[squid-users] Logs from traffic that don't belong to either whitelist or blacklist

[Walter H.]

On 25.05.2017 11:25, Amos Jeffries wrote:
> On 25/05/17 19:51, Miguel Barbero wrote:
>> Good morning,
>>
>> We have a special requirement and we are not sure whether it's 
>> possible to accomplish.
>>
>> We have defined a whitelist and a blacklist on our Squid. Its 
>> behaviour is as usual and how it could expect.
>>
>> All the traffic less blacklist is passed however we are interested to 
>> get an alert about the passed traffic that don't belong neither 
>> whitelist or blacklist.
>>
>> Is there any way to get this?
>
> It is. I would configure it like this:
>
>
> acl blacklist ...
> http_access deny blocklist
>
> acl whitelist ...
> http_access allow whitelist
>
> external_acl_type notify %% /path/to/notify_script
> acl notify external notify
>
> http_access allow notify
> http_access deny all
>
> Where the notify_script is a helper that sends your notification 
> however you want and returns "OK" to Squid. 
Hello Amos,

this helps me too, but where at the above "notify" can be a own defined 
label?

acl videourls ...
acl audiourls ...

external_acl_type notify %% /path/to/notify_script
acl notifyscript external notify

http_access allow notifyscript

how can I have two different notify_scripts?
e.g. one for acl  videourls and one for acl audiourls

Thanks,
Walter

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 3491 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://lists.squid-cache.org/pipermail/squid-users/attachments/20170525/4a03e703/attachment.bin>