How to Use the SARG log analyzer on CentOS to analyze Squid logs

How to Use the SARG log analyzer on CentOS to analyze Squid logs

In the previous tutorial, we showed you how to use Squid to configure transparent proxy on CentOS. Squid provides many useful features, but it is not straightforward to analyze an original Squid log file. For example, how do you analyze the timestamp and number in the following Squid log?

1. 1404788984.4291162172.17.1.23 TCP_MISS/302436 GET http://facebook.com/-DIRECT/173.252.110.27 text/html
2. 1404788985.04612416172.17.1.23 TCP_MISS/2004169 CONNECT stats.pusher.com: 443-DIRECT/173.20.223.127-
3. 1404788986.124174102.17.1.23 TCP_MISS/200955 POST http://ocsp.digicert.com/-DIRECT/117.18.237.29 application/ocsp-response
4. 1404788989.738342172.17.1.23 TCP_MISS/2003890 CONNECT www.google.com: 443-DIRECT/74.125.200.106-
5. 1404788989.757226172.17.1.23 TCP_MISS/200942 POST http://clients1.google.com/ocsp-DIRECT/74.125.200.113 application/ocsp-response
6. 1404788990.83939172.17.1.23 TCP_MISS/20078944 CONNECT fbstatic-a.akamaihd.net: 443-DIRECT/184.26.162.35-
7. 1404788990.8462148172.17.1.23 TCP_MISS/200118947 CONNECT fbstatic-a.akamaihd.net: 443-DIRECT/184.26.162.35-
8. 1404788990.8116151172.17.1.23 TCP_MISS/20076809 CONNECT fbstatic-a.akamaihd.net: 443-DIRECT/184.26.162.35-
9. 1404788991.140611172.17.1.23 TCP_MISS/200110073 CONNECT fbstatic-a.akamaihd.net: 443-DIRECT/184.26.162.35-

We use yum to install necessary dependencies.

1. # Yum install gcc make wget httpd crond

Load necessary services at startup

1. # Service httpd start; service crond start
2. # Chkconfig httpd on; chkconfig crond on

Download and decompress the SARG

1. # Wget http://downloads.sourceforge.net/project/sarg/sarg/sarg-2.3.8/sarg-2.3.8.tar.gz?
2. # Tar zxvf sarg-2.3.8.tar.gz
3. # Cd sarg-2.3.8

Note: For 64-bit Linux, the source code of log. c must be patched with the following file.

1. 1506c1506
2. <If (fprintf (ufile-> file, "% s \ t %" PRIi64 "\ t % s \ t % ld \ t % s \ n", dia, hora, ip, url, nbytes, code, elap_time, smartfilter) <= 0 ){
3. ---
4. > If (fprintf (ufile-> file, "% s \ t %" PRIi64 "\ t % s \ t % ld \ t % s \ n", dia, hora, ip, url, (int64_t) nbytes, code, elap_time, smartfilter) <= 0 ){
5. 1513c1513
6. <Fprintf (fp_log, "% s \ t %" PRIi64 "\ t % s \ t % ld \ t % s \ n", dia, hora, user, ip, url, nbytes, code, elap_time, smartfilter );
7. ---
8. > Fprintf (fp_log, "% s \ t %" PRIi64 "\ t % s \ t % ld \ t % s \ n", dia, hora, user, ip, url, (int64_t) nbytes, code, elap_time, smartfilter );
9. 1564c1564
10. <Printf ("LEN = \ t %" PRIi64 "\ n", nbytes );
11. ---
12. > Printf ("LEN = \ t %" PRIi64 "\ n", (int64_t) nbytes );

Continue and compile/install SARG as follows

1. #./Configure
2. # Make
3. # Make install

After installing SARG, you can modify the configuration file as required. The following is an example of SARG configuration.

1. # Vim/usr/local/etc/sarg. conf

1. Access_log/var/log/squid/access. log
2. Temporary_dir/tmp
3. Output_dir/var/www/html/squid-reports
4. Date_format e # We use Europian DD-MM-YYYY format here ##
5. # We don't want multiple reports for single day/week/month ##
6. Overwrite_report yes

Now it is time to run the test. We run sarg in debug mode to check whether there is an error.

1. # Sarg-x

If I is normal, sarg generates Squid logs and creates a report under/var/www/html/squid-reports. The report can also be accessed through the address http: // <Server IP>/squid-reports/in the browser.

And SARG can be used to create daily, weekly, and monthly reports. The time range is specified by the "-d" parameter. The value may be in the form of day-n, week-n, or month-n, the value of n is the number of days, weeks, and months that have elapsed. For example, if week-1 is used, SARG will generate the report of the previous week. When day-2 is used, SARG generates a report of the previous two days.

Squid

As a demonstration, we will prepare a scheduled task to run SARG every day.

1. # Vim/etc/cron. daily/sarg

1. #! /Bin/sh
2. /Usr/local/bin/sarg-d day-1

The file requires executable permissions.

1. # Chmod 755/usr/local/bin/sarg

Now, SARG should prepare traffic reports on Squid Management every day. These reports can be easily accessed through the SARG network interface.

To sum up, SARG is a network-based tool that analyzes Squid logs and displays the analysis in more detail. The system administrator can use SARG to monitor which websites are accessed and track the most visited websites and users. This tutorial includes the configuration of SARG. You can further customize the configuration to meet your requirements.

I hope this tutorial will help you.

Sarmed Rahman

• Twitter address
• LinkedIn address

Sarmed Rahman is an IT professional in Bangladesh. He insisted on Writing technical articles from time to time and believed that technologies could be improved through sharing. In his free time, he enjoys playing games and spending time with friends.

Squid details: click here
Squid: click here

Via: http://xmodulo.com/2014/07/analyze-squid-logs-sarg-log-analyzer-centos.html

Translator: geekpi Proofreader: Caroline

This article was originally translated by LCTT and launched with the Linux honor in China