Ignore negative elapsed time in squid log

Squid sometime reports a negative elapsed time. Commit d91457d25 only
improperly fixed it. The negative value was still rejected as an invalid
line.

This fix detects the negative value and ignore it.

diff --git a/readlog_squid.c b/readlog_squid.c
index 6264b1544f277299240ba03b065b7e232a471a20..4436321563ca7ff735356d54058ca79bafdf215c 100644 (file)
--- a/readlog_squid.c
+++ b/readlog_squid.c
@@ -70,12 +70,27 @@ static enum ReadLogReturnCodeEnum Squid_ReadEntry(char *Line,struct ReadLogStruc
 
        // skip spaces before the elapsed time.
        while (*Line==' ') Line++;
-       if (!isdigit(*Line)) return(RLRC_Unknown);
 
        // get the elapsed time.
        Begin=Line;
        Entry->ElapsedTime=0L;
-       while (isdigit(*Line)) Entry->ElapsedTime=Entry->ElapsedTime*10+(*Line++-'0');
+       if (*Line=='-')
+       {
+               /*
+                * Negative elapsed time happens in squid (see
+                * http://www.squid-cache.org/mail-archive/squid-users/200711/0192.html)
+                * but no answer were provided as to why it happens. Let's just
+                * assume a zero elapsed time and ignore every following digit.
+                */
+               Line++;
+               if (!isdigit(*Line)) return(RLRC_Unknown);
+               while (isdigit(*Line)) Line++;
+       }
+       else
+       {
+               if (!isdigit(*Line)) return(RLRC_Unknown);
+               while (isdigit(*Line)) Entry->ElapsedTime=Entry->ElapsedTime*10+(*Line++-'0');
+       }
        if (*Line!=' ' || Line==Begin) return(RLRC_Unknown);
 
        // get IP address. It can be a fqdn if that option is enabled in squid.