Hi, I am the author of ufdbGuard and ufdbGuard supports Squid 5.x
The SARG error in access.log has nothing to do with ufdbGuard.
On 09/11/2021 08:45, Majed Zouhairy wrote:
hmmm, this started happening after the last squid update.. i just noticed it is now version 5.2
i have ufdbguard but i don't think i have smp..
the last line of squid conf are
url_rewrite_extras "%>a/%>A %un %>rm bump_mode=%ssl::bump_mode sni=\"%ssl::>sni\" referer=\"%{Referer}>h\""
url_rewrite_program /usr/local/ufdbguard/bin/ufdbgclient -m 4 -l /var/log/squid/
url_rewrite_children 16 startup=8 idle=2 concurrency=4 queue-size=64
i think ufdbguard does not support squid version 5 yet, which might be the problem
On 11/8/21 10:42 PM, Alex Rousskov wrote:
On 11/8/21 5:30 AM, Majed Zouhairy wrote:
when i run sarg
SARG: sarg version: 2.4.0 Jan-16-2020
SARG: Reading access log file: /var/log/squid/access.log
SARG: Log format identified as "squid log format" for
/var/log/squid/access.log
SARG: The following line read from /var/log/squid/access.log could not
be parsed and is ignored
1636349341.484 12 10.184.0.2 NONE_NONE/400 20417 GET
https://zen.yandex.by/lz5XeGt8f/ir4w02684/13f5fd2qrAJ2/p_CMhOoMLrxy4M2QFtQI-HLBvD5tHT6JdGbykwp9eDzBNcrpN2RIqcyiFH9pWekXwFsAEtIMz3_5FVo5y8zXIrAwGER6-e4cM0VckNJR_CjjEd2OObzKrHDSM2ZrfFzJ9CELTSJAeFt45wBcaGm_VqdcIXKVKFp7THc-uX7PdjLGAUpRv63aKSdE2OOnMXyOt0SJK0vNXql0thIirh9cGORGu31DYR9cCKZAW9gYjiGgfTFlxfgLOitwTohOyMZzx3ZNcK_K-rk2Vb_
....
UPVydoTW1636349696.714 629 10.106.0.2 NONE_NONE/200 0 CONNECT
azscus1-client-s.gateway.messenger.live.com:443 -
HIER_DIRECT/40.74.219.49 -
SARG: 4 consecutive errors found in the input log file
/var/log/squid/access.log
so i think the solution would be to exclude zen.yandex.by from processing ?
The correct solution would depend on what you are trying to accomplish
(with sarg), but that solution is unlikely to include disabling logging
of requests to any domains IMHO.
Based on the above output (that could have been changed by multiple mail
agents), it is difficult for me to guess what sarg did not like, but if
you are suffering from Squid SMP workers corrupting each-other
access.log entries, then please see Bug 5173:
https://bugs.squid-cache.org/show_bug.cgi?id=5173
HTH,
Alex.
_______________________________________________
squid-users mailing list
squid-users@xxxxxxxxxxxxxxxxxxxxx
http://lists.squid-cache.org/listinfo/squid-users
_______________________________________________
squid-users mailing list
squid-users@xxxxxxxxxxxxxxxxxxxxx
http://lists.squid-cache.org/listinfo/squid-users
