I understand, thank you. So, I'm mucking with log modules in 3.HEAD now, but not understanding the process 100% from the LogModules docs page. There are modules (udp, tcp, etc) that I configure for each log file, such as: access_log udp://localhost:1000 cache_store_log upd://localhost:1001 Seems easy enough. But what is this log_file_daemon? Is that a helper akin to a auth/acl helper that reads info from STDIN? If so, the best approach seems to be a log helper, started by squid, which could cache the logs to disk if the external logfile processing app is down. UDP/TCP makes me nervous in case the log helper process is ever down or started in the wrong order by human error (it's just an extra dependency to manage). If this is the scheme in place here, can you give me a couple of sentences describing the creation of a log helper? What is it's input/output protocol & method? What log files is it applicable to? Does squid start the process and manage it? Thanks! David -----Original Message----- From: Amos Jeffries [mailto:squid3@xxxxxxxxxxxxx] Sent: Wednesday, June 09, 2010 8:41 PM To: squid-users@xxxxxxxxxxxxxxx Subject: Re: Rotating logs restarts authentication/acl helpers? On Wed, 9 Jun 2010 18:49:22 -0600, "David Parks" <davidparks21@xxxxxxxxx> wrote: > Using 3.1.4, when I call squid -k rotate to rotate the logs, it restarts > all the authentication and acl helpers. > Why is this? I have an ACL helper running for every request (very quick), > and the reload of logs is causing it to be down for ~10 seconds. > I would like to be able to parse logs every 30 seconds for near-real-time > reporting. This is because the helpers are attached to the cache.log for debugging and error reporting. This has always been the case AFAIK. Use the log daemon: feature instead for real-time access to log data. It lets you easily create a daemon script to receive and do anything with the log lines. http://wiki.squid-cache.org/Features/LogDaemon Amos
