为了让awstats分析squid的日志,我们要修改一下它的日志格式.我们先看看squid的默认格式和解释吧.

logformat squid  %ts.%03tu %6tr %>a %Ss/%03Hs %<st %rm %ru %un %Sh/%<A %mt

解释如下:
Seconds since epoch; subsecond time (milliseconds);  Response time (milliseconds); Client source IP address;  Squid request status (TCP_MISS etc); HTTP status code; Reply size including HTTP headers;  Request method (GET/POST etc) ; Request URL;  User name;  Squid hierarchy status (DEFAULT_PARENT etc);  Client FQDN;  MIME content type

下面看看要怎么样修改,awstats才能认识和分析squid的日志

 

squid： /etc/squid/squid.conf
代码:

logformat combined %>a %ui %un [%tl] "%rm %ru HTTP/%rv" %Hs %<st "%{Referer}>h" "%{User-Agent}>h" %Ss:%Sh %{host}>h
access_log /var/log/squid/access.log combined

awstats: /etc/awstats/awstats.conf.local
代码:

LogFormat = "%host %other %logname %time1 %methodurl %code %bytesd %refererquot %uaquot %other %virtualname"
LogFile="/var/log/squid/access.log"

关键点： squid 的日志需要加上虚拟主机名： %{host}>h awstats的读取参数指出 %virtualname 还有一种方法，我觉得也是比较理想的，直接修改apache的日志格式：

原：
#LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined

修改为：
LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\""combined

这样也可以将apache的日志转为正常的日志。
 

RSS 2.0 | leave a response | trackback