Multiple access logs

Previous Topic Next Topic
 
classic Classic list List threaded Threaded
4 messages Options
Reply | Threaded
Open this post in threaded view
|

Multiple access logs

Alan
Is it possible to have multiple access_log entries in Squid 3.5?

For example, to write to a file and a daemon at the same time?

In my testing a second entry overrides the first one, but I hope I'm
missing something here.

Thanks.

Alan

_______________________________________________
squid-users mailing list
[hidden email]
http://lists.squid-cache.org/listinfo/squid-users
Reply | Threaded
Open this post in threaded view
|

Re: Multiple access logs

Alex Rousskov
On 4/1/20 11:21 AM, [hidden email] wrote:
> Is it possible to have multiple access_log entries in Squid 3.5?

I have not checked Squid v3, but I suspect the answer has not changed
much since that version.


> For example, to write to a file and a daemon at the same time?

Multiple access logs are supported, but there are caveats.

A matching "access_log none" directive terminates logging -- directives
below it are not checked. Some believe that this is desirable and
documented behavior, similar to a "deny" rule match, I guess.

Also, the related code is buggy AFAICT. To make sure that all configured
access logs are used, try this _untested_ workaround: Do not use more
than one access_log directive without ACLs. If you use one such
directive, then make it the _last_ access_log directive.

For developer-level details see accessLogLogTo().

HTH,

Alex.
_______________________________________________
squid-users mailing list
[hidden email]
http://lists.squid-cache.org/listinfo/squid-users
Reply | Threaded
Open this post in threaded view
|

Re: Multiple access logs

Alan
On 02/04/2020 03:29, Alex Rousskov wrote:

> On 4/1/20 11:21 AM, [hidden email] wrote:
>> Is it possible to have multiple access_log entries in Squid 3.5?
>
> I have not checked Squid v3, but I suspect the answer has not changed
> much since that version.
>
>
>> For example, to write to a file and a daemon at the same time?
>
> Multiple access logs are supported, but there are caveats.
>
> A matching "access_log none" directive terminates logging -- directives
> below it are not checked. Some believe that this is desirable and
> documented behavior, similar to a "deny" rule match, I guess.
>
> Also, the related code is buggy AFAICT. To make sure that all configured
> access logs are used, try this _untested_ workaround: Do not use more
> than one access_log directive without ACLs. If you use one such
> directive, then make it the _last_ access_log directive.
>
> For developer-level details see accessLogLogTo().

Thanks for your answer.

Here is what I've found after testing:

1. I thought the UDP logging module didn't work, but I didn't realize
there is a buffer of 1400 bytes (that can't be configured).
2. The TCP logging module works fine.
3. We can't use 2 different log_daemon programs, which is really
inconvenient.  But the same program can be used with different
parameters for different instances (eg: if different formats are
needed), so it's possible to use a wrapper to overcome this.

Regards,

Alan

_______________________________________________
squid-users mailing list
[hidden email]
http://lists.squid-cache.org/listinfo/squid-users
Reply | Threaded
Open this post in threaded view
|

Re: Multiple access logs

Alex Rousskov
On 4/2/20 5:06 AM, [hidden email] wrote:

> 1. I thought the UDP logging module didn't work, but I didn't realize
> there is a buffer of 1400 bytes (that can't be configured).

It can be configured in Squid v4+. Look for access_log buffer-size=...

Alex.
_______________________________________________
squid-users mailing list
[hidden email]
http://lists.squid-cache.org/listinfo/squid-users