Koozali.org: home of the SME Server

Legacy Forums => General Discussion (Legacy) => Topic started by: tonysmith47 on January 23, 2004, 04:20:44 AM

Title: How to interpret the date part of the Squid access log?
Post by: tonysmith47 on January 23, 2004, 04:20:44 AM

I am in the unhappy position of having to "read the riot Act" to some staff who are doing the wrong thing with the internet access provided to them.

The access log of course looks like this:-
1074371567.007   1362 192.120.0.159 TCP_MISS/500 418 GET http://tuner.imband.com/tuner/GetVersionInfo? - DIRECT/208.184.122.40 -

It is the first bit, which is obviously some sort of date/time satamp that I need to decode to a normal gregorian date/time....

I thought (dumbly) that this was a simple julian date, but there are way too many digits/


Help please.....

I'd appreciate direct mail to laptop@tonsyl.org as well as posts here.


Thanks


Tony Smith

Title: Re: How to interpret the date part of the Squid access log?
Post by: Anonymous on January 24, 2004, 04:47:11 PM

First of all, you have to create a simple perl file with the following text:
=============================
#! /usr/bin/perl -p
s/^\d+\.\d+/localtime $&/e;
=============================
name the file as timeconvert.pl

Then from the command line, issue the following order:

cat /var/log/squid/access.log | /timeconvert.pl > /var/log/squid/access-01-24.log

This will convert the dates and creates a new file with the name access-01-24.log

Regards,
Samer Pharaon

Title: How to interpret the date part of the Squid access log?
Post by: kozel on August 09, 2004, 07:57:14 PM

thanks, I guess I should have searched first.