From: Frederic Marchal <fmarchal@users.sourceforge.net>
Date: Thu, 5 Mar 2015 19:49:33 +0000 (+0100)
Subject: Ignore negative elapsed time in squid log
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=7ab27b70125ad1b6037c63f340b7b2b95c1dc16f;p=thirdparty%2Fsarg.git

Ignore negative elapsed time in squid log

Squid sometime reports a negative elapsed time. Commit d91457d25 only
improperly fixed it. The negative value was still rejected as an invalid
line.

This fix detects the negative value and ignore it.
---

diff --git a/readlog_squid.c b/readlog_squid.c
index 6264b15..4436321 100644
--- a/readlog_squid.c
+++ b/readlog_squid.c
@@ -70,12 +70,27 @@ static enum ReadLogReturnCodeEnum Squid_ReadEntry(char *Line,struct ReadLogStruc
 
 	// skip spaces before the elapsed time.
 	while (*Line==' ') Line++;
-	if (!isdigit(*Line)) return(RLRC_Unknown);
 
 	// get the elapsed time.
 	Begin=Line;
 	Entry->ElapsedTime=0L;
-	while (isdigit(*Line)) Entry->ElapsedTime=Entry->ElapsedTime*10+(*Line++-'0');
+	if (*Line=='-')
+	{
+		/*
+		 * Negative elapsed time happens in squid (see
+		 * http://www.squid-cache.org/mail-archive/squid-users/200711/0192.html)
+		 * but no answer were provided as to why it happens. Let's just
+		 * assume a zero elapsed time and ignore every following digit.
+		 */
+		Line++;
+		if (!isdigit(*Line)) return(RLRC_Unknown);
+		while (isdigit(*Line)) Line++;
+	}
+	else
+	{
+		if (!isdigit(*Line)) return(RLRC_Unknown);
+		while (isdigit(*Line)) Entry->ElapsedTime=Entry->ElapsedTime*10+(*Line++-'0');
+	}
 	if (*Line!=' ' || Line==Begin) return(RLRC_Unknown);
 
 	// get IP address. It can be a fqdn if that option is enabled in squid.