Re: [squid-users] Squid log formats - 2.5->2.6?

On Tue, 17 Jun 2008 00:26:41 +0200, Henrik Nordstrom wrote
> On mån, 2008-06-16 at 11:21 -0400, Mike Diggins wrote:
> > Has something changed in the access log format between Squid 2.5Stable14
> > and 2.6Stable20? I'm just upgrading and noticed my webalizer can no
longer
> > parse the access.log file. It complains about the date which I believe is
> > the same on both (seconds since the Epoch).
> >
> > Error: Skipping record (bad date): [31/dec/1969:19:00:00 -0000] [68]
> >
> > In squid 2.6, I've picked the default squid format (logformat):
> >
> > logformat squid %ts.%03tu %6tr %>a %Ss/%03Hs %<st %rm %ru %un %Sh/%<A %mt
>
> Should work.
>
> Are you sure you told webalizer to parse a Squid access log in Squid
> native format, and not a common log format?
>
> Also try without the logformat directive. The "squid" format is
> built-in, and may differ sligtly if you redefine it with a logformat
> directive..
>
> Regards
> Henrik

Greetings all!

To quickly chime in, I had a very similar problem and it turned out to be my
squid.conf file and the:
logformat squid %ts.%03tu %6tr %>a %Ss/%03Hs %<st %rm %ru %un %Sh/%<A %mt

line. Believe it or not, there was a SPACE between 'squid' and '%ts' and the
result was a SPACE in the logs before the date started showing. Made me nuts
too until I started digging and on a lark, saw it, removed the space and it
started working again. I did not report it mainly because I had not seen any
others mentioning it, and figured it was some bonehead thing I did! Could
still be, of course.
Hopefully this may be your problem also. And hope it helps if it is!

Regards,
JPP

--
FRWS WebMail (http://www.frws.com)
Cause you deserve Spam and Virus free email...