I have attached my script written last year that I use for this
purpose...
Irfan Akber wrote:
>
> Can the date stamp be interpreted to the actual date and time in access.log
>
> 917048472.229 3678 208.240.201.74 TCP_MISS/200 1028 GET
>
> ^^^^^
> http://www.excite.com/img/sho/cloth/Accessor.gif -
> | | | | ??? (exact date and time ???)
>
> Thanks,
>
> Irfan Akber
#!/usr/bin/perl
# sqtimelog.pl (C)1998 by Miles Lott ([EMAIL PROTECTED])
# Parse Squid access.log file, converting time field to a readable
# format, and laying out necessary fields.
#
# Usage:
# sqtimelog access.conf > acc.log
#
#
# Your local network(s) - Define the second as "1.1.1" or some other
# bogus network if none is appropriate. It will be ignored.
$localnet1 = "192.168.0";
$localnet2 = "192.168.1";
# Main works
open ( FILE, "<$ARGV[0]") || die "Couldn't open $ARGV[0]\n";
while (<FILE>) {
@field = $_;
# Print Date and time
$timecon = scalar ( localtime ( $field[0]) );
# Print username, user IP, website visited, and local IP addr
if ( /$localnet1\.(.*?)\ http:\/\/(.*?)\ (.*?)\ (.*?)\ / ) { print "$timecon
$3 GET http://$2 $localnet1\.$1" }
if ( /$localnet2\.(.*?)\ http:\/\/(.*?)\ (.*?)\ (.*?)\ / ) { print "$timecon
$3 GET http://$2 $localnet2\.$1" }
if ( /$localnet1\.(.*?)\ CONNECT(.*?)\ (.*?)\ (.*?)\ (.*?)\ / ) { print
"$timecon $4 CONNECT http://$3 $localnet1\.$1" }
if ( /$localnet2\.(.*?)\ CONNECT(.*?)\ (.*?)\ (.*?)\ (.*?)\ / ) { print
"$timecon $4 CONNECT http://$3 $localnet2\.$1" }
# Add newline
print"\n";
}
close FILE;
