Re: [squid-users] oot: about sarg

still same :((
--------------
Squid User Access Reports
        
FILE/PERIOD CREATION DATE USERS BYTES AVERAGE
22Jan2009-22Jan2009 Thu Jan 22 07:32:48 EST 2009 5 2.71M 543.46K
21Jan2009-22Jan2009 Thu Jan 22 07:01:10 EST 2009 96 1.71G 17.83M
21Jan2009-21Jan2009 Wed Jan 21 23:01:11 EST 2009 96 1.71G 17.83M
20Jan2009-21Jan2009 Wed Jan 21 06:30:15 EST 2009 95 3.06G 32.30M
---------------
my crontab are :
root_at_castor:/home/mirza# crontab -l
0 0 * * * /usr/local/squid/sbin/squid -k rotate
1 * * * * /usr/bin/sarg -f /etc/squid/sarg.conf
----------------
root_at_castor:/home/mirza# cat /etc/logrotate.conf
# see "man logrotate" for details
# rotate log files weekly
weekly

# keep 4 weeks worth of backlogs
rotate 4

# create new (empty) log files after rotating old ones
create

# uncomment this if you want your log files compressed
#compress

# packages drop log rotation information into this directory
include /etc/logrotate.d

# no packages own wtmp, or btmp -- we'll rotate them here
/var/log/wtmp {
    missingok
    monthly
    create 0664 root utmp
    rotate 1
}

/var/log/btmp {
    missingok
    monthly
    create 0660 root utmp
    rotate 1
}

# system-specific logs may be configured here
===============
Running on ubuntu Interpid

On Wed, Jan 21, 2009 at 3:11 PM, Marcello Romani
<mromani_at_ottotecnica.com> wrote:
> ░▒▓ ɹɐzǝupɐɥʞ ɐzɹıɯ ▓▒░ ha scritto:
>>
>> On Wed, Jan 21, 2009 at 2:15 PM, Marcello Romani
>> <mromani_at_ottotecnica.com> wrote:
>>>
>>> ░▒▓ ɹɐzǝupɐɥʞ ɐzɹıɯ ▓▒░ ha scritto:
>>>>
>>>> On Sat, Jan 17, 2009 at 3:51 AM, Chris Robertson <crobertson_at_gci.net>
>>>> wrote:
>>>>>
>>>>> ░▒▓ ɹɐzǝupɐɥʞ ɐzɹıɯ ▓▒░ wrote:
>>>>>>
>>>>>> i use crontab
>>>>>> */30 * * * * /usr/bin/sarg -f /etc/squid/sarg.conf
>>>>>>
>>>>>> but the sarg always display 2 lines
>>>>>> 16Jan2009-16Jan2009 Fri Jan 16 07:30:01 EST 2009 7 82.28M
>>>>>> 11.75M
>>>>>> 15Jan2009-16Jan2009 Fri Jan 16 06:30:12 EST 2009 98 3.44G
>>>>>> 35.13M
>>>>>> 15Jan2009-15Jan2009 Fri Jan 16 00:00:12 EST 2009 98 3.44G
>>>>>> 35.12M
>>>>>>
>>>>> This looks like you have three SARG processes running. One started at
>>>>> midnight, one at 06:30 and one at 07:30.
>>>
>>> I think that was not the output of ps ax|grep -i sarg but rather an ls...
>>>
>>>> nope
>>>> it's only one process
>>>> 0 0 * * * /usr/local/squid/sbin/squid -k rotate
>>>> */30 * * * * /usr/bin/sarg -f /etc/squid/sarg.conf
>>>>
>>>>> 1) How large is your access.log?
>>>>
>>>> -rw-r----- 1 proxy proxy 2006857 2009-01-21 08:19 access.log
>>>> -rw-r----- 1 proxy proxy 40269121 2009-01-21 06:36 access.log.1
>>>> -rw-r----- 1 proxy proxy 6799787 2009-01-20 06:39 access.log.2.gz
>>>>
>>> You specify that a new sarg process has to be started every 30 minutes.
>>> However, you have no control over how much time each sarg process needs
>>> to
>>> do its job. You could as well have some of the invocations take so long
>>> that
>>> they end their job i.e. two hours later, thus producing reports that show
>>> similar last modification times.
>>>
>>>>> 2) How often do you rotate it?
>>>>
>>>> 0 0 * * * /usr/local/squid/sbin/squid -k rotate
>>>> ---
>>>> this is my logrotate.d squid
>>>> #
>>>> # Logrotate fragment for squid.
>>>> #
>>>> /var/log/squid/*.log {
>>>> daily
>>>> compress
>>>> delaycompress
>>>> rotate 2
>>>> missingok
>>>> nocreate
>>>> sharedscripts
>>>> prerotate
>>>> test ! -x /usr/sbin/sarg-reports || /usr/sbin/sarg-reports
>>>> endscript
>>>> postrotate
>>>> test ! -e /var/run/squid.pid || /usr/sbin/squid -k rotate
>>>> endscript
>>>> }
>>>>
>>>>
>>>>
>>>>
>>>>> You are not specifying that SARG only process data for the current day,
>>>>> so
>>>>> it's working on the whole data set every time it runs.
>>>>
>>>> actually i need sarg to process every 30 minuetes
>>>>
>>> You rotate once a day but process log every 30 minutes, i.e. every 30
>>> mintes
>>> you process an entire day worth of logs.
>>> As the hours pass, every invocation of sarg needs more and more time
>>> because
>>> the access log grows as time passes.
>>> By the end of the day you could have a huge access log that needs more
>>> than
>>> 30 minutes to be fully analyzed.
>>>
>>>>
>>>>>> how to fix it ?
>>>>>> the point 15Jan2009-16Jan2009 is similar with 15Jan2009-15Jan2009
>>>>>>
>>>>>> i want to set my report
>>>>>> everyday with update every 30 min...
>>>>>>
>>>>> I run SARG on an hourly basis at a lot of my client's sites, so I tell
>>>>> it
>>>>> to
>>>>> only process the current day's reports, with a script in
>>>>> /etc/cron.hourly
>>>>> that looks like...
>>>>>
>>>>> #!/bin/bash
>>>>>
>>>>> #Get current date
>>>>> TODAY=$(date +%d/%m/%Y)
>>>>> /usr/bin/sarg -d $TODAY-$TODAY
>>>>> exit $?
>>>>>
>>>>> # End Script
>>>>>
>>>>> Chris
>>>>>
>>>>>
>>>>
>>>>
>>> HTH
>>>
>>> --
>>> Marcello Romani
>>>
>>
>> and the point is
>> if i rotate squid by the end of day
>> then i need sarg to run not 30 min but 60 min ? every 00:01 AM perhaps ?
>> if so... then the case solved
>> to prove it i need 1 day from now to test it
>>
>> thx
>> ( i hope it solved :D )
>>
>
> Maybe you could monitor how long it takes for sarg to run by touch'ing
> special named files before and after its execution, i.e.:
>
> */30 * * * * touch /tmp/sarg_start_`date +'%F %T'` && /usr/bin/sarg -f
> /etc/squid/sarg.conf && touch /tmp/sarg_end_`date +'%F %T'`
>
> ls'ing you should see start,end,start,end, etc. If the sequence is broken,
> then you have a process starting before the preceding one ends.
>
> Just my 2 cents...
>
> --
> Marcello Romani
>

-- 
-=-=-=-=
Personal Blog http://my.blog.or.id ( lagi belajar )
Hot News !!! :
Pengin punya Layanan SMS PREMIUM ?
Contact me ASAP. dapatkan Share revenue MAXIMAL tanpa syarat traffic...