���r��D���[ <-- HERE �y�����$/ at /usr/share/perl5/SquidAnalyzer.pm line 929, <GEN0> line 206649
darold commented 9 years ago

What is your version of SquidAnalyzer? Please try with latest code from github and if you still have the issue, please post send me the part of the log file that's fail.

dtouzeau commented 9 years ago

Latest git version, i send to you the squid log file

darold commented 9 years ago

Ok, thanks, do you have any error message to reports with using last SquidAnalyzer code? I'm not able to reproduce the issue with your log.

dtouzeau commented 9 years ago

Issue is this error make the script crash and log is not totally parsed..

darold commented 9 years ago

With last development code and Perl v5.14.2 I'm not able to reproduce this issue. However here is the line that generates the issue from your log:

1435617936.796      0 192.168.1.159 TAG_NONE/400 7294 <86><9a>^Vîr<9a>þDëùÙ[éy¨<9e>ó<9e>è %B0%DDV%12%D3%DB%DF%FB%13%BA%AA%93%A2%D2P%D86%91%0F.%A5%C9%27%B1%05%B0%27A%0E%BF%BE?dcd%DD - HIER_NONE/- text/html

I don't know what made such a corruption but in field method, instead of GET/POST/CONNECT or any other valid method, you have the string: <86><9a>^Vîr<9a>þDëùÙ[éy¨<9e>ó<9e>è

Please download and install latest development code from github, commit dce60d6 include a fix for your case but I really recommend you to look at host 192.168.1.159 and see how it has performed this invalid request.

Regards

darold commented 9 years ago

Commit 1d418de, to skip immediately lines that squid is not able to tag: TAG_NONE.