Ubuntu
sarg package

sarg: getword loop detected (bug in utils.c, name_month function?)

Bug #515402 reported by Dave Hope
16
This bug affects 3 people
Affects Status Importance Assigned to Milestone
Ubuntu Server papercuts
Invalid
Undecided
Unassigned
Debian
Fix Released
Unknown
Gentoo Linux
Fix Released
Medium
sarg (Ubuntu)
Fix Released
Undecided
Unassigned
Nominated for Karmic by Don Schulte

Bug Description

Binary package hint: sarg

sarg fails when processing an out the box access.log from squdi3:

Package: sarg, Version: 2.2.5-2
Package: squid3, Version: 3.0.STABLE18-1

root@BOH-INF-MON01:/tmp# sarg -z -x
SARG: Init
SARG: Loading configuration from: /etc/squid/sarg.conf
SARG: TAG: language English
SARG: TAG: access_log /var/log/squid3/access.log
SARG: TAG: title "Squid User Access Reports"
SARG: TAG: font_face Tahoma,Verdana,Arial
SARG: TAG: header_color darkblue
SARG: TAG: header_bgcolor blanchedalmond
SARG: TAG: font_size 9px
SARG: TAG: background_color white
SARG: TAG: text_color #000000
SARG: TAG: text_bgcolor lavender
SARG: TAG: title_color green
SARG: TAG: temporary_dir /tmp
SARG: TAG: output_dir /var/www/squid-reports
SARG: TAG: resolve_ip no
SARG: TAG: user_ip no
SARG: TAG: topuser_sort_field BYTES reverse
SARG: TAG: user_sort_field BYTES reverse
SARG: TAG: exclude_users /etc/squid/sarg.users
SARG: TAG: exclude_hosts /etc/squid/sarg.hosts
SARG: TAG: date_format u
SARG: TAG: lastlog 0
SARG: TAG: remove_temp_files yes
SARG: TAG: index yes
SARG: TAG: index_tree file
SARG: TAG: overwrite_report yes
SARG: TAG: records_without_userid ip
SARG: TAG: use_comma yes
SARG: TAG: mail_utility mailx
SARG: TAG: topsites_num 100
SARG: TAG: topsites_sort_order CONNECT D
SARG: TAG: index_sort_order D
SARG: TAG: exclude_codes /etc/squid/sarg.exclude_codes
SARG: TAG: max_elapsed 28800000
SARG: TAG: report_type topusers topsites sites_users users_sites date_time denied auth_failures site_user_time_date down
SARG: TAG: usertab /etc/squid/sarg.usertab
SARG: TAG: long_url no
SARG: TAG: date_time_by bytes
SARG: TAG: charset Latin1
SARG: TAG: show_successful_message no
SARG: TAG: show_read_statistics no
SARG: TAG: topuser_fields NUM DATE_TIME USERID CONNECT BYTES %BYTES IN-CACHE-OUT USED_TIME MILISEC %TIME TOTAL AVERAGE
SARG: TAG: user_report_fields CONNECT BYTES %BYTES IN-CACHE-OUT USED_TIME MILISEC %TIME TOTAL AVERAGE
SARG: TAG: topuser_num 0
SARG: TAG: site_user_time_date_type table
SARG: TAG: download_suffix "zip,arj,bzip,gz,ace,doc,iso,adt,bin,cab,com,dot,drv$,lha,lzh,mdb,mso,ppt,rtf,src,shs,sys,exe
SARG: Loading exclude file from: /etc/squid/sarg.hosts
SARG: Loading exclude file from: /etc/squid/sarg.users
SARG: Parameters:
SARG:
SARG: Hostname or IP address (-a) =
SARG: Useragent log (-b) =
SARG: Exclude file (-c) = /etc/squid/sarg.hosts
SARG: Date from-until (-d) =
SARG: Email address to send reports (-e) =
SARG: Config file (-f) = /etc/squid/sarg.conf
SARG: Date format (-g) = USA (mm/dd/yyyy)
SARG: IP report (-i) = No
SARG: Input log (-l) = /var/log/squid3/access.log
SARG: Resolve IP Address (-n) = No
SARG: Output dir (-o) = /var/www/squid-reports/
SARG: Use Ip Address instead of userid (-p) = No
SARG: Accessed site (-s) =
SARG: Time (-t) =
SARG: User (-u) =
SARG: Temporary dir (-w) = /tmp
SARG: Debug messages (-x) = Yes
SARG: Process messages (-z) = Yes
SARG:
SARG: sarg version: 2.2.5 Mar-03-2008
SARG: Maximum file descriptor: cur=1024 max=1024, changed to cur=20000 max=20000
SARG: Loading User table: /etc/squid/sarg.usertab
SARG: Reading access log file: /var/log/squid3/access.log
SARG: (util) tbuf=2010Feb01
SARG: (util) period=2010Feb01-
SARG: Records read: 22966, written: 22965, excluded: 1
SARG: Squid log format
SARG: (util) data=02/01/2010
SARG: (util) tbuf=2010Feb01
SARG: (util) period=2010Feb01-2010Feb01
SARG: Period: 2010Feb01-2010Feb01
SARG: pre-sorting files
SARG: (util) dirname=/var/www/squid-reports/2010Feb01-2010Feb01
SARG: (util) wdir=/var/www/squid-reports/2010Feb01-2010Feb01
SARG: Making period file
SARG: Making file: /tmp/sarg/10.5.8.1
SARG: Making file: /tmp/sarg/10.5.6.14
...removed...
SARG: Making file: /tmp/sarg/10.5.6.20
SARG: Resolve IP Address (-n) = No
SARG: Output dir (-o) = /var/www/squid-reports/
SARG: Use Ip Address instead of userid (-p) = No
SARG: Accessed site (-s) =
SARG: Time (-t) =
SARG: User (-u) =
SARG: Temporary dir (-w) = /tmp
SARG: Debug messages (-x) = Yes
SARG: Process messages (-z) = Yes
SARG:
SARG: sarg version: 2.2.5 Mar-03-2008
SARG: Maximum file descriptor: cur=1024 max=1024, changed to cur=20000 max=20000
SARG: Loading User table: /etc/squid/sarg.usertab
SARG: Reading access log file: /var/log/squid3/access.log
SARG: (util) tbuf=2010Feb01
SARG: (util) period=2010Feb01-
SARG: Records read: 22966, written: 22965, excluded: 1
SARG: Squid log format
SARG: (util) data=02/01/2010
SARG: (util) tbuf=2010Feb01
SARG: (util) period=2010Feb01-2010Feb01
SARG: Period: 2010Feb01-2010Feb01
SARG: pre-sorting files
SARG: (util) dirname=/var/www/squid-reports/2010Feb01-2010Feb01
SARG: (util) wdir=/var/www/squid-reports/2010Feb01-2010Feb01
SARG: Making period file
SARG: Making file: /tmp/sarg/10.5.8.1
SARG: Making file: /tmp/sarg/10.5.6.14
SARG: Making file: /tmp/sarg/10.5.6.61
...removed...
SARG: getword loop detected.
SARG: searching for 'x20'
SARG: Maybe you have a broken record or garbage in your access.log file.

