Topic: How to interpret the date part of the Squid access log?

[tonysmith47]

I am in the unhappy position of having to "read the riot Act" to some staff who are doing the wrong thing with the internet access provided to them.

The access log of course looks like this:-
1074371567.007   1362 192.120.0.159 TCP_MISS/500 418 GET http://tuner.imband.com/tuner/GetVersionInfo? - DIRECT/208.184.122.40 -

It is the first bit, which is obviously some sort of date/time satamp that I need to decode to a normal gregorian date/time....

I thought (dumbly) that this was a simple julian date, but there are way too many digits/


Help please.....

I'd appreciate direct mail to laptop@tonsyl.org as well as posts here.


Thanks


Tony Smith

[Anonymous]

First of all, you have to create a simple perl file with the following text:
=============================
#! /usr/bin/perl -p
s/^\d+\.\d+/localtime $&/e;
=============================
name the file as timeconvert.pl

Then from the command line, issue the following order:

cat /var/log/squid/access.log | /timeconvert.pl > /var/log/squid/access-01-24.log

This will convert the dates and creates a new file with the name access-01-24.log

Regards,
Samer Pharaon

[kozel]

thanks, I guess I should have searched first.