兩款不錯的 Squid Logfile 分析軟體

兩款不錯的 Squid Logfile 分析軟體
雖然SARG 的資料很詳細, 可惜它並不適合拿來做即時分析報表, 無法即時掌握使用者的動向. 在Squid: Logfile Analysis 眾多的分析軟體中找了老半天, 終於發現了這兩個不錯的工具:
MySAR (處理頻率: 每分鐘一次)squidview (處理頻率: 即時)
並將安裝過程與操作備忘記錄如下:
在 Fedora Core 3 安裝 MySQL Squid Access Report (MySAR) 使用 squidview 在終端視窗 (terminal console) 即時監看 Squid Log
>>>在 Fedora Core 3 安裝 MySQL Squid Access Report (MySAR)
預設環境
squid-2.5.stable php-4.3.11 mysql-3.23.58 mysql-server-3.23.58 mysql-devel-3.23.58 glibc-2.3.5 php-mysql-4.3.11
昇級 MySQL 至 4.1.16 版
http://www.mysql.com/ -> Downloads -> MySQL 4.1 ->
Linux x86 generic RPM downloads ->
Server (MySQL-server-4.1.16-0.glibc23.i386.rpm) Client programs (MySQL-client-4.1.16-0.glibc23.i386.rpm) Libraries and header files (MySQL-devel-4.1.16-0.glibc23.i386.rpm)
Linux x86 generic RPM (statically linked against glibc2.2.5) downloads ->
Dynamic client libraries (including 3.23.x libraries) (MySQL-shared-compat-4.1.16-0.i386.rpm)
rpm -Uvh --nodeps MySQL*.rpm
service httpd restart
安裝 MySAR
連結:MySAR 官方網頁
wgethttp://nchc.dl.sourceforge.net/sourceforge/mysar/mysar-2.0.4.tar.gz
tar -zxf mysar-2.0.4.tar.gz -C /usr/local
cd /usr/local/mysar/etc
wgethttp://cha.homeip.net/blog/archives/mysar.sql.204 (原本的 mysar.sql 不完整, 請自本站下載修正後的 sql 檔)
mysql -u root -p < mysar.sql.204
vi config.ini -> 將 dbName = mysar2 改成 dbName = mysar
vi mysar.cron -> 將 ...maintenance.php /usr/local... 修正為: ...maintenance.php > /usr/local...
chown root:root mysar.cron
ln -s /usr/local/mysar/etc/mysar.cron /etc/cron.d/mysar
ln -s /usr/local/mysar/etc/mysar.apache /etc/httpd/conf.d/mysar.conf
service httpd reload
連入 MySAR Web 畫面
啟動瀏覽器 -> http://linux.host.ip.addr/mysar/
2005.12.27 補充
由於 MySQL 4.1.16 使用了新的密碼加密方式, 而 MySQL-shared-compat-4.1.16 仍使用舊版 (libmysqlclient.so.10) 的函式庫, 如果使用者密碼在 MySQL 4.1.16 的環境下建立, PHP 連結到新版 MySQL 的時候會出現: mysql_connect(): Client does not support authentication protocol requested by server; consider upgrading MySQL client 的錯誤訊息. 此時只要以 root 登入 MySQL, 將 mysql 資料庫裡的 user table 的使用者密碼用 old_password() 函數設定過即可. 如: update user set password=old_password(‘mysar‘) where user=‘mysar‘;
前述 mysar.sql.204 已修正 password() 函數為 old_password(), 能在 MySQL 4.1.16 + MySQL-shared-compat-4.1.16 的情況正常使用.
>>>使用 squidview 在終端視窗 (terminal console) 即時監看 Squid Log
連結:squidview 官方網頁
安裝過程:
cd /usr/local/src
wgethttp://www.rillion.net/squidview/squidview-0.69.tar.gz
tar -zxf squidview-0.69.tar.gz
cd squidview-0.69
./configure
make
make install
squidview (測試是否能正常執行)
cd ~/.squidview/
cat -n /etc/hosts (查看 /etc/hosts 內容, 引用其中 client host 資料, 以產生 aliases 檔案)
1  # Do not remove the following line, or various programs
2  # that require network functionality will fail.
3  127.0.0.1            localhost.localdomain localhost
4
5  192.168.0.100    Andy
6  192.168.0.101    Benny
7  192.168.0.102    Catherine
.
.
.
tail +5 /etc/hosts | cut -f 1,3 | awk ‘BEGIN{FS="\t"}{print $2 " " $1}‘ > aliases (註1)
squidview
c (進入設定選單)
a (use alias file to map IPs to names: yes --> 改成 yes 可對照 aliases 檔案顯示 client host name)
q (離開設定選單)
註1: tail +5 /etc/hosts ==> 從第五列開始到最後一列
cut -f 1,3 ==> 以 Tab 為分格, 取出第一欄和第三欄
awk ‘BEGIN{FS="\t"}{print $2 " " $1}‘ ==> 以 Tab 為分格, 印出第二欄 + 一個空白字元 + 第一欄
註2: aliases 檔案格式為 hostname (空格) ip_address, 如: Andy 192.168.0.100
相關網頁
Linux NAT + Squid + SARG 製作使用者上網記錄報表Squid: Logfile Analysis
--- 2006.01.20 補充:
讓 MySAR 自動更新網頁的方法:
vi /usr/local/mysar/smarty-tmp/*header.tpl.php
在第一個 meta 標籤底下加入:

