[squid-users] SQUID syslog to rsyslog server (v2.7 Windows)

[Amos Jeffries]

On 21/07/2016 11:52 p.m., Full Name wrote:
> 
> We've added in the two lines below to the 'squid.conf' file and restarted the service, but syslog traffic does not appear to be currently flowing:
> (The hashed out line was what was previously being used with data successfully being logged to a local file.)
> 
>    access_log udp://10.203.193.25:514 squid
>    access_log syslog:local0.info squid
>    #access_log c:/ClientSiteProxy/var/logs/Access.log
> 
> Are these the correct command directives and in the correct format?

Yes, but syslog is a Unix/Linux/BSD feature. AFAIK, Windows native
builds do not support it.

There are Windows builds for current Squid-3.5 versions available.
<http://wiki.squid-cache.org/KnowledgeBase/Windows>
Since these builds use Cygwin environment they should support syslog.

PS. Squid 2.7 is no longer supported since August 2011.

> 
> There is reference to there being a syslog 'facility' which we've arbitrarily picked 'local0'  However cannot find anything in the reference that states the meaning of each of the facility options.
> 

They are defined under "facility" here:
 <http://linux.die.net/man/3/syslog>

Basically the facility determines whether and how any particular
security measures, or log reporting tool handles it. The specifics
depend on how the log server has been setup.

Amos