Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 
New Member

Squid to cs-mars


We need to send the access_log from our squid servers to the MARS.

The squid log file is in Apache normal log file. For example, a line will look like this : - - [24/Nov/2006:17:08:59 +0100] "GET HTTP/1.1" 200 21513 TCP_MISS:DIRECT

The MARS is configured to receive COMMON_ACCESS_LOG type data.

The MARS receives the data, but cannot parse it.

The (free) program used to send the data to the MARS is Snare for Squid :

Any help is welcome.


New Member

Re: Squid to cs-mars

Mars provides ability to custom define and parse logs.

Go to Admin->Custom Setup (tabs)

New Member

Re: Squid to cs-mars

page 273 :

Note MARS supports only HTTP proxy logs and MMS streaming media proxy logs.

so there is probably no need to define a new parser for this format.


Re: Squid to cs-mars

I don't think the Snare agent is the supported way to get "web server" logs to CSMARS. Take a look at the supplementary files available here, in particular the web agent:

If you're going to use the Snare agent, you'll need to create custom parser templates.

New Member

Re: Squid to cs-mars

Let me try that. I'm not bound to the snare thing, nor to pushing or pulling : either will do.

New Member

Re: Squid to cs-mars

The web agent method works fine, even if the script is badly written : thanks !

Is the method "UploadWebLogServlet" documented somewhere ? Can it load large chunks of data ?


CreatePlease to create content