Re: [squid-users] Logging By IP Address

Michael wrote:
> I am interested in recording the activity of only certain IP addresses.
> Is there a way to tell Squid to ignore activity coming from a specific
> range of addresses?

I'd have suggested using egrep to create a subset/second file from the
normal/main access.log file of just the IP's you want to track and then
discarding the old log nightly when it gets rotated, but I assume you've
already thought of that or something similar and need realtime instead of
hourly/daily type logs.

Then I thought maybe Henrik's customlog patch would do this but looking at
the conf notes (near the bottom of the patch:
http://devel.squid-cache.org/cgi-bin/diff2/customlog-2.5?s2_5 ) it looks
like it tells you what to log not what gets logged. But check for yourself
as I only skimmed it.

To create a perl daemon that constantly tee's/tail's the IP range you want,
I've seen Henrik recommend the File:Tail module of perl (he calls it tail -f
on steroids) to create a running subset of your main logs (check
groups.google.com for more info).

P.S. Your subject "Logging by IP Address" at first made me think that you
wanted squid to log the IP instead of the hostname. Since squid logs the IP
by default, if you are logging the hostname/FDQN then you've set log_fqdn to
"on" and should comment it out and then restart/reconfigure squid to go back
to the default of off.

hth

adam
Received on Wed Jul 30 2003 - 14:27:19 MDT