[squid-users] Squid full request logging

[Alex Rousskov]

On 3/4/21 2:52 PM, Niels Hofmans wrote:

> is it possible to do full request/response logging?

Squid can log HTTP headers with %>h and %<h logformat codes.

Squid cannot log HTTP message bodies.


> I do not see the appropriate log_format directive in the docs.
> I was hoping not having to do this in my ICAP service since this slows
> down approval of the HTTP request. (Empty preview v.s. a request capped
> at 1MB that needs to be sent over every time)

FWIW, an ICAP or eCAP service can start responding to the request
_before_ the service receives the entire HTTP message body. To get
things going, all the service needs is HTTP headers (and even that is,
technically, optional in some cases).

Using an adaptation service is still an overhead, of course, but, very
few legitimate Squid use cases involve logging message bodies, so there
is no built-in mechanism optimized for that specific rare purpose
(yet?). The fastest option available today is probably a dedicated eCAP
service that refuses to adapt the message bit continues to receive (and
log) the message body.


HTH,

Alex.