On 19/11/10 01:48, Jack Falworth wrote:
Hi squid-users,
I've a problem sending the cache.log to a remote syslog server. First
the facts:
I'm running squid 2.7 Stable9 on a Ubuntu 10.04 machine. For all
daemons I use syslog-ng to log to a remote syslog server. This works
perfectly fine for all daemons including the squid access log(s), but
I can't get it working for the cache.log.
Let's have a look at the config:
In the squid.conf I configured the following two access logs:
access_log syslog:local5.info squid
access_log syslog:local6.info some_custom_format
debug_options are default. Squid is started with "squid -s -DNYC -f
squid.conf"
In my syslog-ng.conf I configured this (for debugging purposes I also
logged to locale files):
filter f_squid_cache {
program(squid) and facility(local4);
};
destination d_local_squid_cache {
file("/var/log/squid/cache.log");
};
destination d_remote_squid_cache {
udp("someIP" port(514));
};
log {
source(s_local);
filter(f_squid_cache);
destination(d_local_squid_cache);
destination(d_remote_squid_cache);
};
The same goes for both access logs, only the facilities and the
identifier names are substituted.
As far as I understood the -s switch, squid send copies of cache.log
messages to syslog using the Local4 facility. Furthermore only
messages with level 0/1 are forwarded. This would be perfectly fine
for me.
When I now run squid with those configs, all three log files are sent
to syslog, matched and written to local files. Both access logs are
also sent to the remote syslog server as intended. But for some
unknown reason the cache log is only stored locally and is not sent
to the remote host (remember: same syslog configuration as for access
logs).
Running syslog-ng with debugging and verbose parameters does not give
me any information about the reason. Also there is no hint in the
cache.log. It is simply not working.
While playing with the squid program arguments I also noticed some
weird behavior, maybe a bug in squid. By omitting the -s switch,
squid is not intended to log the cache messages to syslog. But if the
cache.log pattern in the syslog-ng.conf remains I still receive the
cache.log messages in syslog (the cache_log directive in squid.conf
is not specified, thus using the default value)!? Maybe those things
are related.
Any suggestions?
-s could be local4 or could be daemon. The OS support decides.
Use -l with the facility label if you want to be sure of what it is.
As for when its not specified, the initial start sequence before
cache.log (file) is opened goes to stderr. The system daemon
infrastructure usually pipes such to syslog or messages logs.
Amos
--
Please be using
Current Stable Squid 2.7.STABLE9 or 3.1.9
Beta testers wanted for 3.2.0.3
