[squid-users] Access log to syslog

[Amos Jeffries]

On 15/04/2016 5:35 p.m., stefand at korbitec.com wrote:
> I'm trying to log multiple ACLs to syslog using squid 3.3.8 on CentOS 7
> 
> When I add the line :
> 
> access_log syslog:local4.info squid ACL1 ACL2 ACL3
> 
> Nothing gets logged to syslog
> 
> However when I change the line to :
> 
> access_log syslog:local4.info squid ACL1
> 
> It logs correctly, but just for ACL1 (as expected)
> 
> Should I then rather have the configuration file with the following lines:
> 
> access_log syslog:local4.info squid ACL1
> access_log syslog:local4.info squid ACL2
> access_log syslog:local4.info squid ACL3
> 
> Doesn't make sense to me as the documentation states (http://www.squid-cache.org/Versions/v3/3.3/cfgman/access_log.html) :
> 
> access_log <module>:<place> [<logformat name> [acl acl ...]]
> 

Any list of ACL conditions in a line of squid.conf like that are joined
with a boolean "AND" condition. All of them must be true for the action
being decided to happen.

In this case the action is to record a log line about the current
transaction.
* In your first non-working setup (ACL1 and ACL2 and ACL3) had to be
true for it to record.
* In your second setup only ACL1 had to be true for it to record.

If you have not met them already take a look at the all-of and any-of
ACL types which can be used to join simpler ACLs into a single test with
complex conditions - like having brackets in the boolean test.

You may need to upgrade your Squid to get those newer ACL types. You can
find details of newer Squid pckages for CentOS at
<http://wiki.squid-cache.org/KnowledgeBase/CentOS>

Amos