It seems that squid has a hard limit of 8192bytes for each entry, so the remaining characters are truncated. That makes sarg (2.3.8) exit with 'Maybe you have a broken user ID'.
Example log attached.
This problem is solved in sarg 2.4 (not yet released). It ignores unknown lines and output a summary of the reasons for ignoring lines.
You might find a solution for sarg 2.3 in http://www.squid-cache.org/Doc/config/logformat/. Columns width can be limited in the access.log. If I'm not mistaken, your problem can be solved with something like this in squid.log:
Unfortunately, there are no estimate any more. Version 2.4 was started four years ago and I don't have enough time to finish it.
Version 2.4 is not ready for release as many features I want to add are still missing but it is fully functional (I have been using it on a production server for years). If you need it and know how to build sarg, you can get the sources from the git repository. The procedure is described on the [Build] page of this wiki.
This problem is solved in sarg 2.4 (not yet released). It ignores unknown lines and output a summary of the reasons for ignoring lines.
You might find a solution for sarg 2.3 in http://www.squid-cache.org/Doc/config/logformat/. Columns width can be limited in the access.log. If I'm not mistaken, your problem can be solved with something like this in squid.log:
It requires squid version 3.2 though.
Thanks for your answer. Is there any estimated release date for sarg 2.4?
Unfortunately, there are no estimate any more. Version 2.4 was started four years ago and I don't have enough time to finish it.
Version 2.4 is not ready for release as many features I want to add are still missing but it is fully functional (I have been using it on a production server for years). If you need it and know how to build sarg, you can get the sources from the git repository. The procedure is described on the [Build] page of this wiki.
Related
Wiki: Build on Linux