[squid-users] ntlm user in access.log

[Amos Jeffries]

On 16/04/2016 6:06 a.m., Alexander Titaev wrote:
> Hi, Squid-users.
> 
> before was
> fbsd 9.3 i386, squid-2.7.9_1, samba36-3.6.23
> 1448899275.777 5230 192.168.0.29 TCP_MISS/200 2823 CONNECT rs.mail.ru:443 IGM\mtiunov DIRECT/94.100.180.76 -
> 
> is now
> 10.2 amd64, squid-3.5.16, samba36-3.6.25_3
> 1460709029.057 1 192.168.0.74 TCP_MISS/503 4751 GET http://vk.com/widget_community.php? IGM\\mtiunov HIER_DIRECT/192.168.1.254 text/html
> 
> how I can get
> DOM\user
> instead
> DOM\\user
> 
> 

Your log processor needs to cope with usernames being shell escaped and
URL-encoded. The shell escaping of slash, CR and LF characters was added
to resolve problems found with Squid-2.

Or you can create a custom logformat with whatever type of escaping you
wish on any parameter. Details at
<http://www.squid-cache.org/Doc/config/logformat/>

Amos