This seems to have been fixed by Gentoo and Debian recently:
http://bugs.gentoo.org/show_bug.cgi?id=263802
http://<email address hidden>/msg262206.html

Revision history for this message
Dave Hope (dave-davehope) wrote :

This bug is fixed upstream in ssarg 2.2.6 - http://sarg.sourceforge.net/sarg.ChangeLog.txt

What's the process for getting the sarg in Ubuntu updated to 2.2.6? is there anything I can do to help?

Revision history for this message
Neriberto Caetano do Prado (neriberto-gmail) wrote :

I have the same trouble in many servers so I recompile the sarg 2.2.7 that I get from http://sarg.sourceforge.net/ and works fine now with the same sarg.conf that I've been used with the sarg 2.2.5 that come with distribution.

Revision history for this message
Alex Muntada (alex.muntada) wrote :

Please, note that latest Ubuntu (Lucid) has already sarg version 2.2.6. Can you confirm that this issue is being fixed in Lucid?

Changed in sarg (Ubuntu):
status: New → Incomplete
Revision history for this message
Alex Muntada (alex.muntada) wrote :

Lucid has 2.2.6 already.

Changed in server-papercuts:
status: New → Invalid
Bug Watch Updater (bug-watch-updater)
Changed in gentoo:
status: Unknown → Fix Released
Revision history for this message
Dave Hope (dave-davehope) wrote :

Hi,

Unfortunately my systems all still run Karmic, so I cant' test in lucid just yet.

If someone backports it to Karmic I'll gladly test. When I build 2.2.6 from source it works fine.

Given 2.2.7 is out now, it's probably worth going straight to that?

Revision history for this message
Alex Muntada (alex.muntada) wrote :

Unless 2.2.7 fixes a big issue it is quite unlikely that lucid will ship it, since we're approaching to beta release and new features must be approved explicitly (feature freeze was almost 1 month ago). However, you can nominate this bug for release on the links above.

Anyway, it would be nice if you had the change to test sarg on lucid (e.g. from a live cd).

Revision history for this message
Alex Muntada (alex.muntada) wrote :

@Dave, could you please attach the access.log from squid3 that triggers the issue? I'd like to test sarg on lucid but squid3 is not available in ubuntu.

Revision history for this message
Dave Hope (dave-davehope) wrote :

@Alex

The log contains potentially sensetive information, can I e-mail it to you personally? I've got a 700KB sample.

Revision history for this message
Dave Hope (dave-davehope) wrote :

@Alex

Thanks for your private message. I've trimmed it down to just one (random) line which causes the problem.

Revision history for this message
Alex Muntada (alex.muntada) wrote :

Confirmed that this issue has been fixed in latest ubuntu. Please, nominate for older ubuntu releases if needed.

Changed in sarg (Ubuntu):
status: Incomplete → Fix Released
Revision history for this message
jmedina (jorgearma1982) wrote :

I have a few squid3+sarg installations and run without problems, probably this is not a sarg bug but squid3 default config, the default /etc/squid3/squid.conf has a default logformat which incluides one space after the fist entry on access.log, I always uncomment the line and remove the extra space char.

I hope this can help, I have never had the need to recompile sarg since dapper, of course I always uncomment the logformat directive and remove the extra space.

Best regards.

Bug Watch Updater (bug-watch-updater)
Changed in debian:
status: Unknown → Fix Released
Bug Watch Updater (bug-watch-updater)
Changed in gentoo:
importance: Unknown → Medium
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Bug attachments

Remote bug watches

Bug watches keep track of this bug in other bug trackers.