<div dir="ltr">I'm very very sorry for replying to your email directly, I didn't mention to, I just clicked reply on gmail<div><br></div><div>I wanted squid to log to syslog, using the syslog module on ubuntu the socket path is /dev/log</div><div>from there I have my rsyslog config that forwards it to logstash</div><div><br></div><div>In any case my manager just told me to not log directly to syslog anymore, he wants to write the logs to file and have them shipped to syslog</div><div><br></div><div>In any case I think I found the root of my problems, my squid.conf was being built using patch, I had a file with only the diff.</div><div>So it looks like the patch wasn't being applied correctly, so squid was running with the default conf file.</div><div><br></div><div>Thanks for the help, and sorry again</div><div>Avraham</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Wed, Nov 11, 2015 at 2:55 PM, Sebastian Kirschner <span dir="ltr"><<a href="mailto:s.kirschner@afa-finanz.de" target="_blank">s.kirschner@afa-finanz.de</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi Avraham,<br>
<br>
1. Please do not contact me direct, use the Mailing List.<br>
<br>
I read the sentences you wrote to me again,<br>
do you really want that squid logs the things that would go in access.log to your /var/log/syslog (default debian path),<br>
or do you just want to see what is written in the access.log.<br>
<br>
For Changing the location/ way that squid log the access entries read 2. , if not the default<br>
path of the access log is /usr/local/squid/var/logs/access.log.<br>
<br>
2. As you could see what Yuri Voinov wrote<br>
<span class="">> #<br>
># udp To send each log line as text data to a UDP receiver.<br>
># Place: The destination host name or IP and port.<br>
># Place Format: //host:port<br>
>#<br>
># tcp To send each log line as text data to a TCP receiver.<br>
># Lines may be accumulated before sending (see buffered_logs).<br>
># Place: The destination host name or IP and port.<br>
># Place Format: //host:port<br>
>#<br>
># Default:<br>
># access_log daemon:/var/log/squid/access.log squid<br>
>#Default:<br>
># access_log daemon:/var/log/squid/access.log squid<br>
<br>
</span>These is snipped from the squid configuration documents on squid page (<a href="http://www.squid-cache.org/Doc/config/access_log/" rel="noreferrer" target="_blank">http://www.squid-cache.org/Doc/config/access_log/</a>).<br>
<br>
You could try ( I didn’t do it before) to use syslog as module and insert it in your squid.conf<br>
<br>
Best Regards<br>
Sebastian<br>
<br>
<br>
Von: Avraham Serour [mailto:<a href="mailto:tovmeod@gmail.com">tovmeod@gmail.com</a>]<br>
Gesendet: Mittwoch, 11. November 2015 11:48<br>
An: Sebastian Kirschner<br>
Betreff: Re: [squid-users] logging to syslog<br>
<div class="HOEnZb"><div class="h5"><br>
I'm actually using rsyslog, it comes with ubuntu<br>
in any case my conf for now is:<br>
<br>
template(name="lesquid_accessFormat" type="string" string="programname=%programname% %msg%\n")<br>
action(type="omfile" dirCreateMode="0700" FileCreateMode="0644"<br>
File="/var/log/messages" template="lesquid_accessFormat")<br>
<br>
then I tail the /var/log/messages file and check what happens when I make a request using the proxy<br>
<br>
On Wed, Nov 11, 2015 at 12:09 PM, Avraham Serour <<a href="mailto:tovmeod@gmail.com">tovmeod@gmail.com</a>> wrote:<br>
so where should the symlink should be? what is the default unix socket path that squid tried to use?<br>
<br>
On Wed, Nov 11, 2015 at 10:11 AM, Sebastian Kirschner <<a href="mailto:s.kirschner@afa-finanz.de">s.kirschner@afa-finanz.de</a>> wrote:<br>
Hi Avraham,<br>
<br>
I think it wouldnt be a good idea to just create a symlink because squid (or the user under which squid runs) then must have access to the syslog,<br>
and if your squid instance get compromised the the syslog is open to read for these one.<br>
<br>
Best Regards<br>
Sebastian<br>
_______________________________________________<br>
squid-users mailing list<br>
<a href="mailto:squid-users@lists.squid-cache.org">squid-users@lists.squid-cache.org</a><br>
<a href="http://lists.squid-cache.org/listinfo/squid-users" rel="noreferrer" target="_blank">http://lists.squid-cache.org/listinfo/squid-users</a><br>
<br>
<br>
</div></div></blockquote></div><br></div>