Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a proxy server that runs Ubuntu Server 11.10, Squid 2.7.STABLE9. I installed sarg (version 2.3.1 Sep-18-2010) to generate reports using the ordinary apt-get install, and added a cron job to generate a report of the day every 5 minutes (that will overwrite the 5-minutes-older one):

*/5 * * * * /root/proxy_report.sh

And the content of /root/proxy_report.sh is:

/usr/bin/sarg -nd `date +"%d/%m/%Y"` > /dev/null 2>&1

And I added another cron job to generate a full report every hour at :32 (not to collide with the 5 minutes job):

*/32 * * * * /root/proxy_report_full.sh

And the content of /root/proxy_report_full.sh is :

/usr/bin/sarg -n > /dev/null 2>&1

And I added a small script to remove the yesterday full report (the full report that ends in yesterday that won't be overwritten by the new today full report) in /etc/rc.local to run at startup:

/usr/bin/rm_yesterday.sh &>> /var/log/rm_yesterday

Where /usr/bin/rm_yesterday.sh:

find /var/www/sarg/ | grep `date -d Apr1 +"%Y%b%d"`-* | grep -v `date +"%Y%b%d"` | xargs rm -rf

* Apr1 is the starting date of the proxy...

** I've placed it in /usr/bin to be mounted early at startup...

That arrangement went OK for about a month and a half, except for one time I noticed some errors and reports wasn't generated, and fixed that by making an offset (the two minutes in 32 of the second cron job). However, it then started not to generate reports anymore. By manually trying to generate it it gives the following error:

root@proxy-server:~# sarg -n
SARG: getword_atoll loop detected after 3 bytes.
SARG: Line="154 TCP_MISS/200 39 CONNECT www.google.com"
SARG: Record="154 TCP_MISS/200 39 CONNECT www.google.com"
SARG: searching for 'x2f'
SARG: getword backtrace:
SARG: 1:sarg() [0x8050a4a]
SARG: 2:sarg() [0x8050c8b]
SARG: 3:sarg() [0x804fc2e]
SARG: 4:/lib/i386-linux-gnu/libc.so.6(__libc_start_main+0xf3) [0x129113]
SARG: 5:sarg() [0x80501c9]
SARG: Maybe you have a broken date in your /var/log/squid/access.log file

When I looked to /var/log/squid/ folder, I noticed that it contains some rotated logs:

root@proxy-server:~# ls /var/log/squid/
access.log  access.log.1  cache.log  cache.log.1  store.log  store.log.1

So maybe sarg installed logrotate with it? Or it comes with the standard Ubuntu? I don't remember I installed it manuallly.

The question is: What could've gone wrong? Does it have something to do with rotating the log? How can I trace the error and start generating reports again?

share|improve this question

migrated from serverfault.com Jun 21 '12 at 6:03

This question came from our site for system and network administrators.

logrotate is installed by default on ubuntu. Squid probably provides the necessary logrotation per default, have a look in /etc/logrotate.d – Ulrich Dangel Jun 26 '12 at 9:20
@Ulrich yes I found the squid script. But can this be a problem -to rotate logs? can sarg understand the rotated log? – amyassin Jun 26 '12 at 9:28
I don't know sarg so i can't answer it but it seems it has a problem with your access.log. Try to use ltrace or strace to debug your problem – Ulrich Dangel Jun 26 '12 at 9:31
i just googled and yes the logrotation seems to be the problem - bugs.debian.org/cgi-bin/bugreport.cgi?bug=369693 and bugs.launchpad.net/ubuntu/+source/squid/+bug/268816 – Ulrich Dangel Jun 26 '12 at 9:33
For 32-minutes-past-the-hour, wouldn't the minute field be 32 instead of */32, which as I understand it would mean "every 32 minutes", which could potentially confuse the cron daemon. – killermist Jul 8 '12 at 21:37
up vote 1 down vote accepted

First of all i don't know sarg but it seems that the problem is caused by your logfile. This could be caused by two things:

  1. Random characters / binary data / changed log format of your squid configuration
  2. sarg may have a problem with log files rotated by logrotate

Based on http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=369693 as well as https://bugs.launchpad.net/ubuntu/+source/squid/+bug/268816 i think the problem may be caused by logrotate.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.