showing clients ip on whos tried to download virus on squid 4

classic Classic list List threaded Threaded
3 messages Options
Reply | Threaded
Open this post in threaded view
|

showing clients ip on whos tried to download virus on squid 4

robert k Wild
hi all,

this is my config at the end of squid.conf

#ICAP
icap_enable on
icap_send_client_ip on
icap_send_client_username on
icap_client_username_header X-Authenticated-User
icap_service service_req reqmod_precache bypass=0 icap://127.0.0.1:1344/squidclamav
adaptation_access service_req allow all
icap_service service_resp respmod_precache bypass=0 icap://127.0.0.1:1344/squidclamav
adaptation_access service_resp allow all

it works great but when i go on the c-icap logs its just specifies this

Sat Jan  4 00:50:36 2020, 1610/782518016, squidclamav.c(908) squidclamav_end_of_data_handler: Sat Jan  4 00:50:36 2020, 1610/782518016, LOG Virus found, sending redirection header / error page.
Sat Jan  4 00:50:39 2020, 1610/782518016, squidclamav.c(866) squidclamav_end_of_data_handler: Sat Jan  4 00:50:39 2020, 1610/782518016, LOG Virus found in https://secure.eicar.org/eicar_com.zip ending download [stream: Eicar-
Test-Signature FOUND]

how come the clients ip is not showing up?

thanks,
rob


--
Regards,

Robert K Wild.

_______________________________________________
squid-users mailing list
[hidden email]
http://lists.squid-cache.org/listinfo/squid-users
Reply | Threaded
Open this post in threaded view
|

Re: showing clients ip on whos tried to download virus on squid 4

Amos Jeffries
Administrator
On 4/01/20 2:13 pm, robert k Wild wrote:

>
> it works great but when i go on the c-icap logs its just specifies this
>
> Sat Jan  4 00:50:36 2020, 1610/782518016, squidclamav.c(908)
> squidclamav_end_of_data_handler: Sat Jan  4 00:50:36 2020,
> 1610/782518016, LOG Virus found, sending redirection header / error page.
> Sat Jan  4 00:50:39 2020, 1610/782518016, squidclamav.c(866)
> squidclamav_end_of_data_handler: Sat Jan  4 00:50:39 2020,
> 1610/782518016, LOG Virus found in
> https://secure.eicar.org/eicar_com.zip ending download [stream: Eicar-
> Test-Signature FOUND]
>
> how come the clients ip is not showing up?

Those are ICAP service issues. Nothing to do with Squid.

For this type of question you will have to contact the squidclamav or
c-icap developers or community.

Amos
_______________________________________________
squid-users mailing list
[hidden email]
http://lists.squid-cache.org/listinfo/squid-users
Reply | Threaded
Open this post in threaded view
|

Re: showing clients ip on whos tried to download virus on squid 4

robert k Wild
Thanks Amos,

I will contact c icap users in future with any cicap config lines 

On Sat, 4 Jan 2020, 01:41 Amos Jeffries, <[hidden email]> wrote:
On 4/01/20 2:13 pm, robert k Wild wrote:
>
> it works great but when i go on the c-icap logs its just specifies this
>
> Sat Jan  4 00:50:36 2020, 1610/782518016, squidclamav.c(908)
> squidclamav_end_of_data_handler: Sat Jan  4 00:50:36 2020,
> 1610/782518016, LOG Virus found, sending redirection header / error page.
> Sat Jan  4 00:50:39 2020, 1610/782518016, squidclamav.c(866)
> squidclamav_end_of_data_handler: Sat Jan  4 00:50:39 2020,
> 1610/782518016, LOG Virus found in
> https://secure.eicar.org/eicar_com.zip ending download [stream: Eicar-
> Test-Signature FOUND]
>
> how come the clients ip is not showing up?

Those are ICAP service issues. Nothing to do with Squid.

For this type of question you will have to contact the squidclamav or
c-icap developers or community.

Amos
_______________________________________________
squid-users mailing list
[hidden email]
http://lists.squid-cache.org/listinfo/squid-users

_______________________________________________
squid-users mailing list
[hidden email]
http://lists.squid-cache.org/listinfo/squid-users