2 * SARG Squid Analysis Report Generator http://sarg.sourceforge.net
6 * please look at http://sarg.sourceforge.net/donations.php
8 * http://sourceforge.net/projects/sarg/forums/forum/363374
9 * ---------------------------------------------------------------------
11 * This program is free software; you can redistribute it and/or modify
12 * it under the terms of the GNU General Public License as published by
13 * the Free Software Foundation; either version 2 of the License, or
14 * (at your option) any later version.
16 * This program is distributed in the hope that it will be useful,
17 * but WITHOUT ANY WARRANTY; without even the implied warranty of
18 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19 * GNU General Public License for more details.
21 * You should have received a copy of the GNU General Public License
22 * along with this program; if not, write to the Free Software
23 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111, USA.
27 #include "include/conf.h"
28 #include "include/defs.h"
29 #include "include/readlog.h"
32 A new file is being read. The name of the file is \a FileName.
34 static void Squid_NewFile(const char *FileName
)
39 Read one entry from a standard squid log format.
41 \param Line One line from the input log file.
42 \param Entry Where to store the information parsed from the line.
44 \retval RLRC_NoError One valid entry is parsed.
45 \retval RLRC_Unknown The line is invalid.
46 \retval RLRC_InternalError An internal error was encountered.
48 static enum ReadLogReturnCodeEnum
Squid_ReadEntry(char *Line
,struct ReadLogStruct
*Entry
)
64 while (isdigit(*Line
)) log_time
=log_time
*10+(*Line
++-'0');
65 if (*Line
!='.' || Line
==Begin
) return(RLRC_Unknown
);
67 // ignore decimal part to log time.
69 while (isdigit(*Line
)) Line
++;
70 if (*Line
!=' ' || Line
==Begin
) return(RLRC_Unknown
);
72 // skip spaces before the elapsed time.
73 while (*Line
==' ') Line
++;
75 // get the elapsed time.
77 Entry
->ElapsedTime
=0L;
81 * Negative elapsed time happens in squid (see
82 * http://www.squid-cache.org/mail-archive/squid-users/200711/0192.html)
83 * but no answer were provided as to why it happens. Let's just
84 * assume a zero elapsed time and ignore every following digit.
87 if (!isdigit(*Line
)) return(RLRC_Unknown
);
88 while (isdigit(*Line
)) Line
++;
92 if (!isdigit(*Line
)) return(RLRC_Unknown
);
93 while (isdigit(*Line
)) Entry
->ElapsedTime
=Entry
->ElapsedTime
*10+(*Line
++-'0');
95 if (*Line
!=' ' || Line
==Begin
) return(RLRC_Unknown
);
97 // get IP address. It can be a fqdn if that option is enabled in squid.
99 for (IpLen
=0 ; *Line
&& *Line
!=' ' ; IpLen
++) Line
++;
100 if (*Line
!=' ' || IpLen
==0) return(RLRC_Unknown
);
102 // get the HTTP code.
103 Entry
->HttpCode
=++Line
;
104 for (HttpCodeLen
=0 ; *Line
&& *Line
!=' ' ; HttpCodeLen
++) Line
++;
105 if (*Line
!=' ' || HttpCodeLen
==0) return(RLRC_Unknown
);
107 // get the number of transfered bytes.
110 while (isdigit(*Line
)) Entry
->DataSize
=Entry
->DataSize
*10+(*Line
++-'0');
111 if (*Line
!=' ' || Begin
==Line
) return(RLRC_Unknown
);
113 // get the HTTP method
114 Entry
->HttpMethod
=++Line
;
115 for (HttpMethodLen
=0 ; *Line
&& *Line
!=' ' ; HttpMethodLen
++) Line
++;
116 if (*Line
!=' '|| HttpMethodLen
==0) return(RLRC_Unknown
);
120 for (UrlLen
=0 ; *Line
&& *Line
!=' ' ; UrlLen
++) Line
++;
121 if (*Line
!=' ' || UrlLen
==0) return(RLRC_Unknown
);
123 // the ID of the user or - if the user is unidentified
124 Entry
->User
=User
=++Line
;
125 for (UserLen
=0 ; *Line
&& *Line
!=' ' ; UserLen
++) Line
++;
126 if (*Line
!=' ' || UserLen
==0) return(RLRC_Unknown
);
128 // now, the format is known with a good confidence. If the time doesn't decode, it is an error.
129 tt
=localtime(&log_time
);
131 debuga(__FILE__
,__LINE__
,_("Cannot convert the timestamp from the squid log file\n"));
132 return(RLRC_InternalError
);
134 memcpy(&Entry
->EntryTime
,tt
,sizeof(struct tm
));
136 // it is safe to alter the line buffer now that we are returning a valid entry
138 Entry
->HttpCode
[HttpCodeLen
]='\0';
139 Entry
->HttpMethod
[HttpMethodLen
]='\0';
140 Entry
->Url
[UrlLen
]='\0';
143 return(RLRC_NoError
);
146 //! \brief Object to read a standard squid log format.
147 const struct ReadLogProcessStruct ReadSquidLog
=
149 /* TRANSLATORS: This is the name of the log format displayed when this format is detected in an input log file. */
150 N_("squid log format"),