.
.
Hi
Why do I see multiple different lines in access.log file?
Is every line a separate request?
I used ssl-bump , peek at_step sslbump1 and then based on my ACL,I bump them or splice them!
my squid.conf for log:
logformat squid2 %ts %{%Y %b %d %H:%M:%S}tl %>a %<a %<A %ru %>Hs %<Hs %ssl::bump_mode
For example for google.com I see multiple lines in access.log:
1563634658 2019 Jul 20 19:27:38 40.0.0.40 - - 216.58.208.67:443 200 - splice
1563634658 2019 Jul 20 19:27:38 40.0.0.40 - - 216.58.208.67:443 200 - splice
1563634659 2019 Jul 20 19:27:39 40.0.0.40 - - 172.217.18.130:443 200 - splice
1563634659 2019 Jul 20 19:27:39 40.0.0.40 - - 216.58.208.78:443 200 - splice
1563634659 2019 Jul 20 19:27:39 40.0.0.40 - - 172.217.18.130:443 200 - splice
1563634658 2019 Jul 20 19:27:38 40.0.0.40 - - 216.58.208.67:443 200 - splice
1563634659 2019 Jul 20 19:27:39 40.0.0.40 - - 172.217.18.130:443 200 - splice
1563634659 2019 Jul 20 19:27:39 40.0.0.40 - - 216.58.208.78:443 200 - splice
1563634659 2019 Jul 20 19:27:39 40.0.0.40 - - 172.217.18.130:443 200 - splice
where is https:// google.com in the this log?
If i denied google , access.log shows:
1563634748 2019 Jul 20 19:29:08 40.0.0.40 172.217.18.130 googleads.g.doubleclick.net googleads.g.doubleclick.net:443 200 - splice
1563634748 2019 Jul 20 19:29:08 40.0.0.40 216.58.208.78 apis.google.com apis.google.com:443 200 - splice
1563634748 2019 Jul 20 19:29:08 40.0.0.40 172.217.18.130 adservice.google.com adservice.google.com:443 200 - splice
1563634748 2019 Jul 20 19:29:08 40.0.0.40 216.58.208.67 ssl.gstatic.com ssl.gstatic.com:443 200 - splice
1563634748 2019 Jul 20 19:29:08 40.0.0.40 216.58.208.67 www.gstatic.com www.gstatic.com:443 200 - splice
1563634748 2019 Jul 20 19:29:08 40.0.0.40 172.217.18.132 www.google.com www.google.com:443 200 - splice
1563634748 2019 Jul 20 19:29:08 40.0.0.40 172.217.18.132 www.google.com www.google.com:443 200 - splice
1563634748 2019 Jul 20 19:29:08 40.0.0.40 172.217.18.132 172.217.18.132 172.217.18.132:443 200 - bump
1563634749 2019 Jul 20 19:29:09 40.0.0.40 134.0.216.195 detectportal.firefox.com http://detectportal.firefox.com/success.txt 200 200 -
1563634749 2019 Jul 20 19:29:09 40.0.0.40 - - 99.86.163.28:443 200 - splice
1563634748 2019 Jul 20 19:29:08 40.0.0.40 216.58.208.78 apis.google.com apis.google.com:443 200 - splice
1563634748 2019 Jul 20 19:29:08 40.0.0.40 172.217.18.130 adservice.google.com adservice.google.com:443 200 - splice
1563634748 2019 Jul 20 19:29:08 40.0.0.40 216.58.208.67 ssl.gstatic.com ssl.gstatic.com:443 200 - splice
1563634748 2019 Jul 20 19:29:08 40.0.0.40 216.58.208.67 www.gstatic.com www.gstatic.com:443 200 - splice
1563634748 2019 Jul 20 19:29:08 40.0.0.40 172.217.18.132 www.google.com www.google.com:443 200 - splice
1563634748 2019 Jul 20 19:29:08 40.0.0.40 172.217.18.132 www.google.com www.google.com:443 200 - splice
1563634748 2019 Jul 20 19:29:08 40.0.0.40 172.217.18.132 172.217.18.132 172.217.18.132:443 200 - bump
1563634749 2019 Jul 20 19:29:09 40.0.0.40 134.0.216.195 detectportal.firefox.com http://detectportal.firefox.com/success.txt 200 200 -
1563634749 2019 Jul 20 19:29:09 40.0.0.40 - - 99.86.163.28:443 200 - splice
Thank you
_______________________________________________ squid-users mailing list squid-users@xxxxxxxxxxxxxxxxxxxxx http://lists.squid-cache.org/listinfo/squid-users
