Loading ...
Sorry, an error occurred while loading the content.

process squid log files

Expand Messages
  • simon benedict
    hi, I have recently used webalizer to process my squid log files and there are 2 queries i want to clearify i am using the patched webalizer and when I run it
    Message 1 of 9 , May 16 1:55 AM
    • 0 Attachment

      hi,
       
      I have recently used webalizer to process my squid log files and there are 2 queries i want to clearify
       
      i am using the patched webalizer and when I run it i get the below errors . the squid access.log file size was about 9 mb
       
      1) Warning: Truncating oversized request field
      Skipping bad record (50155)
      Warning: Truncating oversized request field [50236]
      Warning: Truncating oversized request field [50915]
      Warning: Truncating oversized request field [51177]

      2) the countries option show unresolved/unknown 100 %

       

      do i need to make any changes in my squid.conf file

       

      appreciate your help

       

      thanks and regards

       

      simon

       


      Do you Yahoo!?
      SBC Yahoo! - Internet access at a great low price.

    • enventa2000
      ... Hello. ... there are 2 queries i want to clearify ... errors . the squid access.log file size was about 9 mb ... These are only warnings. You may want to
      Message 2 of 9 , May 17 7:21 AM
      • 0 Attachment
        > hi,

        Hello.

        >
        > I have recently used webalizer to process my squid log files and
        there are 2 queries i want to clearify
        >
        > i am using the patched webalizer and when I run it i get the below
        errors . the squid access.log file size was about 9 mb
        >
        > 1) Warning: Truncating oversized request field
        > Skipping bad record (50155)
        > Warning: Truncating oversized request field [50236]
        > Warning: Truncating oversized request field [50915]
        > Warning: Truncating oversized request field [51177]
        >

        These are only warnings. You may want to attempt to solve the "bad
        record" warning, because of its potencial for problems in the future.
        The number in parenthesis is the line number in the log file.

        Launch your favourite text editor and open the squid logfile. Go to
        line number 50155 and inspect the line and the lines around it. You
        will probably find a log entry cut in half, or some other strange
        thing. Delete the faulty line or correct it if you prefer so.

        The "oversized request field" are very long URLs. You can edit the
        code and increase the size of the internal fields storing the URLs,
        but notice that this will cause webalizer to increase menory usage.
        You may run out of RAM if your machine has very little memory.

        In webalizer.h you'll find a line like this:

        #define MAXURLH 128 /* Max URL field size in htab
        */

        You need to change 128 to a higher value. If you have a 32 bit
        machine, it is more efficient to increase this value in increases of
        32. Try 128+32=160 or 128+32*2=192

        #define MAXURLH 160

        You'll probably still have warnings unless you put a very high value.
        Normally those are attempts to overflow some buffer in your server, or
        some sites which have exagerately long request strings for some
        reason.

        > 2) the countries option show unresolved/unknown 100 %
        >
        >
        >
        > do i need to make any changes in my squid.conf file

        Hum, have you activated the DNS resolution in webalizer.conf? This
        line should be uncommented. No need to uncomment the DNSCache line.

        DNSChildren 10

        Also notice that you need to compile using this option in the
        "configure" script:

        make clean
        ./configure --enable-dns
        make
        make install


        Is your server capable of resolving addresses? (try executing
        "nslookup some_ip" in the command line)
      Your message has been successfully submitted and would be delivered to recipients shortly.