up vote 0 down vote favorite
share [g+] share [fb]

We have a Squid 2.6 server running on Ubuntu 8.04. We have an SNMP monitoring software (Zabbix) that gives us almost real time graphs of our internet connection.

I have tried to use squidview to see who is abusing the network, but the "tally" mode always starts checking the log from the beginning of the logfile.

If I understood correctly, I can move to a later line in the log, and start "tally" mode from there, but it's not working. It starts from the top anyway.

Any ideas? Any other options for finding bandwidth hogs in "real time"? (it's never really real time, but close to it is enough)

Thanks!

link|improve this question
75% accept rate
feedback

2 Answers

up vote 0 down vote

I suggest using Free-SA to generate reports on your squid logs

http://free-sa.sourceforge.net/

Not exactly realtime, but you can run it on the fly and it will give you better reporting than squidview.

link|improve this answer
I'm already using SARG for reports, generating them nightly. So we do get the chance to talk to abusers the next day and "educate" them. But we need something faster than that. Squidview is supposed to be able to give "tally" for the position in the log file that you are viewing, but I can't get it to work. If I could, I can calculate it for the last 10 minutes, for example. This is SARG: sarg.sourceforge.net – UrkoM Sep 28 '10 at 3:28
then why not use free-sa / sarg on a tail -1000 of the squid log file every x minutes or similar – jamespo Sep 28 '10 at 16:17
That's actually not a bad idea at all. I'll probably use it at some point. Thanks! – UrkoM Oct 29 '10 at 1:23
feedback
up vote 0 down vote accepted

The problem was fixed after upgrading to Ubuntu 10.04 64bits. Now squidview works fine.

Here is what I do:

  • Start squidview
  • Press 'g' and enter 100 (it will take you to the last line of access.log)
  • Press 'T' and it will enter Tally mode from the point where you are. It should be "real-time", and in a few seconds it will have at the top the biggest offenders.

I'm still having some trouble, in which the left-most column does not show complete IP addresses, but so far it's not been critical.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.