Re: [squid-users] Access Logging

On 6/13/05, Ric Lonsdale <ric.lonsdale@blueyonder.co.uk> wrote:
> I'm running stable7 with RedHat E3.0. Staff in my company authenticate
> via an iPlanet directory server and we have just started using
> SmartFilter content filtering software. Some of these people have a
> userid which is their first name, followed by a space, then their
> surname.
>
> My problem is this :-
>
> The squid access log presents the userid with %20 in between the first
> and last name, as per the example below for the userid joe bloggs:-
>
> 1118656272.932 604 JLZGJ0J.axa-uk.intraxa TCP_MISS/200 1215 GET
> http://ads.apn.co.nz/jserver/SITE=NZH/AREA=SEC.NATIONALNEWS.STY/AAMSZ=14
> 0x100/acc_random=81452188/pageid=79485504 joe%20bloggs
> TIMEOUT_DIRECT/203.99.65.232 text/html ALLOW "General News"
>
> This is forwarded to SmartFilter, which cannot translate the %20 into a
> space, thereby making it impossible to look at detailed reporting on the
> userid specified.

When you say "this is forwarded to SmartFilter", can you provide
more detail on the mechanism used to forward to SmarFilter?

I know SmartFilter uses custom hooks into Squid which the squid
developers will not support (rightfully so). Offhand I don't know whether
this is how the username is getting forwarded to SmartFilter, or if
there is some other Mechanism by which SmartFilter/SmartReporter
receive access log events...

> My question is, is it possible to get squid to remove the %20 when it
> logs internet access (e.g log as joebloggs), or for it to produce the
> space in between the names (e.g. joe bloggs)?.
> Squidrunner kindly advised me to use sed, but we are using real-time
> analysis so cannot run the command against a static log file.

The root of the issue is that the space character is the delimiter for
the access log file, so introducing fields which may or may not themselves
contain embedded spaces is problematic.
This is why the space character must be escaped to %20

If you feel up to modifying the source code, you can look in access_log.c
for the subroutine username_quote() and just add another "if" condition at
the top of the while loop.

Kevin Kadow
Received on Mon Jun 13 2005 - 15:06:46 MDT