<div dir="auto"><div dir="auto"><span style="font-family:sans-serif">Hi Alex, </span></div><div dir="auto"><span style="font-family:sans-serif"><br></span></div><div dir="auto"><span style="font-family:sans-serif">Thanks for confirming, I lost hope. Can you share some link or details about below</span></div><div dir="auto"><span style="font-family:sans-serif"><br></span></div><div><span style="font-family:sans-serif">> There are other ways to police</span><br style="font-family:sans-serif"><span style="font-family:sans-serif">traffic (e.g., browser plugins), but they all require fiddling with the</span><br style="font-family:sans-serif"><span style="font-family:sans-serif">client environment.</span><br><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, May 6, 2020, 7:56 PM Alex Rousskov <<a href="mailto:rousskov@measurement-factory.com">rousskov@measurement-factory.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">On 5/6/20 8:58 AM, Akshay Hegde wrote:<br>
<br>
> 1. Is there any way to filter HTTPS URLs without importing CA<br>
> certificates on client side?<br>
<br>
No, there is no way for a proxy to look at request URLs without the<br>
browser trusting the proxy certificate. There are other ways to police<br>
traffic (e.g., browser plugins), but they all require fiddling with the<br>
client environment.<br>
<br>
<br>
> 2. for 16GB RAM, 4 core CPU, 8GB Swap, expected to have 10GB cache, how<br>
> to calculate configurations parameters, is there any thumb rule ?<br>
<br>
I believe there is some related advice on Squid wiki:<br>
<a href="https://wiki.squid-cache.org/SquidFaq/SquidMemory" rel="noreferrer noreferrer" target="_blank">https://wiki.squid-cache.org/SquidFaq/SquidMemory</a><br>
<br>
HTH,<br>
<br>
Alex.<br>
<br>
<br>
> # config<br>
> cache_mgr webmaster<br>
> cache deny QUERY<br>
> cache_mem 256 MB<br>
> cache_swap_low 90<br>
> cache_swap_high 95<br>
> maximum_object_size 4 MB<br>
> minimum_object_size 0 KB<br>
> maximum_object_size_in_memory 512 kB<br>
> ipcache_size 2048<br>
> ipcache_low 90<br>
> ipcache_high 95<br>
> fqdncache_size 1024<br>
> cache_replacement_policy lru<br>
> memory_replacement_policy lru<br>
> cache_dir ufs /var/spool/squid 10000 16 256<br>
> cache_effective_user squid<br>
> cache_effective_group squid<br>
> cache_log /var/log/squid/cache.log<br>
> cache_store_log /var/log/squid/store.log<br>
> memory_pools on<br>
> memory_pools_limit 5 MB<br>
> <br>
> # SSL-Bump -working but not feasible.<br>
> http_port 3128 ssl-bump cert=/etc/squid/sslcert/proxyCA.pem<br>
> generate-host-certificates=on dynamic_cert_mem_cache_size=4MB<br>
> sslcrtd_program /usr/lib64/squid/security_file_certgen -s<br>
> /var/spool/squid/ssl_db -M 4MB<br>
> sslcrtd_children 5<br>
> acl step1 at_step SslBump1<br>
> ssl_bump peek step1<br>
> ssl_bump bump all<br>
> <br>
> ------------------------------------ My New Environment --------------------<br>
> # squid -v<br>
> Squid Cache: Version 4.4<br>
> Service Name: squid<br>
> <br>
> # cat /etc/redhat-release<br>
> CentOS Linux release 8.1.1911 (Core)<br>
> <br>
> <br>
> # Tested ACLs<br>
> logformat test_log %ts.%03tu %6tr %>a %Ss/%03>Hs %<st %rm %>ru %[un<br>
> %Sh/%<a %mt<br>
> acl test_sites dstdomain "/etc/squid/acls/test_sites.acl"<br>
> access_log /var/log/squid/test_site.log test_log test_sites<br>
> <br>
> # tail -f /var/log/squid/test_site.log<br>
> 1588678050.178 3247 10.0.2.15 TCP_TUNNEL/200 28073 CONNECT<br>
> <a href="http://nav.sciencedirect.com:443" rel="noreferrer noreferrer" target="_blank">nav.sciencedirect.com:443</a> <<a href="http://nav.sciencedirect.com:443" rel="noreferrer noreferrer" target="_blank">http://nav.sciencedirect.com:443</a>> akshay<br>
> HIER_DIRECT/<a href="http://91.235.133.74" rel="noreferrer noreferrer" target="_blank">91.235.133.74</a> <<a href="http://91.235.133.74" rel="noreferrer noreferrer" target="_blank">http://91.235.133.74</a>> -<br>
> 1588678050.189 3942 10.0.2.15 TCP_TUNNEL/200 24000 CONNECT<br>
> <a href="http://nav.sciencedirect.com:443" rel="noreferrer noreferrer" target="_blank">nav.sciencedirect.com:443</a> <<a href="http://nav.sciencedirect.com:443" rel="noreferrer noreferrer" target="_blank">http://nav.sciencedirect.com:443</a>> akshay<br>
