Re-Organize Squid access log file....

harshaabba · 10-07-2011, 12:16 AM

hi all,

I need to reorganized the following squid access log file in the way I have mentioned below.Date and Time Filed merged using a colon
Eg: 03/Apr/2011:04:02:38 But I need to change this
to: 03/Apr/2011 04:02:38 , Colon should be omitted within all the file.

access.log
172.16.20.174 03/Apr/2011:04:02:38 http://www.manageengine.com/manageengine-ad.html?
172.16.20.174 03/Apr/2011:04:02:39 http://www.manageengine.com/css/advstyle.css
. . .

I need to separate the Date and Time field
New access.log
172.16.20.174 03/Apr/2011 04:02:38 http://www.manageengine.com/manageengine-ad.html?
172.16.20.174 03/Apr/2011 04:02:39 http://www.manageengine.com/css/advstyle.css
. . . .
Please help me to achieve this.

Thanks

bathory · 10-07-2011, 04:41 AM

Hi,

You need to change %tl to be %{%x}tl %{%X}tl in the logformat directive.
Search squid.conf for the access_log directive and see what logformat it uses. E.g. for common you'll see something like that:

Code:

access_log /var/log/squid/access.log common

Then go to the line that defines the logformat used (common in this case, but could be squid, squidmime or combined) and change the %tl as above, e.g.

Code:

logformat common %>a %ui %un [%{%x}tl %{%X}tl] "%rm %ru HTTP/%rv" %>Hs %<st %Ss:%Sh

Note: the above logformat is from squid 3.1.x, so your may vary a little

Regards