SARG(1)
NAME
sarg - Squid Analysis Report Generator
SYNOPSIS
sarg [options] logfile...
DESCRIPTION
sarg is a logfile parser and analyzer for the Squid Web Proxy Cache,
which can be found at http://www.squid-cache.org/. This manual page
documents briefly the sarg command. More information is available at
http://sarg.sourceforge.net/. This manual page was originally written
for the Debian distribution because the author didn't include one in
favor of documentation in the GNU Info format; see below.
sarg is a tool that allows you to view "where" your users are going to
on the Internet. sarg generates reports in HTML, with fields such as:
users, IP Addresses, bytes, sites, and times. These HTML files can
appear in your web server's directory for browsing by users or administrators. You may also have sarg email the reports to the Squid Cache
administrator.
sarg can read squid or Microsoft ISA access logs. Optionally, it can complement the reports with the log of a Squid filter/redirector such as squidGuard (http://www.squidguard.org/).
OPTIONS
A summary of options is included below.
-h Show summary of options.
- -a [hostname|ip address]
- Limits report to records containing the specified hostname/ip address
- -b filename
- Enables UserAgent log and writes it to filename.
- -c filename
- Uses filename as the exclude files to select records that are not counted.
- --convert
- Convert a squid log file date/time field to a human-readable format. All the log files are read and output as one text on the standard output.
- --css Output, on the standard output, the internal css inlined in the
- reports by sarg. You can redirect the output to a file of your choice and edit it. Then you can override the internal css with external_css_file in sarg.conf.
- -d date
- Uses date as the time limit during log file processing. Format for date is dd/mm/yyyy-dd/mm/yyyy or a single date dd/mm/yyyy. Date ranges can also be specified as day-n, week-n, or month-n where n is the number of days, weeks or months to jump backward. Note that there is no spaces around the hyphen.
- -e email
- Sends report to email (stdout for console).
- -f filename
- Reads configuration from filename.
- -g e|u Sets date format in generated reports.
- e = Europe -> dd/mm/yy
u = USA -> mm/dd/yy - -i Generates reports by user and ip address.
- NOTE: This requires the 'report_type' option in config file to contain "users_sites".
- -l filename
- Uses filename as the input log. This option can be repeated up to 255 times to read multiple files. If the files end with the extension .gz, .bz2 or .Z they are decompressed. If the file name is just - , the log file is read from standard input. In that case, it cannot be compressed.
- This option is kept for compatibility with older versions of sarg but, starting with sarg 2.3, the log files may be named on the command line without the -l option. It allows the use of wildcards on the command line. Make sure you don't exceed the limit of 255 files.
- -L filename
- Reads a proxy redirector log file such as one created by squidGuard or Rejik. If you use this option, you may want to configure redirector_log_format in sarg.conf to match the output format of your web content filtering program. This option can be repeated up to 64 times to read multiple files.
- -n Enables ip address resolution.
- -o dir Writes report in dir.
- -p Generates reports using ip address instead of userid.
- -s string
- Limits report to the site specified by string [eg. www.debian.org]
- --split
- Split the squid log file and output it as text on the standard output omitting the dates outside of the range specified by the -d parameter. If it is combined with --convert the dates are also converted to a human-readable format.
- -t string
- Limits records counted in statistics based on time-of-day. Format for string is HH or HH:MM or HH:MM:SS.
- -u user
- Limits reports to user activities.
- -w dir Uses dir for temporary files.
- -x Writes debug messages to STDOUT
- -z Writes messages on processes to STDOUT
FILES
/etc/squid/sarg.conf
/var/log/squid/access.log
/var/log/squid/squidGuard.log
SEE ALSO
AUTHOR
- This manual page was written by Luigi Gangitano <gangitano@lugroma3.org>, for the Debian GNU/Linux system (but may be used by
others). Revised by Billy Newsom.