Re: [squid-users] More flexible logging options?

hello Shawn,
yes, I can see your problem, I have to log a lot myself because of my
squid performance testing and I found the squid logging quite inflexible
as well.

Anyway, there are some hints, although they are probably not exactly the
right ones you are waiting for:

- for the info I am really interested in I created a new logfile called
focus.log and let squid handle it as the others logs (e.g. log file
rotating, close/open when restart and so on).
Instead of using the debug macro I use my fdebug macro witch writes to
the focus log

- I extended the squid.conf debug_options parameter so you can set a
different level of verbosity for each module. For example, my current
setting is "debug_options ALL,1;14,5;99,4"

- I decided to use ext2fs with noatime mounting option for my debug
partition to not slowing Squid down because of huge debugging

- I wrote a watcher in bash which is run from cron, it checks the size
of cache.log and if it exceeds the pre-set size, it sends SIGUSR1 to
Squid to rotate its logs so I am sure my log partition will not be
filled up.

If anything from my list sounds interesting to you, I can send you a
patch/script/more info.

Best Regards
Marji

> During times when our proxy is being assaulted by spyware, it spends a
> great deal of CPU time logging these denials. I would like to explore the
> possibility of one or more of the following:
>
> -handing off the logging to a separate process such as multilog
> -finding some way to place log limits where multiple lines from a single
> host would otherwise fill the logs. ie: maximum 5 denials logged per
> second per host, with a burst of 20.
> -limiting max # of connections allocated to a single IP per minute, since
> delay pools won't help when all the connections are denials (I don't
> think).
Received on Mon Nov 29 2004 - 00:44:40 MST