> HIER_DIRECT/<a href="http://91.235.133.74" rel="noreferrer noreferrer" target="_blank">91.235.133.74</a> <<a href="http://91.235.133.74" rel="noreferrer noreferrer" target="_blank">http://91.235.133.74</a>> -<br>
> 1588678050.355 2552 10.0.2.15 TCP_TUNNEL/200 788 CONNECT<br>
> <a href="http://nav.sciencedirect.com:443" rel="noreferrer noreferrer" target="_blank">nav.sciencedirect.com:443</a> <<a href="http://nav.sciencedirect.com:443" rel="noreferrer noreferrer" target="_blank">http://nav.sciencedirect.com:443</a>> akshay<br>
> HIER_DIRECT/<a href="http://91.235.133.74" rel="noreferrer noreferrer" target="_blank">91.235.133.74</a> <<a href="http://91.235.133.74" rel="noreferrer noreferrer" target="_blank">http://91.235.133.74</a>> -<br>
> 1588681419.635 647 10.0.2.15 TCP_MISS/200 402 POST<br>
> <a href="http://scratchpads.eu/modules/statistics/statistics.php" rel="noreferrer noreferrer" target="_blank">http://scratchpads.eu/modules/statistics/statistics.php</a> akshay<br>
> HIER_DIRECT/<a href="http://157.140.2.32" rel="noreferrer noreferrer" target="_blank">157.140.2.32</a> <<a href="http://157.140.2.32" rel="noreferrer noreferrer" target="_blank">http://157.140.2.32</a>> text/html<br>
> 1588681420.055 1069 10.0.2.15 TCP_MISS/200 46772 GET<br>
> <a href="http://scratchpads.eu/sites/all/themes/scratchpads_eu/images/shrimp-202px.png" rel="noreferrer noreferrer" target="_blank">http://scratchpads.eu/sites/all/themes/scratchpads_eu/images/shrimp-202px.png</a><br>
> akshay HIER_DIRECT/<a href="http://157.140.2.32" rel="noreferrer noreferrer" target="_blank">157.140.2.32</a> <<a href="http://157.140.2.32" rel="noreferrer noreferrer" target="_blank">http://157.140.2.32</a>> image/png<br>
> <br>
> <br>
> <br>
> <br>
> On Sat, May 2, 2020 at 1:00 AM Alex Rousskov<br>
> <<a href="mailto:rousskov@measurement-factory.com" target="_blank" rel="noreferrer">rousskov@measurement-factory.com</a><br>
> <mailto:<a href="mailto:rousskov@measurement-factory.com" target="_blank" rel="noreferrer">rousskov@measurement-factory.com</a>>> wrote:<br>
> <br>
> On 5/1/20 12:43 PM, Akshay Hegde wrote:<br>
> <br>
> > I have below option globally, which I don't want to make "off"<br>
> > strip_query_terms on<br>
> <br>
> > acl track dstdomain "/etc/squid/sites_track.txt"<br>
> > access_log /var/log/squid/full_site_links.log squid_custom track<br>
> <br>
> > however for specific ACL I would like to log full URL with query<br>
> > parameters, how this can be done ?<br>
> <br>
> I have not tested this, and the results may be version-dependent, but<br>
> according to logformat documentation[1], %ru honors strip_query_terms<br>
> while %>ru does not:<br>
> <br>
> logformat strippedFormat %ts... %ru ...<br>
> access_log ... strippedFormat track !specific_ACL<br>
> <br>
> logformat detailedFormat %ts... %>ru ...<br>
> access_log ... detailedFormat track specific_ACL<br>
> <br>
> [1] <a href="http://www.squid-cache.org/Doc/config/logformat/" rel="noreferrer noreferrer" target="_blank">http://www.squid-cache.org/Doc/config/logformat/</a><br>
> <br>
> <br>
> HTH,<br>
> <br>
> Alex.<br>
> <br>
> > On Fri, May 1, 2020 at 7:05 PM Alex Rousskov wrote:<br>
> ><br>
> > On 5/1/20 1:20 AM, Akshay Hegde wrote:<br>
> ><br>
> > > *1. How to disable logging of few ACLs ?<br>
> ><br>
> > Use "access_log none aclX" to prevent creation of access.log<br>
> records for<br>
> > transactions matching aclX. See<br>
> > <br>
> <a href="http://lists.squid-cache.org/pipermail/squid-users/2020-April/021876.html" rel="noreferrer noreferrer" target="_blank">http://lists.squid-cache.org/pipermail/squid-users/2020-April/021876.html</a><br>
> > for<br>
> > some related caveats.<br>
> ><br>
> ><br>
> > > *2. Kernel Out of Memory<br>
> ><br>
> > This problem is most likely unrelated to logging. If your Squid is<br>
> > gradually leaking memory (rather than just being overwhelmed with<br>
> > traffic), then the first step towards removing those memory<br>
> leaks would<br>
> > be to upgrade your Squid from the unsupported and buggy v3.1.10.<br>
> ><br>
</blockquote></div></div></div>