[squid-users] access.log squid -- httpd conversion?

I don't know if this has already been done, but I wrote a quick awk
script that converts from the native squid access.log format to the
httpd one. I noticed that there was a Perl script out there
(http://martin.gleeson.com/pwebstats/squid2common.pl) but I don't
honestly know if this is the same thing. Anyways, it'll convert from this

997720088.493 477 192.168.1.1 TCP_MISS/200 9016 GET
http://192.168.200.200/ user1 DIRECT/192.168.200.200 text/html

to this

192.168.1.1 (null) user1 [13/Aug/2001:11:28:08 -0500] "GET
http://192.168.200.200/ HTTP/1.1" 200 9016 TCP_MISS:DIRECT

The script is as follows.

#!/bin/bash

# Converts native formatted squid access log into httpd formatted.
# Only thing that is faked is the "HTTP/1.1" below (and the null).
# Otherwise all data comes from the original log and is not lost.
# Change this string if you'd like.

awk '
{
 access="HTTP/1.1";
 split($4,a,"/");
 split($9,b,"/");
 print $3" (null) "$8" [" strftime( "%d/%b/%Y:%T %z", $1 )"] \""$6" "$7"
"access"\" "a[2]" "$5" "a[1]":"b[1]
}'

exit $?

BTW, if someone could tell me what the "(null)" signifies in the httpd
log format type, then perhaps I could enter that in as well. I had a
doc open a while ago that listed it but I'd lost that since.

Peter Smith
peter.smith@utsouthwestern.edu
Received on Fri Sep 07 2001 - 08:55:49 MDT