Re: [squid-users] Log Format

On tis, 2008-06-17 at 16:37 -0400, Jonathan Chretien wrote:

> Is there a way to purge the access log to get only the URL that the user requested when he clicked on a link or when he typed the address in the address bar ?

There is no difference between clicking on a link or objects composing a
page.

But if the browser behaves you should be able to identify addresses
typed in the url-bar by matching requests without a referer header, but
that will most likely cut down the logs far too much to be usable.

Consider this example that your HR most likely wants to know about:

Someone sends an email with some really bad addresses to one of your
users hotmail accounts.

The user logs in on hotmail, gets realle excited about that email,
clicks on the link and browses those pages for hours, gets infected by
trojanst stealing all of you company internal trade secrets etc.

In HTTP clicking on a link is no different than a page downloading an
external ad banner.. both are references from that page, and both may
contain text/html content, or other content..

Regards
Henrik