<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:1665625480;
mso-list-type:hybrid;
mso-list-template-ids:715555106 67698703 67698713 67698715 67698703 67698713 67698715 67698703 67698713 67698715;}
@list l0:level1
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level2
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level3
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l0:level4
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level5
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level6
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l0:level7
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level8
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level9
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
ol
{margin-bottom:0in;}
ul
{margin-bottom:0in;}
--></style>
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt">I have the following for each of my rules (except for my last rule: http_access deny all rule):<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">http_access allow AllowedSrc AllowedInternalDst<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">note ruleid ACCESS2INTERNAL AllowedSrc AllowedInternalDst<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">note ruletype ALLOW AllowedSrc AllowedInternalDst<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">I have the following log-format entry used for all logs (note the last two fields now indicate to which rule I matched and the expected behavior):<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">logformat MyLogFormat ---> local_time="[%tl]" squid_service=%{service}note squid_status=%Ss squid_hierarchy_status=%Sh ** haproxy_id=%{X-Request-Id}>h orig_src_ip=%{X-Forwarded-For}>h haproxy_egress_ip=%>a
haproxy_port=%>p squid_ingress_port=%>lp squid_egress_port=%<lp dst_ip=%<a dst_host=%<A dst_port=%<p ident_username=%[ui username=%[un request_method=%rm request="%rm %ru HTTP/%rv" status_code_from_server=%>Hs status_code_to_client=%<Hs referer="%{Referer}>h"
user_agent="%{User-Agent}>h" protocol_version=%rv ** dns_response_time=%dt response_time=%tr mime_type=%mt *XFER* total_request_size=%>st total_reply_size=%<st ** %{src_zone}note %{dst_zone}note %{method_category}note %{dst_category}note %{file_upload}note
** REQUEST HEADERS %>h *** RESPONSE HEADERS %<h *** tag_returned=%et tag_string="%ea" previous_hop_mac=%>eui peer_response_time=%<pt total_response_time=%<tt *SSL* src_ssl_negotiated_version=%ssl::>negotiated_version dst_ssl_negotiated_version=%ssl::<negotiated_version
src_tls_hello_version=%ssl::>received_hello_version dst_tls_hello_version=%ssl::<received_hello_version src_tls_max_version=%ssl::>received_supported_version dst_tls_max_version=%ssl::<received_supported_version src_tls_cipher=%ssl::>negotiated_cipher dst_tls_cipher=%ssl::<negotiated_cipher
ssl_bump=%<bs ssl_bump_mode=%ssl::bump_mode ssl_sni=%ssl::>sni src_cert_subject="%ssl::>cert_subject" src_cert_issuer="%ssl::>cert_issuer" dst_cert_subject="%ssl::<cert_subject" dst_cert_issuer="%ssl::<cert_issuer" cert_errors="%ssl::<cert_errors" *** error_page_presented=%err_code
err_detail="%err_detail" rule_id=%{ruleid}note rule_type=%{ruletype}note<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">So when traffic is allowed, everything works as expected (Note the orig_src_ip, rule_id, rule, type are all populated):<o:p></o:p></span></p>
<p class="MsoNormal">---> local_time="[30/May/2019:07:25:12 -0400]" squid_service=explicit squid_status=TCP_TUNNEL squid_hierarchy_status=HIER_DIRECT ** haproxy_id=5CEFBD98_0AFB14CC_0AFB1621_206C_9E79_461F orig_src_ip=10.10.2.24 <TRUNCATED> rule_id=<span style="font-size:11.0pt">
ACCESS2INTERNAL </span>rule_type=ALLOW<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">When a client is denied, it creates two log entries, each with portion of the logs filled out (i.e. orig_src_ip in the first log, and the requested url and the rule that I expected to match in second log):<o:p></o:p></p>
<p class="MsoNormal"><b>---> local_time="[30/May/2019:07:20:32 -0400]"</b> squid_service=explicit squid_status=TCP_DENIED squid_hierarchy_status=HIER_NONE ** haproxy_id=5CEFBC7F_0AFB14CC_0AFB1621_206C_9DBE_461F orig_src_ip=10.10.2.24 <TRUNCATED> error_page_presented=ERR_ACCESS_DENIED
err_detail="-" rule_id=- rule_type=-<o:p></o:p></p>
<p class="MsoNormal"><b><o:p> </o:p></b></p>
<p class="MsoNormal"><b>---> local_time="[30/May/2019:07:20:32 -0400]"</b> squid_service=explicit squid_status=NONE squid_hierarchy_status=HIER_NONE ** haproxy_id=- orig_src_ip=- <TRUNCATED> request_method=GET request="GET https://example.org/ HTTP/1.1" status_code_from_server=403
status_code_to_client=- <TRUNCATED> error_page_presented=ERR_ACCESS_DENIED err_detail="-" rule_id=<span style="font-size:11.0pt"> ACCESS2INTERNAL
</span>rule_type=<o:p></o:p></p>
<p class="MsoNormal">ALLOW<o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">So my questions are these:<o:p></o:p></span></p>
<ol style="margin-top:0in" start="1" type="1">
<li class="MsoListParagraph" style="margin-left:0in;mso-list:l0 level1 lfo1"><span style="font-size:11.0pt">Is there a better way to log which rules a connection matches?<o:p></o:p></span></li><li class="MsoListParagraph" style="margin-left:0in;mso-list:l0 level1 lfo1"><span style="font-size:11.0pt">Why does the denied log twice and not as a single log entry? Why isn't the requested URL logged in the first log entry and then done.<o:p></o:p></span></li><li class="MsoListParagraph" style="margin-left:0in;mso-list:l0 level1 lfo1"><span style="font-size:11.0pt">Why do I see two squid_status types on the denied (TCP_DENIED and NONE)?<o:p></o:p></span></li></ol>
</div>
</body>
</html>