Best squid's log analyzer??

Bash[DevNull] · Guru Joined: 10 Oct 2003 Posts: 333

What are you thinking about? Wich one is best? I don't know what to install in my box

_________________
Biomechanical Artificial Sabotage Humanoid

Spooky Ghost · Posted: Wed Dec 17, 2003 10:21 am Post subject:

I'm using calamaris from portage and that works well for my purposes. I've got a cron job that runs it every night and produces a few HTML reports and there are plenty of options to choose from. There's no support for pretty graphs, but the information is easy to read. If you're looking for more real time information perhaps you might look at the SNMP support that squid has, but I've never used that so can't really comment.

UberLord · Posted: Wed Dec 17, 2003 10:51 am Post subject:

ACID is good.

It's not in portage, but it does do pretty graphs.

However, it requires a web server, mysql and snort configured to log to mysql

b0fh · Guru Joined: 16 Jun 2003 Posts: 426

*push*

Any other good tools for squid graphing? I've tried "squid-graph" from portage, but it seems it can just plot for the period of one day...

redalert_007 · n00b Joined: 06 Mar 2004 Posts: 12

ACID????

Acid it's a console for SNORT (IDS)...nothing to do with Squid Logs...

Well.. For me it's SARG.
http://sarg.sourceforge.net/
Using from 2001, and no problems.

deoren · Apprentice Joined: 23 Dec 2004 Posts: 227 Location: USA

This is an old thread but I began looking today for the same reason you asked the question: Which really is better?
Hopefully these notes will help someone.

My primary requirement is reporting based on user id. I've found several which do this:

squint looks like it would do well for getting the top 10 users and not much else (light research)

lightsquid is a cgi script for generating detailed reports.

squidARG is not pretty, but you have a lot of different reports generated from your logs which are
all VERY detailed. Unfortunately it looks like it runs on a Windows box.

I could see setting up a daily script to download the log files from a GNU box and process them, but that is just added hassle.

Sarg is written in C (speed!) and it's reports are more than adequate. I will likely go with it for detailed reports and use squint to get a quick "top 10" view of usage patterns.

For overall reporting, v3 of calamaris with it's ability to generate graphs will likely give it a place among the trial runs we'll do.