I have a weird issue. I am using 6.5.8 to analyze proxy logs from squid 2.4 running on Red Hat 8. I have logrotate configured to drop the access.log every morning at 4:00 am, and I have a configuration set to read the access.log.1.gz and add the data to the database. Sawmill autodetects the log format, but when I build the databse I get "Rebuilt database. (Reading log data from file /var/log/squid/.). Processed 859,637 lines, 57M of log data, added 429,818 entries in 7 minutes, 54 seconds."

Why is the added lines lower than the processed lines, and how would I go about finding out why it is adding lower? BTW - if I gunzip the access.log.1.gz file and count the lines in it, I get 429,819, and the log file is actually around 57 megs of data.

In this format Sawmill may be making more than one "pass" on each line to create a "virtual log line" and so Sawmill counts this as two lines processed (as it has two jobs on that log line).

Basically it is nothing to worry about.

Cheers,
--
Graham