<div dir="ltr"><div dir="ltr"><div>Hi Alex,</div><div><br></div><div>I updated to latest squid as you suggested, and I tried SSL-Bump using below config (which filters URLs which are in 443 too), however I have 600 users (windows, linux, Mac, mobile OS like Androd, Windows etc), so asking them to import CA certificate in browser is not feasible. <br></div><div><br></div><div>1. Is there any way to filter HTTPS URLs without importing CA certificates on client side? if available can you share config snippet<br></div><div>2. for 16GB RAM, 4 core CPU, 8GB Swap, expected to have 10GB cache, how to calculate configurations parameters, is there any thumb rule ? please share how you usually calculate. <br></div><div><br></div><div># config<br></div><div>cache_mgr webmaster <br>cache deny QUERY<br>cache_mem 256 MB<br>cache_swap_low 90<br>cache_swap_high 95<br>maximum_object_size 4 MB<br>minimum_object_size 0 KB<br>maximum_object_size_in_memory 512 kB<br>ipcache_size 2048<br>ipcache_low 90<br>ipcache_high 95<br>fqdncache_size 1024<br>cache_replacement_policy lru<br>memory_replacement_policy lru<br>cache_dir ufs /var/spool/squid 10000 16 256<br>cache_effective_user squid<br>cache_effective_group squid<br>cache_log /var/log/squid/cache.log<br>cache_store_log /var/log/squid/store.log<br>memory_pools on<br>memory_pools_limit 5 MB<br></div><div><br></div><div># SSL-Bump -working but not feasible. </div><div>http_port 3128 ssl-bump cert=/etc/squid/sslcert/proxyCA.pem generate-host-certificates=on dynamic_cert_mem_cache_size=4MB<br>sslcrtd_program /usr/lib64/squid/security_file_certgen -s /var/spool/squid/ssl_db -M 4MB<br>sslcrtd_children 5<br>acl step1 at_step SslBump1<br>ssl_bump peek step1<br>ssl_bump bump all<br></div><div><br></div><div>------------------------------------ My New Environment --------------------<br></div><div># squid -v<br>Squid Cache: Version 4.4<br>Service Name: squid</div><div><br></div><div># cat /etc/redhat-release <br>CentOS Linux release 8.1.1911 (Core) <br></div><div><br></div><div><br></div><div># Tested ACLs</div><div>logformat test_log %ts.%03tu %6tr %>a %Ss/%03>Hs %<st %rm %>ru %[un %Sh/%<a %mt<br>acl test_sites dstdomain "/etc/squid/acls/test_sites.acl"<br>access_log /var/log/squid/test_site.log test_log test_sites</div><div><br></div><div># tail -f /var/log/squid/test_site.log <br>1588678050.178 3247 10.0.2.15 TCP_TUNNEL/200 28073 CONNECT <a href="http://nav.sciencedirect.com:443" target="_blank">nav.sciencedirect.com:443</a> akshay HIER_DIRECT/<a href="http://91.235.133.74" target="_blank">91.235.133.74</a> -<br>1588678050.189 3942 10.0.2.15 TCP_TUNNEL/200 24000 CONNECT <a href="http://nav.sciencedirect.com:443" target="_blank">nav.sciencedirect.com:443</a> akshay HIER_DIRECT/<a href="http://91.235.133.74" target="_blank">91.235.133.74</a> -<br>1588678050.355 2552 10.0.2.15 TCP_TUNNEL/200 788 CONNECT <a href="http://nav.sciencedirect.com:443" target="_blank">nav.sciencedirect.com:443</a> akshay HIER_DIRECT/<a href="http://91.235.133.74" target="_blank">91.235.133.74</a> -</div><div>1588681419.635 647 10.0.2.15 TCP_MISS/200 402 POST <a href="http://scratchpads.eu/modules/statistics/statistics.php" target="_blank">http://scratchpads.eu/modules/statistics/statistics.php</a> akshay HIER_DIRECT/<a href="http://157.140.2.32" target="_blank">157.140.2.32</a> text/html<br>1588681420.055 1069 10.0.2.15 TCP_MISS/200 46772 GET <a href="http://scratchpads.eu/sites/all/themes/scratchpads_eu/images/shrimp-202px.png" target="_blank">http://scratchpads.eu/sites/all/themes/scratchpads_eu/images/shrimp-202px.png</a> akshay HIER_DIRECT/<a href="http://157.140.2.32" target="_blank">157.140.2.32</a> image/png</div><div><br></div><div><br></div><div><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Sat, May 2, 2020 at 1:00 AM Alex Rousskov <<a href="mailto:rousskov@measurement-factory.com" target="_blank">rousskov@measurement-factory.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">On 5/1/20 12:43 PM, Akshay Hegde wrote:<br>
<br>
> I have below option globally, which I don't want to make "off"<br>
