[squid-users] Syslog patch for 2.5STABLE9

On Fri, 25 Feb 2005 12:54:30 -0600, Kevin <kkadow@gmail.com> wrote:
> Has anybody put together a good patch for Squid (2.5.X) to record access
> information via syslog instead of writing to disk? It looks like I could simply
> modify logfilePrintf() in logfile.c?

While it's bad form to reply to one's own post, yes, it really is that simple,
I wrapped the logfilePrintf calls in access_log.c with if statements.

> (P.S. Yes, I fully understand the various issues with and drawbacks of
> using "syslog" for access logs, particularly across a network.)

That said, here is a functional (beta) patch for sending access_log to syslog,
use at your own risk. To enable syslog logging, change cache_access_log
in squid.conf to read "cache_access_log syslog".

diff squid-2.5.STABLE9/src/access_log.c
squid-2.5.STABLE9+syslog/src/access_log.c
--- squid-2.5.STABLE9/src/access_log.c Mon Sep 27 17:34:19 2004
+++ squid-2.5.STABLE9+syslog/src/access_log.c Fri Feb 25 14:14:33 2005
@@ -35,6 +35,8 @@

#include "squid.h"
+#include <syslog.h>
+#include <stdarg.h>

static void accessLogSquid(AccessLogEntry * al);
static void accessLogCommon(AccessLogEntry * al);
@@ -245,7 +247,8 @@
     client = inet_ntoa(al->cache.caddr);
  user = accessLogFormatName(al->cache.authuser ?
     al->cache.authuser : al->cache.rfc931);
- logfilePrintf(logfile, "%9d.%03d %6d %s %s/%03d %lu %s %s %s %s%s/%s %s",
+ if (LogfileStatus == LOG_ENABLE)
+ logfilePrintf(logfile, "%9d.%03d %6d %s %s/%03d %lu %s %s %s %s%s/%s %s",
     (int) current_time.tv_sec,
     (int) current_time.tv_usec / 1000,
     al->cache.msec,
@@ -260,6 +263,22 @@
     hier_strings[al->hier.code],
     al->hier.host,
     al->http.content_type);
+ else if (LogfileStatus == LOG_TOSYSLOG)
+ syslog(LOG_INFO, "%9d.%03d %6d %s %s/%03d %lu %s %s %s %s%s/%s %s",
+ (int) current_time.tv_sec,
+ (int) current_time.tv_usec / 1000,
+ al->cache.msec,
+ client,
+ log_tags[al->cache.code],
+ al->http.code,
+ (unsigned long) al->cache.size,
+ al->private.method_str,
+ al->url,
+ user && *user ? user : dash_str,
+ al->hier.ping.timedout ? "TIMEOUT_" : "",
+ hier_strings[al->hier.code],
+ al->hier.host,
+ al->http.content_type);
  safe_free(user);
}

@@ -274,7 +293,8 @@
     client = inet_ntoa(al->cache.caddr);
  user1 = accessLogFormatName(al->cache.authuser);
  user2 = accessLogFormatName(al->cache.rfc931);
- logfilePrintf(logfile, "%s %s %s [%s] \"%s %s HTTP/%d.%d\" %d %ld %s:%s",
+ if (LogfileStatus == LOG_ENABLE)
+ logfilePrintf(logfile, "%s %s %s [%s] \"%s %s HTTP/%d.%d\" %d
%ld %s:%s",
     client,
     user2 ? user2 : dash_str,
     user1 ? user1 : dash_str,
@@ -286,6 +306,19 @@
     (long int) al->cache.size,
     log_tags[al->cache.code],
     hier_strings[al->hier.code]);
+ else if (LogfileStatus == LOG_TOSYSLOG)
+ syslog(LOG_INFO, "%s %s %s [%s] \"%s %s HTTP/%d.%d\" %d %ld %s:%s",
+ client,
+ user2 ? user2 : dash_str,
+ user1 ? user1 : dash_str,
+ mkhttpdlogtime(&squid_curtime),
+ al->private.method_str,
+ al->url,
+ al->http.version.major, al->http.version.minor,
+ al->http.code,
+ (long int) al->cache.size,
+ log_tags[al->cache.code],
+ hier_strings[al->hier.code]);
  safe_free(user1);
  safe_free(user2);
}
@@ -293,7 +326,7 @@
void
accessLogLog(AccessLogEntry * al)
{
- if (LogfileStatus != LOG_ENABLE)
+ if (LogfileStatus == LOG_DISABLE)
     return;
  if (al->url == NULL)
     al->url = dash_str;
@@ -313,13 +346,18 @@
  if (Config.onoff.log_mime_hdrs) {
     char *ereq = log_quote(al->headers.request);
     char *erep = log_quote(al->headers.reply);
+ if (LogfileStatus == LOG_ENABLE)
     logfilePrintf(logfile, " [%s] [%s]\n", ereq, erep);
+ else if (LogfileStatus == LOG_TOSYSLOG)
+ syslog(LOG_INFO, " [%s] [%s]\n", ereq, erep);
     safe_free(ereq);
     safe_free(erep);
  } else {
- logfilePrintf(logfile, "\n");
+ if (LogfileStatus == LOG_ENABLE)
+ logfilePrintf(logfile, "\n");
  }
- logfileFlush(logfile);
+ if (LogfileStatus == LOG_ENABLE)
+ logfileFlush(logfile);
#if MULTICAST_MISS_STREAM
  if (al->cache.code != LOG_TCP_MISS)
     (void) 0;
@@ -349,6 +387,8 @@
#if FORW_VIA_DB
  fvdbClear();
#endif
+ if (LogfileStatus == LOG_TOSYSLOG)
+ return;
  if (NULL == logfile)
     return;
  logfileRotate(logfile);
@@ -360,6 +400,8 @@
void
accessLogClose(void)
{
+ if (LogfileStatus == LOG_TOSYSLOG)
+ return;
  if (NULL == logfile)
     return;
  logfileClose(logfile);
@@ -386,6 +428,11 @@
  assert(sizeof(log_tags) == (LOG_TYPE_MAX + 1) * sizeof(char *));
  if (strcasecmp(Config.Log.access, "none") == 0)
     return;
+ if (strcasecmp(Config.Log.access, "syslog") == 0) {
+ logfile=NULL;
+ LogfileStatus = LOG_TOSYSLOG;
+ return;
+ }
  logfile = logfileOpen(Config.Log.access, MAX_URL << 1, 1);
  LogfileStatus = LOG_ENABLE;
#if HEADERS_LOG
diff squid-2.5.STABLE9/src/defines.h squid-2.5.STABLE9+syslog/src/defines.h
--- squid-2.5.STABLE9/src/defines.h Thu Aug 8 15:17:39 2002
+++ squid-2.5.STABLE9+syslog/src/defines.h Fri Feb 25 14:13:19 2005
@@ -142,6 +142,7 @@
#define current_stacksize(stack) ((stack)->top - (stack)->base)

/* logfile status */
+#define LOG_TOSYSLOG 2
#define LOG_ENABLE 1
#define LOG_DISABLE 0