Re: Re: [squid-users] Help with sarg usage

I don't know if it's what you wanted, but I found a way to create reports on
historical data in logs that have been rotated:

gunzip squidlog*.gz -d -c > large.log
sarg -l ./large.log -d 01/01/2008-01/02/2008

Basically, unzipping all the logfiles (you could also just do a subset) to
STDOUT and piping that into a new log, which sarg gets pointed to with a
date range.

My user used 235M worth of bandwidth in December!

Chris Robertson-2 wrote:
>
> Richard Chapman wrote:
>> Hi Chris - and many many thanks...
>>
>> See also below.
>>
>>> You have two choices with SARG.
>>>
>>> The first is the simplest, but might not meet your needs. Make sure
>>> in your sarg.conf file the "report_type" directive includes
>>> "users_sites" and "date_time" and/or "site_user_time_date". The
>>> first will give you a listing of the sites each username/IP
>>> accessed. The second, will show bandwidth usage per hour for each
>>> username/IP (linked from the main report). The third will give you a
>>> listing of the times an individual accessed a specific website
>>> (linked from the users_sites report).
>>>
>> I have checked that these "report_types" are enabled - and can find
>> most of what you are talking about except the one I really want. The
>> thing you describe as the "second" above is exactly what I want - but:
>> The date-time reports I get don't seem to be exactly what you
>> describe. If I go to the main page, then click on the most recent
>> report I get a list of client IP addresses.
>> If I click on the "Date-Time" icon near the left of each row - I get
>> an array with hours across and dates down. Each cell contains what
>> appears to be an "elapsed time". I don't really understand what this
>> time means - but it doesn't appear to be the Bandwidth used during
>> that hour.
>
> Hmmm. The report I get when I follow the steps you described (which
> _is_ the report I was referring to) is titled "Squid User Access
> Report". It's a grid with hours for the columns header and dates for
> the rows, but it lists usage by bytes...
>
> Aha. From sarg.conf:
>
> # TAG: date_time_by bytes|elap
> # Date/Time reports will use bytes or elapsed time?
> #
>
> #date_time_by bytes
>
>> Am I in the wrong place - or am I misunderstanding something? Either
>> way - what do these "times" mean?
>
> My understanding is that this indicates the amount of time Squid spent
> processing the requests (second column of the native log format). Since
> it can service more that one request at a time, it might add up to more
> than 1 hour per hour.
>
>> Tanks Chris
>>
>> Richard.
>
> Chris
>
>

-- 
View this message in context: http://www.nabble.com/Help-with-sarg-usage-tp17847023p21339027.html
Sent from the Squid - Users mailing list archive at Nabble.com.