I have a proxy server that runs Ubuntu Server 11.10, Squid 2.7.STABLE9. I installed sarg (version 2.3.1 Sep-18-2010) to generate reports using the ordinary apt-get install, and added a cron job to generate a report of the day every 5 minutes (that will overwrite the 5-minutes-older one):

*/5 * * * * /root/proxy_report.sh

And the content of /root/proxy_report.sh is:

/usr/bin/sarg -nd `date +"%d/%m/%Y"` > /dev/null 2>&1

And I added another cron job to generate a full report every hour at :32 (not to collide with the 5 minutes job):

*/32 * * * * /root/proxy_report_full.sh

And the content of /root/proxy_report_full.sh is :

/usr/bin/sarg -n > /dev/null 2>&1

And I added a small script to remove the yesterday full report (the full report that ends in yesterday that won't be overwritten by the new today full report) in /etc/rc.local to run at startup:

/usr/bin/rm_yesterday.sh &>> /var/log/rm_yesterday

Where /usr/bin/rm_yesterday.sh:

find /var/www/sarg/ | grep `date -d Apr1 +"%Y%b%d"`-* | grep -v `date +"%Y%b%d"` | xargs rm -rf

* Apr1 is the starting date of the proxy...

** I've placed it in /usr/bin to be mounted early at startup...

That arrangement went OK for about a month and a half, except for one time I noticed some errors and reports wasn't generated, and fixed that by making an offset (the two minutes in 32 of the second cron job). However, it then started not to generate reports anymore. By manually trying to generate it it gives the following error:

root@proxy-server:~# sarg -n
SARG: getword_atoll loop detected after 3 bytes.
SARG: Line="154 TCP_MISS/200 39 CONNECT www.google.com"
SARG: Record="154 TCP_MISS/200 39 CONNECT www.google.com"
SARG: searching for 'x2f'
SARG: getword backtrace:
SARG: 1:sarg() [0x8050a4a]
SARG: 2:sarg() [0x8050c8b]
SARG: 3:sarg() [0x804fc2e]
SARG: 4:/lib/i386-linux-gnu/libc.so.6(__libc_start_main+0xf3) [0x129113]
SARG: 5:sarg() [0x80501c9]
SARG: Maybe you have a broken date in your /var/log/squid/access.log file

When I looked to /var/log/squid/ folder, I noticed that it contains some rotated logs:

root@proxy-server:~# ls /var/log/squid/
access.log  access.log.1  cache.log  cache.log.1  store.log  store.log.1

So maybe sarg installed logrotate with it? Or it comes with the standard Ubuntu? I don't remember I installed it manuallly.

The question is: What could've gone wrong? Does it have something to do with rotating the log? How can I trace the error and start generating reports again?

  • logrotate is installed by default on ubuntu. Squid probably provides the necessary logrotation per default, have a look in /etc/logrotate.d Jun 26, 2012 at 9:20
  • @Ulrich yes I found the squid script. But can this be a problem -to rotate logs? can sarg understand the rotated log?
    – amyassin
    Jun 26, 2012 at 9:28
  • I don't know sarg so i can't answer it but it seems it has a problem with your access.log. Try to use ltrace or strace to debug your problem Jun 26, 2012 at 9:31
  • 1
    i just googled and yes the logrotation seems to be the problem - bugs.debian.org/cgi-bin/bugreport.cgi?bug=369693 and bugs.launchpad.net/ubuntu/+source/squid/+bug/268816 Jun 26, 2012 at 9:33
  • For 32-minutes-past-the-hour, wouldn't the minute field be 32 instead of */32, which as I understand it would mean "every 32 minutes", which could potentially confuse the cron daemon.
    – killermist
    Jul 8, 2012 at 21:37

1 Answer 1


First of all i don't know sarg but it seems that the problem is caused by your logfile. This could be caused by two things:

  1. Random characters / binary data / changed log format of your squid configuration
  2. sarg may have a problem with log files rotated by logrotate

Based on http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=369693 as well as https://bugs.launchpad.net/ubuntu/+source/squid/+bug/268816 i think the problem may be caused by logrotate.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .