Search squid archive

RE: Logging failed authentication requests

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



>-----Original Message-----
>From: Amos Jeffries [mailto:squid3@xxxxxxxxxxxxx] 
>Sent: Wednesday, April 07, 2010 10:56 PM
>
>Mellem, Dan wrote:
>> Hi,
>> 
>> Thanks for your response. Please see below.
>> 
>>> From: Amos Jeffries [mailto:squid3@xxxxxxxxxxxxx] 
>>> Sent: Wednesday, April 07, 2010 7:33 PM
>>> On Wed, 07 Apr 2010 19:12:53 -0700, "Mellem, Dan"
>>
>> I do a:
>> tail -f access.log | fgrep '<my IP address>'
>> 
>> and only get responses for allowed traffic. I also don't 
>have any 407s
>> at all in the log.
>> You said the logging is on by default. Is there a way to it off or to
>> turn on debugging that would show where it's getting dropped?
>> 
[...]
>> 
>> If I type the wrong password, I get re-prompted for authentication
>> again. I get the normal:
>> 
>> GET
>>    407 Proxy Authentication Required
>> GET w/Proxy-Authorization: Basic (wrong password)
>>    407 Proxy Authentication Required
>> GET w/Proxy-Authorization: Basic (right password)
>>    200 OK
>> 
>
>Okay thats good then. Those 407 _should_ be in the access.log.
>
>If you grep the log for " 407 " (note the spaces) or the date 
>and minute 
>when the tests were done instead of your IP you may see them. 
>It should 
>have been visible with an IP though.
>
>The only ways to get things not logged is to add ACL after the 
>specific 
>access_log line, or to add "log_access" lines preventing things being 
>logged globally.
>
>Amos

Hi, Amos,

I searched the logs for 407 results and didn't find any at all (I
searched for '" 407 ' since I was getting some file sizes of 407 bytes
[the pattern '" 404 ' did find matches]).

The access log is the default, and has no ACL associated.
access_log /usr/local/squid/var/logs/access.log

There are no log_access entries in the configuration, either.


Update: OK, I found the problem. The accessLogLog() function in
access_log.c had been altered to only log successful requests. It was
left over from an old Smartfilter installation. I commented out the
lines and I'm now getting the 407 entries in the log. Thanks for your
help.

-Dan




[Index of Archives]     [Linux Audio Users]     [Samba]     [Big List of Linux Books]     [Linux USB]     [Yosemite News]

  Powered by Linux