> strip_query_terms on<br>
<br>
> acl track dstdomain "/etc/squid/sites_track.txt"<br>
> access_log /var/log/squid/full_site_links.log squid_custom track<br>
<br>
> however for specific ACL I would like to log full URL with query<br>
> parameters, how this can be done ?<br>
<br>
I have not tested this, and the results may be version-dependent, but<br>
according to logformat documentation[1], %ru honors strip_query_terms<br>
while %>ru does not:<br>
<br>
logformat strippedFormat %ts... %ru ...<br>
access_log ... strippedFormat track !specific_ACL<br>
<br>
logformat detailedFormat %ts... %>ru ...<br>
access_log ... detailedFormat track specific_ACL<br>
<br>
[1] <a href="http://www.squid-cache.org/Doc/config/logformat/" rel="noreferrer" target="_blank">http://www.squid-cache.org/Doc/config/logformat/</a><br>
<br>
<br>
HTH,<br>
<br>
Alex.<br>
<br>
> On Fri, May 1, 2020 at 7:05 PM Alex Rousskov wrote:<br>
> <br>
> On 5/1/20 1:20 AM, Akshay Hegde wrote:<br>
> <br>
> > *1. How to disable logging of few ACLs ?<br>
> <br>
> Use "access_log none aclX" to prevent creation of access.log records for<br>
> transactions matching aclX. See<br>
> <a href="http://lists.squid-cache.org/pipermail/squid-users/2020-April/021876.html" rel="noreferrer" target="_blank">http://lists.squid-cache.org/pipermail/squid-users/2020-April/021876.html</a><br>
> for<br>
> some related caveats.<br>
> <br>
> <br>
> > *2. Kernel Out of Memory<br>
> <br>
> This problem is most likely unrelated to logging. If your Squid is<br>
> gradually leaking memory (rather than just being overwhelmed with<br>
> traffic), then the first step towards removing those memory leaks would<br>
> be to upgrade your Squid from the unsupported and buggy v3.1.10.<br>
> <br>
> <br>
> HTH,<br>
> <br>
> Alex.<br>
> <br>
> <br>
> <br>
> -- <br>
> <<a href="https://about.me/akshay.k.hegde?promo=email_sig&utm_source=product&utm_medium=email_sig&utm_campaign=edit_panel&utm_content=thumb" rel="noreferrer" target="_blank">https://about.me/akshay.k.hegde?promo=email_sig&utm_source=product&utm_medium=email_sig&utm_campaign=edit_panel&utm_content=thumb</a>><br>
> <br>
> Akshay Hegde<br>
> <a href="http://about.me/akshay.k.hegde" rel="noreferrer" target="_blank">about.me/akshay.k.hegde</a><br>
> <<a href="https://about.me/akshay.k.hegde?promo=email_sig&utm_source=product&utm_medium=email_sig&utm_campaign=edit_panel&utm_content=thumb" rel="noreferrer" target="_blank">https://about.me/akshay.k.hegde?promo=email_sig&utm_source=product&utm_medium=email_sig&utm_campaign=edit_panel&utm_content=thumb</a>><br>
> <br>
> <br>
<br>
</blockquote></div><br clear="all"><br>-- <br><div dir="ltr"><div dir="ltr"><div><table cellspacing="0" cellpadding="0" border="0">
<tbody>
<tr>
<td style="line-height:0;vertical-align:bottom;padding-right:10px;padding-top:20px;padding-bottom:20px" width="107" valign="bottom" align="left">
<a href="https://about.me/akshay.k.hegde?promo=email_sig&utm_source=product&utm_medium=email_sig&utm_campaign=edit_panel&utm_content=thumb" style="text-decoration:none" target="_blank">
<img src="https://thumbs.about.me/thumbnail/users/a/k/s/akshay.k.hegde_emailsig.jpg?_1482928744_22" alt="" style="margin: 0px; padding: 0px; display: block; border: 1px solid rgb(238, 238, 238);" width="105" height="70">
</a>
</td>
<td style="line-height:1.1;vertical-align:bottom;padding-top:20px;padding-bottom:20px" valign="bottom" align="left">
<img src="https://about.me/t/sig?u=akshay.k.hegde" style="border: 0px none; margin: 0px; padding: 0px; overflow: hidden;" width="1" height="1">
<div style="font-size:18px;font-weight:bold;color:rgb(51,51,51);font-family:"Proxima Nova",Helvetica,Arial,sans-serif">Akshay Hegde</div>
<a href="https://about.me/akshay.k.hegde?promo=email_sig&utm_source=product&utm_medium=email_sig&utm_campaign=edit_panel&utm_content=thumb" style="text-decoration:none;font-size:12px;color:rgb(43,130,173);font-family:"Proxima Nova",Helvetica,Arial,sans-serif" target="_blank">about.me/akshay.k.hegde
</a>
</td>
</tr>
</tbody>
</table>
</div></div></div>
</div>