Posted by Jamyy at 2005年12月16日 15:14
Trackback Pings
TrackBack URL for this entry:
http://cha.homeip.net/cgi-bin/mt/mt-tb.cgi/151
Comments
你好 請教一下 我依照你的方法
結果出現
Notice: Undefined index: hostiplong in /usr/local/mysar/www/index.php on line 77
Notice: Undefined index: sitesID in /usr/local/mysar/www/index.php on line 82
Notice: Undefined index: usersID in /usr/local/mysar/www/index.php on line 89
Notice: Undefined index: usersID in /usr/local/mysar/www/index.php on line 90
Notice: Undefined index: action in /usr/local/mysar/www/index.php on line 92
Notice: Undefined index: a in /usr/local/mysar/www/index.php on line 96
Notice: Undefined variable: newQueryString in /usr/local/mysar/inc/functions.inc.php on line 361
Notice: Undefined variable: foundParameter in /usr/local/mysar/inc/functions.inc.php on line 364
Notice: Undefined variable: newQueryString in /usr/local/mysar/inc/functions.inc.php on line 361
Notice: Undefined variable: foundParameter in /usr/local/mysar/inc/functions.inc.php on line 364
Notice: Undefined variable: newQueryString in /usr/local/mysar/inc/functions.inc.php on line 361
Notice: Undefined variable: foundParameter in /usr/local/mysar/inc/functions.inc.php on line 364
Notice: Undefined variable: newQueryString in /usr/local/mysar/inc/functions.inc.php on line 361
Notice: Undefined variable: foundParameter in /usr/local/mysar/inc/functions.inc.php on line 364
Notice: Undefined variable: newQueryString in /usr/local/mysar/inc/functions.inc.php on line 361
Notice: Undefined variable: foundParameter in /usr/local/mysar/inc/functions.inc.php on line 364
Notice: Undefined variable: newQueryString in /usr/local/mysar/inc/functions.inc.php on line 361
Notice: Undefined variable: foundParameter in /usr/local/mysar/inc/functions.inc.php on line 364
Notice: Undefined variable: newQueryString in /usr/local/mysar/inc/functions.inc.php on line 361
Notice: Undefined variable: foundParameter in /usr/local/mysar/inc/functions.inc.php on line 364
Notice: Undefined variable: newQueryString in /usr/local/mysar/inc/functions.inc.php on line 361
Notice: Undefined variable: foundParameter in /usr/local/mysar/inc/functions.inc.php on line 364
Notice: Undefined variable: newQueryString in /usr/local/mysar/inc/functions.inc.php on line 361
Notice: Undefined variable: foundParameter in /usr/local/mysar/inc/functions.inc.php on line 364
Notice: Undefined variable: newQueryString in /usr/local/mysar/inc/functions.inc.php on line 361
Notice: Undefined variable: foundParameter in /usr/local/mysar/inc/functions.inc.php on line 364
Notice: Undefined variable: newQueryString in /usr/local/mysar/inc/functions.inc.php on line 361
Notice: Undefined variable: foundParameter in /usr/local/mysar/inc/functions.inc.php on line 364
Notice: Undefined variable: newQueryString in /usr/local/mysar/inc/functions.inc.php on line 361
Notice: Undefined variable: foundParameter in /usr/local/mysar/inc/functions.inc.php on line 364
在首頁上方 且 我有把access路徑改到正確的位置
可是 他都沒有資料出現 可否方便幫我解惑一下 謝謝!!
Posted by: soda at 2006年08月17日 20:12
我剛剛在一台從未灌過 MySAR 的 Fedora Core 3 電腦上安裝最新版本的 MySAR (v2.0.11)
發現它比 2.0.4 更好安裝, 不用像這篇寫的那麼麻煩, 強烈推薦您使用新版的 MySAR.
以下是在 Fedora Core 3 安裝 MySAR 2.0.11 過程:
1. 昇級 MySQL 到 4.1.16 版
2. 下載 MySAR 2.0.11
3. tar zxf mysar-2.0.11.tar.gz -C /usr/local
4. vi /etc/httpd/conf/httpd.conf
加入:
Alias /mysar /usr/local/mysar/www

Order deny,allow
Deny from all
Allow from your.lan.network/24

5. /etc/init.d/httpd reload
6. 用瀏覽器連到 http://your.linux.host.ip/mysar 即可進行安裝設定, 過程中都照著畫面指示即可
7. 將 mysar 排入 crond 排程:
方法1: ln -s /usr/local/mysar/etc/mysar.cron /etc/cron.d/mysar
方法2: cat /usr/local/mysar/etc/mysar.cron >> /etc/crontab
此外, 要讓 PHP 網頁不顯示 Notice 訊息, 可 vi /etc/php.ini
讓 error_reporting = E_ALL & ~E_NOTICE 就行了
Posted by: Jamyy at 2006年08月17日 23:42
感謝你的寶貴資料, 本人最近也在安裝 MySAR (因 SARG 的記錄快要灌爆我的硬碟=_=‘), 但網路上的資料真的很少, 現在終於能夠將記錄灌進 MySQL 了。
Posted by: Ronald at 2006年09月14日 11:31
U‘r welcome :)
Posted by: Jamyy at 2006年09月14日 13:09
有沒有window2000伺服器可用的分析軟體
104搜尋引擎-http://www.104search.com.tw
香港酒店-http://www.hong-kong-hotel.hk
Posted by:sam at 2007年01月04日 16:35
您指的是 Squid for Windows 嗎?
(http://www.acmeconsulting.it/SquidNT.html)
如果是的話, 該網頁就有提供 Windows Log Analysis Software 囉~
Posted by: Jamyy at 2007年01月08日 15:47
from: http://cha.homeip.net/blog/archives/2005/12/_squid_logfile.html#more