<div dir="ltr"><div>Hello,<br></div><div>Bellow is the message that I retrieve from logstash. We use logstash as our logging system. Now, I do add tags to log messages in log stash. I believe the %st is my size right?<br></div><div><br>Apr 14 01:31:13 Proxy-SI-1 (squid-2): Proxy-SI-1
1460611873.853 0 2 10.88.14.225 TCP_DENIED_ABORTED 301 2147480505 535
2147479970 POST 1.0 text/html - - - - 3128 - [Mozilla/4.0 (compatible;
MSIE 5.5; Win32)] [-] sq_err:[301 Access Denied] c_hdr:[Accept:
*/*\r\nContent-Type: application/octet-stream\r\nUser-Agent: Mozilla/4.0
(compatible; MSIE 5.5; Win32)\r\nUserAgent:
<a href="http://blugro3relay.groove.microsoft.com">blugro3relay.groove.microsoft.com</a>\r\nContent-Length:
2147479552\r\nPragma: no-cache\r\nCache-Control: no-cache\r\nExpires:
0\r\nCache-Control: max-age=0\r\n] s_hdr:[HTTP/1.1 301 Moved
Permanently\r\nServer: squid/3.4.13\r\nMime-Version: 1.0\r\nDate: Thu,
14 Apr 2016 05:31:13 GMT\r\nContent-Type: text/html\r\nContent-Length:
0\r\nLocation: <a href="http://blockmessage.palmbeach.k12.fl.us/block_message.php?clientaddr=10.88.14.225&clientname=-&clientuser=-&clientgroup=SDPBC-Network&targetgroup=Blacklist&url=HTTP://blugro3relay.groove.microsoft.com" target="_blank">http://blockmessage.palmbeach.k12.fl.us/block_message.php?clientaddr=10.88.14.225&clientname=-&clientuser=-&clientgroup=SDPBC-Network&targetgroup=Blacklist&url=HTTP://blugro3relay.groove.microsoft.com</a>\r\nX-Squid-Error: 301 Access Denied\r\n\r]<br><br></div>Here is the custom syslog from the config<br>logformat custom Proxy-SI-1 %ts.%tu %dt %tr %>a %Ss %03Hs %st %<st %>st %rm %rv %mt %[un %<A %<a %<p %>lp %{Referer}>h [%{User-Agent}>h\<br>] [%{Host}>h] sq_err:[%{X-Squid-Error}<h] c_hdr:[%>h] s_hdr:[%<h]<br><br></div><div class="gmail_extra"><br><div class="gmail_quote">On Fri, Apr 15, 2016 at 12:57 AM, Jason Haar <span dir="ltr"><<a href="mailto:jason_haar@trimble.com" target="_blank">jason_haar@trimble.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">If you are blocking it, then it can't be uploading 2G? How are you measuring that it uploads 2G? Did you change squid's logging to support that (it doesn't log upload sizes - only download sizes by default). Are you simply referring to the Content-Length header - as that would say 2G - even if the upload is then blocked.</div><div class="gmail_extra"><br><div class="gmail_quote"><span class="">On Fri, Apr 15, 2016 at 4:04 PM, Michael Pelletier <span dir="ltr"><<a href="mailto:michael.pelletier@palmbeachschools.org" target="_blank">michael.pelletier@palmbeachschools.org</a>></span> wrote:<br></span><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class=""><div dir="ltr"><div>I am blocking <a href="http://grove.microsoft.com" target="_blank">grove.microsoft.com</a>. Even though I am blocking it, I am seeing large, 2 Gig, uploads from the client to the proxy (which indeed blocks it). It is almost like the connection request (explicit) contains the 2 gig post request. Why is this happening? Has anyone seen this?<br><br><br></div>Michael<br></div>
<br>
<p style="font-size:1.3em;font-family:Arial,Helvetica,sans-serif"></p><p style="font-size:1.3em;font-family:Arial,Helvetica,sans-serif"></p><p style="font-size:1.3em;font-family:Arial,Helvetica,sans-serif"></p></span><div><div style="font-size:1.3em"><b style="color:rgb(34,34,34);font-size:1.3em"><font size="2"><span style="line-height:14.7200002670288px;font-family:Arial">Disclaimer:</span> </font></b><span style="color:rgb(34,34,34);font-size:x-small;line-height:11.5px;font-family:Arial">Under Florida law, e-mail addresses are public records. If you do not want your e-mail address released in response to a public records request, do not send electronic mail to this entity. Instead, contact this office by phone or in writing.</span></div></div><p style="font-size:1.3em;font-family:Arial,Helvetica,sans-serif"></p><p style="font-size:1.3em;font-family:Arial,Helvetica,sans-serif"></p><p style="font-size:1.3em;font-family:Arial,Helvetica,sans-serif"></p><br>_______________________________________________<br>
squid-users mailing list<br>
<a href="mailto:squid-users@lists.squid-cache.org" target="_blank">squid-users@lists.squid-cache.org</a><br>
<a href="http://lists.squid-cache.org/listinfo/squid-users" rel="noreferrer" target="_blank">http://lists.squid-cache.org/listinfo/squid-users</a><br>
<br></blockquote></div><span class="HOEnZb"><font color="#888888"><br><br clear="all"><div><br></div>-- <br><div><div dir="ltr"><div>Cheers</div><div><br></div><div>Jason Haar</div><div>Information Security Manager, Trimble Navigation Ltd.</div><div>Phone: <a href="tel:%2B1%20408%20481%208171" value="+14084818171" target="_blank">+1 408 481 8171</a></div><div>PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1</div></div></div>
</font></span></div>
<br>_______________________________________________<br>
squid-users mailing list<br>
<a href="mailto:squid-users@lists.squid-cache.org">squid-users@lists.squid-cache.org</a><br>
<a href="http://lists.squid-cache.org/listinfo/squid-users" rel="noreferrer" target="_blank">http://lists.squid-cache.org/listinfo/squid-users</a><br>
<br></blockquote></div><br></div>
<br>
<p style="font-size:1.3em;font-family:Arial,Helvetica,sans-serif"></p><p style="font-size:1.3em;font-family:Arial,Helvetica,sans-serif"></p><p style="font-size:1.3em;font-family:Arial,Helvetica,sans-serif"></p><div><div style="font-size:1.3em"><b style="color:rgb(34,34,34);font-size:1.3em"><font size="2"><span style="line-height:14.7200002670288px;font-family:Arial">Disclaimer:</span> </font></b><span style="color:rgb(34,34,34);font-size:x-small;line-height:11.5px;font-family:Arial">Under Florida law, e-mail addresses are public records. If you do not want your e-mail address released in response to a public records request, do not send electronic mail to this entity. Instead, contact this office by phone or in writing.</span></div></div><p style="font-size:1.3em;font-family:Arial,Helvetica,sans-serif"></p><p style="font-size:1.3em;font-family:Arial,Helvetica,sans-serif"></p><p style="font-size:1.3em;font-family:Arial,Helvetica,sans-serif"></p>