<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal">Greetings all,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I am trying to find the best (easiest, least interfering) solution for the following problem.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Our custom ICAP server writes various information about ICAP transaction (user name, policy ip, detection module, timings, words triggered detection, etc) into the record database. This happens at the time when ICAP transaction ends. Based
on that information we build extensive reports of web filtering activity.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">As known, end of the ICAP transaction does not mean the end of the original transaction in Squid – e.g. after scanning CONNECT request and allowing it to proceed, the actual data transfer from the Squid’s perspective may end much much later.
The piece of information that would be very interesting for reporting module is how many bytes were pumped through that connection. This information is only available after the original Squid transaction ends.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">So somehow in the record database we must correlate the ICAP transaction(s) with original Squid transaction.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Question 1:<o:p></o:p></p>
<p class="MsoNormal">Is there any unique transaction ID in the Squid’s inner workings that I can see in the ICAP server, by passing it as additional X-* ICAP header?
<o:p></o:p></p>
<p class="MsoNormal">I see some references to so called “master transaction” in the docs but could not find any log format like identifier that can be used for ICAP header value.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Question 2:<o:p></o:p></p>
<p class="MsoNormal">If there is no such transaction ID, I can use ICAP header to pass the ICAP specific transaction ID back to Squid *<b>and</b>* I can get that ID written to Squid’s access log as "X-WebSafety-IID=%{X-WebSafety-IID}adapt::<last_h". Is it a
valid approach? <o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Question 3:<o:p></o:p></p>
<p class="MsoNormal">If q1 or q2 is answered positively, I still need to somehow get the data from squid’s access log the ICAP record database. Currently the idea is to have the custom logfile_daemon setting that would fork original log_file_daemon to have
log entries written to access_log *<b>and</b>* parse out the ICAP ID *<b>and</b>* update the corresponding ICAP record in the database with transferred bytes information. But this seems complex and fragile.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Is it possible to have *<b>two</b>* daemon log settings in the squid.conf? One (original) would write access_log is usual and another one would parse out pumped bytes and update the ICAP records database.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Hope I could explain it :(<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thanks in advance for everyone taking time to respond.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Best regards,<o:p></o:p></p>
<p class="MsoNormal">Rafael Akchurin<o:p></o:p></p>
<p class="MsoNormal">Diladele B.V.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>