Hi, George... On Sat, Aug 21, 2004 at 11:55:53PM +0800, George Hong wrote: > I have several squid cache servers setting us as reversed proxy for a > large website. We need to provide a single log file everyday. Instead of > spending hours on combining several huge access.log files into one, I'm > wondering whether I can use a log server and point the log file to it so > that the log file is already well organized. If I want to implement it, > where should I start?
Well, built-in syslog only works for the cache.log so this is not an option. I wrote a Perl script called "tail2syslog" (which I provide as a Debian package but which is useful on other systems as well) which follows the changes in the access.log (like a "tail -f") and forwards them to a syslog server. Advantage: - you probably already have a syslog server in your network Disadvantages: - the script sucks a lot of CPU on busy systems (we have 60 requests per second and the script produces much higher load than Squid) - the output will not be plain access.log output as syslog adds some data before each line (so automated statistics tools won't work without some conversion) - long log lines may get cut (if you log mime headers or have very long URLs) If you are interested I'll put it online. > One way to solve the issue I can think of is to mount the log server's > disk on the cache servers. But mount is not reliable and I don't like > it. It might have write lock issues since multiple servers are writing > to it at the same time. I like the idea of an NFS mount. Probably a nice idea for our servers. :) Christoph -- ~ ~ ".signature" [Modified] 3 lines --100%-- 3,41 All
