[squid-users] Logging ICAP headers in access log

[Amos Jeffries]

On 13/04/19 9:21 am, johnr wrote:
> Hi,
> 
> I am attempting to log ICAP headers in the access log. Specifically, I
> modify my logformat directive to include something like
> {x-icap-info}icap::>h for a header x-icap-info that is available in the icap
> request headers. 
> 
> From the logformat documentation
> (http://www.squid-cache.org/Doc/config/logformat/) it says that log codes
> mentioned in icap_log (http://www.squid-cache.org/Doc/config/icap_log/) are
> available if icap is enabled. I am able to successfully log icap:tt in the
> access log, but logging the headers has not been working. 
> 
> Am I mistaken in thinking this is possible or is it perhaps just a case of
> not using the correct syntax?

Is ICAP REQMOD or ICAP RESPMOD or both being used?

Are multiple ICAP services being used?

Are ICAP access controls being used?
 if so what config?

What *are* you seeing logged?

What exactly is the header name you are trying to log?

Have you tried it with case-sensitive naming?

Have you tried just %icap::>h to show the full set of ICAP headers the
transaction has when logging to access.log?

Please be aware that the ICAP codes are only expected to produce output
*if* the HTTP transaction was passed to an ICAP server. Some requests do
not get that far and should be producing a '-' instead.


Does cache.log contain any mention of problems?
  particularly on startup or reconfigure.

Does "squid -k parse" mention any WARNING or ERROR about your config?
 If so please fix those to ensure no bad config is interferring.

And finally, what version and build of Squid are you using?
 (output of "squid -v" please)


Amos