Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Can anyone recommend me a good tool for analyzing squid logs ?

I'm currently using SARG. Is there something better?
I need to easily see what sites were visited/denied, when and by whom.

There is a list of squid analyzers. Some of them seem to be out of date.
Squid: Logfile Analysis

share|improve this question
add comment

7 Answers

up vote 7 down vote accepted

I used LightSquid: http://lightsquid.sourceforge.net/ It was good enough for me for several reasons:

  • It is fast, takes very little diskspace (In comparison with SARG, only ~45Kb of Perl scripts)
  • There is nothing superfluous

You can try it, using online-demo: http://lightsquid.sourceforge.net/demo17/index.cgi?year=2005&month=04

"Official" feauture-list:

  • fast and simple install fast log
  • parser generatesmall per user data
  • file perl based cgi script for
  • dynamic generated report pages html
  • template for design no database
  • required no additional perl module
  • various reports user groups support
  • graphics report (v 1.6+) real name
  • (v 1.6+) multilangual interface
share|improve this answer
    
Is it still active? No update on website nor sourcecode since 2009. –  Eric DANNIELOU Dec 14 '12 at 10:15
    
Seems like the project is frozen since then. –  Alexey Shatygin Dec 31 '12 at 11:47
add comment

Calamaris might provide what you're looking for. Handles many different types of logs, including squid.

share|improve this answer
add comment

Lire proved very handy when I needed to analyse logs for mail, http, ftp etc. I see that it comes with Squid converters in the Ubuntu package so it might be worth a try.

share|improve this answer
add comment

Mysar is a project that loads the squid logs into a mySQL database, and then runs a nice PHP interface. We just started using it a work and I have to admit I'm impressed. It is not very very difficult to install but it does require some cron jobs.

I'm not sure if the project is under active development or not, but it does a good job of loading the logs into mysql where they are easy to play with. We are looking into extending it to fit our situation a little better.

If you have any specific questions about it feel free to ask.

Chance

share|improve this answer
    
Unfortunately, MYSAR appears to be abandoned. –  kce Mar 23 '12 at 20:55
add comment

I use Free-SA which is similar to SARG but much faster and doesn't crash on huge log files. It works very well.

"Free-SA is statistic analyzer for daemons log files similar to SARG. Its main advantages over SARG are much better speed (7x-20x times), more reports support, crossplatform work and W3C compliance of generated HTML/CSS reports code."

share|improve this answer
    
I have managed to install this, and it looks great. Do you have any links to help on setting up cron tasks for it? –  UrkoM Mar 20 '12 at 1:37
add comment

I use sarg, but for personal use i use sqview (http://github.com/mezgani/sqview/tree/master), and sometimes awk scripting that is very useful.

share|improve this answer
add comment

If you are looking for a security log analyzer, you will like OSSEC. It monitors the logs looking for multiple 404s, 500s, worm actions, etc. Great to detect internal compromises.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.