I have many users with "_" in their username. I did some tests and the problem is that the username is modified in the reports : the "_" and all the letters before are removed.
For example, "toto_123" wil be "123" in the reports.
How can I fix it ?
PS : FC4 and Sarg 2.08 (already patched (see FC4 and "sort: open failed:" for the patch).
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
I tested sarg-2.0.9 with this log record:
1109355589.808 1058 10.10.1.1 TCP_MISS/200 12657 POST http://google.com.br pedro.orso DIRECT/10.60.60.8 text/html
and the process messages is:
SARG: sarg version: 2.0.9 May-30-2005
SARG: Maximum file descriptor: cur=1024 max=1024, changed to cur=20000 max=20000
SARG: Reading access log file: ../../../logs/p1.log
SARG: Records in file: 1, reading: 100.00%
SARG: Records read: 1, written: 1, excluded: 0
SARG: Squid log format
SARG: Period: 2005Feb25-2005Feb25
SARG: Making period file
SARG: Making file: /tmp/sarg/pedro_orso
SARG: Sorting file: /tmp/sarg/pedro_orso
SARG: Making report: pedro_orso
SARG: Making index.html
SARG: Successful report generated on /tmp/zz/2005Feb25-2005Feb25
SARG: Removing temporary files: geral, periodo
SARG: End
and the html report is:
NUM USERID CONNECT BYTES %BYTES IN-CACHE-OUT ELAPSED TIME MILISEC %TIME
1 [Graphic Report] [date/time Report] pedro.orso 1 12.65K 100.00% 0.00% 100.00% 00:00:00 0 0.00%
TOTAL 1 12.65K 0.00% 100.45% 00:00:00 0
AVERAGE 1 12.65K 00:00:00 0
I see pedro.orso...
Please let me know whats and where is the error.
Thanks
pedro Orso
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
I tried your access.log example, and instead of "pedro.orso" it was just "orso" in the reports.
But I did some more tests and it's all about the "ntlm_user_format" option. It was set to "username" because i don't want to have the domain name on each line.
Now it's set to "domainname+username" and the usernames are not modified anymore.
Is this supposed to be the "normal" behaviour of this option ? Is it normal that it removes a part of the username ?...
Well I don't know, but I don't have problems with this topic anymore.
Thanks Pedro !!!!!!
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
I have many users with "_" in their username. I did some tests and the problem is that the username is modified in the reports : the "_" and all the letters before are removed.
For example, "toto_123" wil be "123" in the reports.
How can I fix it ?
PS : FC4 and Sarg 2.08 (already patched (see FC4 and "sort: open failed:" for the patch).
I've just installed the 2.0.9 version.
It works fine, like my previous patched 2.0.8
But this "_" bug is still here...
Can I do any test to help ?
I tested sarg-2.0.9 with this log record:
1109355589.808 1058 10.10.1.1 TCP_MISS/200 12657 POST http://google.com.br pedro.orso DIRECT/10.60.60.8 text/html
and the process messages is:
SARG: sarg version: 2.0.9 May-30-2005
SARG: Maximum file descriptor: cur=1024 max=1024, changed to cur=20000 max=20000
SARG: Reading access log file: ../../../logs/p1.log
SARG: Records in file: 1, reading: 100.00%
SARG: Records read: 1, written: 1, excluded: 0
SARG: Squid log format
SARG: Period: 2005Feb25-2005Feb25
SARG: Making period file
SARG: Making file: /tmp/sarg/pedro_orso
SARG: Sorting file: /tmp/sarg/pedro_orso
SARG: Making report: pedro_orso
SARG: Making index.html
SARG: Successful report generated on /tmp/zz/2005Feb25-2005Feb25
SARG: Removing temporary files: geral, periodo
SARG: End
and the html report is:
NUM USERID CONNECT BYTES %BYTES IN-CACHE-OUT ELAPSED TIME MILISEC %TIME
1 [Graphic Report] [date/time Report] pedro.orso 1 12.65K 100.00% 0.00% 100.00% 00:00:00 0 0.00%
TOTAL 1 12.65K 0.00% 100.45% 00:00:00 0
AVERAGE 1 12.65K 00:00:00 0
I see pedro.orso...
Please let me know whats and where is the error.
Thanks
pedro Orso
I tried your access.log example, and instead of "pedro.orso" it was just "orso" in the reports.
But I did some more tests and it's all about the "ntlm_user_format" option. It was set to "username" because i don't want to have the domain name on each line.
Now it's set to "domainname+username" and the usernames are not modified anymore.
Is this supposed to be the "normal" behaviour of this option ? Is it normal that it removes a part of the username ?...
Well I don't know, but I don't have problems with this topic anymore.
Thanks Pedro !!!!!!