> Hi,
>
> I'm trying to modify logformat to display header of this folowing
> websites. My purpose is to be able to use the correct pattern for
> refresh_pattern. Here are my rules
>
> acl googlevideo url_regex -i googlevideo\.com
> acl kaspersky url_regex -i kaspersky\.com
> acl kaspersky-labs url_regex -i kaspersky-labs\.com
> acl metacafe url_regex -i metacafe\.com
> acl apple url_regex -i phobos\.apple\.com
> acl pornhub url_regex -i pornhub\.com
Please, use dstdomain for this type of matching. It's much faster than regex.
>
> logformat squid %ts.%03tu %6tr %>a %Ss/%03Hs %<st %rm %ru %un %Sh/%<A %mt
> logformat analisa %{%H:%M:%S}tl %-13>a %-6<st %03Hs %-17Ss %-24mt %-6tr
> %ru *REQ* *C:%{Cache-Control}>h *P:%"{Pragma}>h *LMS:
> %"{Last-Modified}>h *REP* *C:%"{Cache-Control}<h *P:%"{Pragma}<h
> *LMS:%"{Last-Modified}<h *Exp:%"{Expires}<h
>
> access_log /var/log/squid/analisa.log analisa googlevideo kaspersky
> kaspersky-labs metacafe apple pornhub
> access_log /var/log/squid/access.log squid
>
> The rules above did not work. The file analisa.log is empty even after I
> accessed several websites above. Did I miss something? Any help would be
> greatly appreciated.
>
The <h and >h bit goes before the {}.
For example: %<h{Expires}
Amos
