Sarg is a squid analysis report generator that allow you to view where your users are going to on the internet.
安装：
1、下载sarg 1.4.2.tar http://web.onda.com.br/orso/sarg.html
2、上传到/usr/local解压
3. 安装
run ./configure
configure options: --enable-bindir=where sarg binary will be saved
default: /usr/bin

--enable-sysconfdir - where the configuration directory is
default: /usr/local/sarg

--enable-mandir - where the sarg man page will be saved
default: /usr/local/man/man1


make
make install

5. Go to /usr/local/sarg (or file entered with --sysconfdir on configure)
and change sarg.conf as you need.
主要修改squid 的LOG路径。
access_log /usr/local/squid/var/logs/access.log
sarg.conf的其它配置可以看注释。

6. 运行sarg -h
产生分类记录
7、如果squid 的LOG很大，运行sarg时对系统性能要求就高，所以可以用cron定时产生记录；然后用/usr/local/squid/bin/squid –k rotate 对squid 的LOG回转。

8、运行sarg产生的记录

8 drwxr-xr-x 2 root 6249 Jul 18 17:06 ./
8 drwxrwxrwt 9 sys 762 Nov 4 13:41 ../
24 -rw-r--r-- 1 root 23396 Jul 18 09:07 190_13_125_102.log
40 -rw-r--r-- 1 root 36264 Jul 18 17:05 190_13_125_102.unsort
0 -rw-r--r-- 1 root 0 Jul 18 09:08 190_13_125_202.htmp
0 -rw-r--r-- 1 root 0 Jul 18 09:08 190_13_125_202.tmp
112 -rw-r--r-- 1 root 113176 Jul 18 17:06 190_13_125_202.unsort
88 -rw-r--r-- 1 root 86942 Jul 18 09:07 190_13_125_33.log
24 -rw-r--r-- 1 root 24233 Jul 18 09:07 190_13_125_52.log
24 -rw-r--r-- 1 root 19472 Jul 18 17:05 190_143_125_38.unsort
…………………….

9、运行sarg产生的记录格式。跟sarg.conf设置有关。

more /tmp/sarg/190_13_125_52.log
07/05/2003 11:54:39 190_13_125_52 190_13_125_52
ie.search.msn.com/zh-cn/srchasst/srchasst.htm 4672 TCP
_MISS/200 13720 ""
07/05/2003 12:03:37 190_13_125_52 190_13_125_52 ie.search.msn.com/zh-cn/srchasst/srchasst.htm 4672 TCP
_MISS/200 90734 ""