Re: [squid-users] oot: about sarg

On Wed, Jan 21, 2009 at 2:15 PM, Marcello Romani
<mromani_at_ottotecnica.com> wrote:
> ░▒▓ ɹɐzǝupɐɥʞ ɐzɹıɯ ▓▒░ ha scritto:
>>
>> On Sat, Jan 17, 2009 at 3:51 AM, Chris Robertson <crobertson_at_gci.net>
>> wrote:
>>>
>>> ░▒▓ ɹɐzǝupɐɥʞ ɐzɹıɯ ▓▒░ wrote:
>>>>
>>>> i use crontab
>>>> */30 * * * * /usr/bin/sarg -f /etc/squid/sarg.conf
>>>>
>>>> but the sarg always display 2 lines
>>>> 16Jan2009-16Jan2009 Fri Jan 16 07:30:01 EST 2009 7 82.28M
>>>> 11.75M
>>>> 15Jan2009-16Jan2009 Fri Jan 16 06:30:12 EST 2009 98 3.44G
>>>> 35.13M
>>>> 15Jan2009-15Jan2009 Fri Jan 16 00:00:12 EST 2009 98 3.44G
>>>> 35.12M
>>>>
>>> This looks like you have three SARG processes running. One started at
>>> midnight, one at 06:30 and one at 07:30.
>
> I think that was not the output of ps ax|grep -i sarg but rather an ls...
>
>>
>> nope
>> it's only one process
>> 0 0 * * * /usr/local/squid/sbin/squid -k rotate
>> */30 * * * * /usr/bin/sarg -f /etc/squid/sarg.conf
>>
>>> 1) How large is your access.log?
>>
>> -rw-r----- 1 proxy proxy 2006857 2009-01-21 08:19 access.log
>> -rw-r----- 1 proxy proxy 40269121 2009-01-21 06:36 access.log.1
>> -rw-r----- 1 proxy proxy 6799787 2009-01-20 06:39 access.log.2.gz
>>
>
> You specify that a new sarg process has to be started every 30 minutes.
> However, you have no control over how much time each sarg process needs to
> do its job. You could as well have some of the invocations take so long that
> they end their job i.e. two hours later, thus producing reports that show
> similar last modification times.
>
>>
>>> 2) How often do you rotate it?
>>
>> 0 0 * * * /usr/local/squid/sbin/squid -k rotate
>> ---
>> this is my logrotate.d squid
>> #
>> # Logrotate fragment for squid.
>> #
>> /var/log/squid/*.log {
>> daily
>> compress
>> delaycompress
>> rotate 2
>> missingok
>> nocreate
>> sharedscripts
>> prerotate
>> test ! -x /usr/sbin/sarg-reports || /usr/sbin/sarg-reports
>> endscript
>> postrotate
>> test ! -e /var/run/squid.pid || /usr/sbin/squid -k rotate
>> endscript
>> }
>>
>>
>>
>>
>>> You are not specifying that SARG only process data for the current day,
>>> so
>>> it's working on the whole data set every time it runs.
>>
>> actually i need sarg to process every 30 minuetes
>>
>
> You rotate once a day but process log every 30 minutes, i.e. every 30 mintes
> you process an entire day worth of logs.
> As the hours pass, every invocation of sarg needs more and more time because
> the access log grows as time passes.
> By the end of the day you could have a huge access log that needs more than
> 30 minutes to be fully analyzed.
>
>>
>>
>>>> how to fix it ?
>>>> the point 15Jan2009-16Jan2009 is similar with 15Jan2009-15Jan2009
>>>>
>>>> i want to set my report
>>>> everyday with update every 30 min...
>>>>
>>>
>>> I run SARG on an hourly basis at a lot of my client's sites, so I tell it
>>> to
>>> only process the current day's reports, with a script in /etc/cron.hourly
>>> that looks like...
>>>
>>> #!/bin/bash
>>>
>>> #Get current date
>>> TODAY=$(date +%d/%m/%Y)
>>> /usr/bin/sarg -d $TODAY-$TODAY
>>> exit $?
>>>
>>> # End Script
>>>
>>> Chris
>>>
>>>
>>
>>
>>
>
> HTH
>
> --
> Marcello Romani
>

and the point is
if i rotate squid by the end of day
then i need sarg to run not 30 min but 60 min ? every 00:01 AM perhaps ?
if so... then the case solved
to prove it i need 1 day from now to test it

thx
( i hope it solved :D )

-- 
-=-=-=-=
Personal Blog http://my.blog.or.id ( lagi belajar )
Hot News !!! :
Pengin punya Layanan SMS PREMIUM ?
Contact me ASAP. dapatkan Share revenue MAXIMAL tanpa syarat traffic...