Re: [squid-users] Squid log formats - 2.5->2.6?

On Mon, 16 Jun 2008 16:46:16 -0600, JPP wrote
> On Tue, 17 Jun 2008 00:26:41 +0200, Henrik Nordstrom wrote
> > On mån, 2008-06-16 at 11:21 -0400, Mike Diggins wrote:
> > > Has something changed in the access log format between Squid
2.5Stable14
> > > and 2.6Stable20? I'm just upgrading and noticed my webalizer can no
> longer
> > > parse the access.log file. It complains about the date which I believe
is
> > > the same on both (seconds since the Epoch).
> > >
> > > Error: Skipping record (bad date): [31/dec/1969:19:00:00 -0000] [68]
> > >
> > > In squid 2.6, I've picked the default squid format (logformat):
> > >
> > > logformat squid %ts.%03tu %6tr %>a %Ss/%03Hs %<st %rm %ru %un %Sh/%<A
%mt
> >
> > Should work.
> >
> > Are you sure you told webalizer to parse a Squid access log in Squid
> > native format, and not a common log format?
> >
> > Also try without the logformat directive. The "squid" format is
> > built-in, and may differ sligtly if you redefine it with a logformat
> > directive..
> >
> > Regards
> > Henrik
>
> Greetings all!
>
> To quickly chime in, I had a very similar problem and it turned out to be
my
> squid.conf file and the:
> logformat squid %ts.%03tu %6tr %>a %Ss/%03Hs %<st %rm %ru %un %Sh/%<A %mt
>
> line. Believe it or not, there was a SPACE between 'squid' and '%ts' and
the
> result was a SPACE in the logs before the date started showing. Made me
nuts
> too until I started digging and on a lark, saw it, removed the space and it
> started working again. I did not report it mainly because I had not seen
any
> others mentioning it, and figured it was some bonehead thing I did! Could
> still be, of course.
> Hopefully this may be your problem also. And hope it helps if it is!
>
> Regards,
> JPP

Sorry - let me be clearer - there were TWO spaces, the one space that is
there is necessary, mine had an extra one.

JPP

--
FRWS WebMail (http://www.frws.com)
Cause you deserve Spam and Virus free email...