Loading ...
Sorry, an error occurred while loading the content.

Re: process squid log files ("oversized request field" and "DNSCache")

Expand Messages
  • enventa2000
    ... Hello. ... there are 2 queries i want to clearify ... errors . the squid access.log file size was about 9 mb ... These are only warnings. You may want to
    Message 1 of 9 , May 17, 2004
    • 0 Attachment
      > hi,

      Hello.

      >
      > I have recently used webalizer to process my squid log files and
      there are 2 queries i want to clearify
      >
      > i am using the patched webalizer and when I run it i get the below
      errors . the squid access.log file size was about 9 mb
      >
      > 1) Warning: Truncating oversized request field
      > Skipping bad record (50155)
      > Warning: Truncating oversized request field [50236]
      > Warning: Truncating oversized request field [50915]
      > Warning: Truncating oversized request field [51177]
      >

      These are only warnings. You may want to attempt to solve the "bad
      record" warning, because of its potencial for problems in the future.
      The number in parenthesis is the line number in the log file.

      Launch your favourite text editor and open the squid logfile. Go to
      line number 50155 and inspect the line and the lines around it. You
      will probably find a log entry cut in half, or some other strange
      thing. Delete the faulty line or correct it if you prefer so.

      The "oversized request field" are very long URLs. You can edit the
      code and increase the size of the internal fields storing the URLs,
      but notice that this will cause webalizer to increase menory usage.
      You may run out of RAM if your machine has very little memory.

      In webalizer.h you'll find a line like this:

      #define MAXURLH 128 /* Max URL field size in htab
      */

      You need to change 128 to a higher value. If you have a 32 bit
      machine, it is more efficient to increase this value in increases of
      32. Try 128+32=160 or 128+32*2=192

      #define MAXURLH 160

      You'll probably still have warnings unless you put a very high value.
      Normally those are attempts to overflow some buffer in your server, or
      some sites which have exagerately long request strings for some
      reason.

      > 2) the countries option show unresolved/unknown 100 %
      >
      >
      >
      > do i need to make any changes in my squid.conf file

      Hum, have you activated the DNS resolution in webalizer.conf? This
      line should be uncommented. No need to uncomment the DNSCache line.

      DNSChildren 10

      Also notice that you need to compile using this option in the
      "configure" script:

      make clean
      ./configure --enable-dns
      make
      make install


      Is your server capable of resolving addresses? (try executing
      "nslookup some_ip" in the command line)
    Your message has been successfully submitted and would be delivered to recipients shortly.