44.15. Analyzing the Squid Logs

Calamaris is a simple Perl program that can generate a report from your Squid log files. If you have it installed, the Calamaris Log Analysis icon will appear on the module's main page. If not, you will need to download and install it separately, as it is not included with Squid. Some Linux distributions have a separate package for it, which can be easily installed using the Software Packages module. If not, the program can be downloaded from calamaris.cord.de/, compiled, and installed.

Clicking on the icon triggers the generation of a report from all of your Squid access logs. By default, only the last 50000 entries are processed to avoid putting undue load on the system. However, this can be adjusted on the Module Config page (as explained in Section 44.17 “Configuring the Squid Proxy Server Module”). When the report is complete, it will be displayed in your browser as a single HTML page. At the top are links to tables lower down on the page that contain summaries such as requests by host, by destination domain, and by cache hit status.

Even if you have log rotation enabled on your system to periodically rename and compress the Squid logs, the module will still include the compressed data in the report. It looks for all files in the log directory whose names start with access.log (such as access.log.02.gz) and decompresses them if necessary before feeding them to Calamaris. The newest files are always processed first, however, so that any log lines limit in force cuts off older entries rather than newer ones.

The Webalizer Logfile Analysis module (covered in Chapter 39) can also be used to generate more impressive reports, containing graphs and pie charts from the squid logs. The module can even recreate a report on schedule (such as daily) and have it written to a directory for later viewing.