Change squid3 access.log

loggingsquid

Where lies the config file to change the output of the access.log file?
I want to remove the website the user was browsing and format the time so it's human readable.

Best Answer

You can define a custom log format in squid.conf with the logformat directive. This can then be used in the access_log directive:

logformat nourl  %tl %6tr %>a %Ss/%03>Hs %<st %[un %Sh/%<a %mt
access_log daemon:/usr/local/squid/var/logs/access.log nourl

will output a log file similar to the squid default, with time in local time and HTTP method and URL removed.

Related Solutions

Linux – Date time in access.log file

Something like

perl -p -e 's/^([0-9]*)/"[".localtime($1)."]"/e' < access.log

could help you with the last part (tail-ing the log). Found it on a Squid mailing list.

Correlating data within Kibana

Ultimately for the most part these two features I've just learned to live without. Generally the data gets parsed down pretty well from filters, and fortunately Windows event logs already provide decent details of the event, so I just have learned to live with just digging into the message to get the information.

Best Answer

Related Solutions

Linux – Date time in access.log file

Correlating data within Kibana

Related Topic