Make squidanalyser able to parse multiple access.log concatenation (timecodes not correctly sorted)

[JFRANCOI]

Hello,

I wish to squidanalyze many squid process through a single squidanalyser report. So I've used rsyslog to concatenate access.log from many squid inside a single file that's used by squidanalyzer.
The problem is squidanalyzer refuses to process because sometimes timecodes are not correclty sorted between both machines and rsyslog concentrator.

Any advise or new feature ?
Regards

[lbsou]

Hi,
I had the same problem with multiple squid instances logging to our syslog-ng server.

My fix is not perfect but get the job done

I use a regex to replace the unix time with the current unix time on syslog-ng

subst("^.{10}..{3}", "${UNIXTIME}.000", value("MESSAGE"));

I don't know if this is possible with rsyslog.

Good luck!

[darold]

This feature is now fully implemented in development code, you can give several log files or a single log file without taking care of timestamp ordering. It can also be used with multi-process (with -j option). A new release is coming.