Re: [squid-users] Squid Activity/Usage and Reporting Tools

Jim asked:
> That worked great: grep " http://www.website.net" access.log | tr -s ' ' |
> cut -d' ' -f3 | sort -n | uniq > /filename
> What is the best way to add to this a number next to each IP of the amount
> of times a particular site was contacted, and the date of last contact?

For anything more complicated than the excellent stuff you've been given so
far, I'd use perl. Here is my own poorly written snippet that shows how
many hits per IP have gone to that site. I'm sure it's not the best code
but I use hashes to count things a lot and find it works well enough:

#!/usr/local/bin/perl -w
use strict;

my %match_hash;
my $proxlog="/tmp/access.log";
my $pattern=www.att.net;

open(LOG,$proxlog) || die "cannot open $proxlog: $!";

while ( <LOG> ) {
       next unless
/^\S+?\s+?\d+?\s+?(\S+?)\s+?\S+?\s+?\d+?\s+?\S+?\s+?http:\/\/$pattern/oi;
              $match_hash{$1}++;
}
close(LOG);

print "Totals for each user going to site $pattern:\n";
foreach(sort byval keys %match_hash) {
print "$_ $match_hash{$_}\n";
}

sub byval { $match_hash{$b} <=> $match_hash{$a}; }

Output will look something like this:
$ ./jim.pl | more
Totals for each user going to site www.att.net:
192.168.8.156 879
192.168.8.196 400
192.168.8.90 150
192.168.8.5 84
192.168.8.37 75
192.168.8.220 8
192.168.8.239 6

hth

Adam
Received on Fri Aug 01 2003 - 15:20:17 MDT