[squid-users] Squid 3.1 access_log and log module syslog sets program-name as (squid)

[Amos Jeffries]

On 25/06/2015 6:49 p.m., YogiBearNL aka Ronald wrote:
> Squid v2.7: 
> 
> Jun 25 08:36:37 proxy SQUID[16271]:
> 192.168.2.85 - - [25/Jun/2015:08:36:37 +0200] "GET
> http://tpc.googlesyndication.com/safeframe/1-0-2/html/container.html
> HTTP/1.1" 200 2439 "http://tweakers.net/" "Mozilla/5.0 (Macintosh; Intel
> Mac OS X 10_8_0) AppleWebKit/400.5.3 (KHTML, like Gecko) Version/5.2.3
> Safari/427.8.5" TCP_MISS:DIRECT 
> 
> Squid v3.1.6: 
> 
> Jun 24 21:47:56 proxy
> (SQUID): 192.168.2.85 - - [24/Jun/2015:21:47:56 +0200] "GET
> http://cdn.viglink.com/images/pixel.gif? HTTP/1.1" 200 639
> "http://www.zdnet.com/blog/central-europe/" "Mozilla/5.0 (Macintosh;
> Intel Mac OS X 10_8_0) AppleWebKit/400.5.3 (KHTML, like Gecko)
> Version/5.2.3 Safari/427.8.5" TCP_MISS:DIRECT 
> 
> When I try to parse the
> syslog lines, the ones with the (squid) as a program name fail because
> there are not normal syslog lines.
> Why is this happening ? And is this
> fixed in a later release ? Or maybe it's some configuration problem
> ?

Squid (both versions) is using the OS syslog() API to deliver these log
entries. The bits up to and inluding the '(SQUID):' and 'SQUID[16271]:'
are all generated by the syslog kernel daemon.

This is weird output, but I think its due to a change in the syslog
application.

Amos