> Edward C. Jakosalem wrote: >>> Hi, >>> >>> Edward C. Jakosalem wrote: >>>>> tis 2007-04-17 klockan 20:55 +1000 skrev Edward C. Jakosalem: >>>>> >>>>>> I have posted this same problem before but I want to post it again >>>>>> because >>>>>> I am pressured to make this work with Squid. I know that Squid's use >>>>>> is >>>>>> either an accelerator or proxy or both. But we want Squid to _only_ >>>>>> capture web traffic and log them, that's all. As such, I have >>>>>> configured >>>>>> my server to act as transparent proxy. >>>>> I don't quite get what you are trying to do here.. Do you want Squid >>>>> to >>>>> act as a transparent proxy by intercepting port 80 traffic and have >>>>> it >>>>> redirected to Squid, or do you just want to audit the port 80 traffic >>>>> without actually touching the packets by just listening on a switch >>>>> mirror/monitor port? >>>> I actully just need squid to act as transparent proxy so I can log >>>> traffic. I don't care how squid will do this, I just need the logs. >>>> And >>>> the reason why we use the mirrored port is that we don't want browsing >>>> affected in case this server goes down. >>> So you want Squid to be in the path but don't want it to affect >>> anything >>> if it goes down? That can't be done, unless you can use WCCP to ignore >>> it if it's down. Never played with WCCP so I don't know if it's >>> possible. I've always 'done the right thing' and told my browsers >>> about >>> the proxy! >>> >>> >>>>> The first can be done by Squid, and any of the interception methods >>>>> will >>>>> work. WCCP, Policy routing etc.. >>>>> >>>>> The second is not a job for Squid. You need a packet analyzer/auditor >>>>> for this. There is quite many different ones depending on what you >>>>> are >>>>> looking for.. >>>> We specifically need the Squid log format that's why we want to make >>>> this >>>> work with squid. My boss doesn't want it any other way. :-( >>> Why must he have Squid format logs? What's his business reason for >>> having to have them in that format? >> >> I honestly don't know. But the aim is to have a record of our customers' >> browsing activities and retain the logs for 6 months. >> >>> Squid is probably the wrong tool for the job and won't work how you've >>> got it set up now so why not look around at other tools that are >>> designed for the job? >> >> I already did and told him that. I actually have a program called >> _packit_ >> up and running. I also found some other useful ones as well. But >> management said Squid can do it and if I can't make it to work, they >> will >> seek help from someone who knows how to. Hey, what's a lowly employee >> like >> me to do? :-( > > Well, it seems to have come down to who you trust to know more about the > software: the people who wrote it, or your managers and whoever gave > them the idea that squid was capable. > > Without knowing who yoru management are or their experience levels I am > thinking at this point that I have heard this story before. It sounds > like your management are not technical people and have been told by a > contact elsewhere that another business use squid to 'record logs of all > our customers activities' then jumped to conclusions. > > Squid _can_ sit between your clients and the web and do it. But it does > need to be in the actual traffic path. > > SO, you can take a proposal to your management (maybe with costings) for > a robust set of squid cache(s) to be your gateway to the net, you are in > the best position to know what is needed for your company given that > 'cannot fail' requirement you mentioned earlier. > > OR, I'm sure between us all we can work up a suitable large quote for > the work it would take a developer to make squid capable of sitting on a > mirror port. (I'll start the bidding randomly at a nice round $500k and > see where that goes if you like ;-). > > OR, you can go back to your management with our (developers and expert > users) support for the argument that squid cannot do it in any known > version and get them to supply the source of their 'it can' information > to help you do it. As as side if they actually come up with a source > we'd like to know who's doing it. Arguments very well noted Amos. I think this last option is the best. Thank you very much! Edward > > > Amos > >
