Re: [squid-users] customize logformat to see header

zulkarnain wrote:
> Hi,
>
> I'm trying to modify logformat to display header of this folowing websites. My purpose is to be able to use the correct pattern for refresh_pattern. Here are my rules
>
> acl googlevideo url_regex -i googlevideo\.com
> acl kaspersky url_regex -i kaspersky\.com
> acl kaspersky-labs url_regex -i kaspersky-labs\.com
> acl metacafe url_regex -i metacafe\.com
> acl apple url_regex -i phobos\.apple\.com
> acl pornhub url_regex -i pornhub\.com
>

Better to use dstdomain.

acl googlevideo dstdomain .googlevideo.com
acl kapersky dstdomain .kapersky.com
...

> logformat squid %ts.%03tu %6tr %>a %Ss/%03Hs %<st %rm %ru %un %Sh/%<A %mt
> logformat analisa %{%H:%M:%S}tl %-13>a %-6<st %03Hs %-17Ss %-24mt %-6tr %ru *REQ* *C:%{Cache-Control}>h *P:%"{Pragma}>h *LMS:
> %"{Last-Modified}>h *REP* *C:%"{Cache-Control}<h *P:%"{Pragma}<h *LMS:%"{Last-Modified}<h *Exp:%"{Expires}<h
>
> access_log /var/log/squid/analisa.log analisa googlevideo kaspersky kaspersky-labs metacafe apple pornhub
>

According to http://www.squid-cache.org/Doc/config/access_log/*, the
ACLs are ANDed together, just like with http_access lines. The only way
something is going to be logged with this format is if the domain
matches all of your url_regex lines.
http://gooGLevideo.compornhub.COMandKAPersky-labs.comMetacafe.com-anythinggoeshere-phobos.apple.com...

You'll need one access_log line for each of the ACLs.

> access_log /var/log/squid/access.log squid
>
> The rules above did not work. The file analisa.log is empty even after I accessed several websites above. Did I miss something? Any help would be greatly appreciated.
>
> Rgds,
> Zul
>

Chris

*"Will log to the specified file ... those entries which match ALL the
acl's specified (which must be defined in acl clauses). If no acl is
specified, all requests will be logged to this file."
Received on Tue Nov 18 2008 - 23:08:58 MST