Squid2.5+自定义日记
Squid2.6由于不能自由定义不同源的虚拟主机,所以只好使用2.5,可惜2.5的日志不能自定义。
补丁下载的网址: http://devel.squid-cache.org/customlog/
可以生成Apache combined日志补丁
下载回来放到源码目录,运行
patch -p0 < customlog-2.5.patch
然后重新编译:
./configure --prefix=/usr/local/squid --enable-delay-pools --enable-useragent-log --enable-referer-log --enable-default-err-language=Simplify_Chinese --enable-x-accelerator-vary --enable-kill-parent-hack --enable-err-languages="Simplif
y_Chinese English" --with-pthreads --with-aio --enable-cache-digests --with-large-files
编译结束后, 在 squid.conf 中添加:
logformat combined %>a - %un [%{%d/%b/%Y:%H:%M:%S +0800}tl] "%rm %ru HTTP/%rv" %Hs %h" "%{User-agent}>h"
cache_access_log /var/squid/logs/access.log combined
一个支持 combined 日志模式的 Squid 即告完成。
注意, 这里用了 +0800 ,绕过了使用 tl 的 %z 或者 %Z 的问题,用 z% ,将显示为 25%z ,可能是 patch 有问题。
Squid custom log format
Basic syntax: %...field where ... is an optional field width. On numeric fields the output will be 0 padded if the field width starts with a 0. If the field width starts with a - then the output will be aligned right within the field.
Field names
Field name syntax keys:
{} modifier or argument. Also used to specify header names
> request (client)
< reply (server)
a address
A address name
h all headers
i ident
p port
r request line (no query)
t time
u user
l local address/port (where request was accepted)
%>a
Client source IP address
%>A
Client FQDN
%>p
Client source port
%Server or peer IP address
%Server or peer port number
%Server IP address or peer name
%la
Local IP address where the request was accepted
%lp
Local port where the request was accepted
%lA
Local port name where the request was accepted
%ts
Date of request, seconds since epoch
%{format}tl
Date of request, strftime format (localtime)
%{format}tg
Date of request, strftime format (gmt)
%tu
Date of request, sub-second component
%tr
Time to serve the request, in milliseconds
%{header}>h
Request header
%{header:element}>h
Named request header field element (list headers)
%{header:separator element}>h
Named request header field element, using "separator" as field separator (it can be any non-alphanumeric single character)
%>h
All request header
%{header} Request headers, as for <..h above
%un
Authenticated user name or dash
%ur
Authenticated user realm or dash
%us
Authenticated user scheme or dash
%ui
Ident user name
%Hs
HTTP status code (200, 404, 407, etc)
%Ht
HTTP status text (Not found, etc)
%Ss
Squid status code (TCP_HIT, TCP_MISS etc)
%Se
Squid error code (ERR_DENIED, ERR_...)
%Sh
Squid hierarchy code (FIRST_UP_PARENT, etc)
%mt
MIME type of the request
%rm
Request method
%ru
Request URL, without the query string
%rq
Request query string, including ?
%rp
Request protocol (i.e. HTTP/1.1)
%ps
Peer selection status (DIRECT, PARENT, CD_PARENT_HIT, etc. including the TIMEDOUT_ variant)
%>sl
Size of request line
%>sh
Size of request headers, including request line
%>sH
Size of request headers, excluding request line
%>sb
Size of request body, raw received bytes
%>sB
Size of request body, excluding transfer encoding
%>st
Total size of request
% Size of reply status line
% Size of reply headers, including status line
% Size of reply headers, excluding status line
% Size of reply body, raw transmitted bytes
% Size of reply body, excluding transfer encoding
% Total size of reply
%%
A literal %
补丁下载的网址: http://devel.squid-cache.org/customlog/
可以生成Apache combined日志补丁
下载回来放到源码目录,运行
patch -p0 < customlog-2.5.patch
然后重新编译:
./configure --prefix=/usr/local/squid --enable-delay-pools --enable-useragent-log --enable-referer-log --enable-default-err-language=Simplify_Chinese --enable-x-accelerator-vary --enable-kill-parent-hack --enable-err-languages="Simplif
y_Chinese English" --with-pthreads --with-aio --enable-cache-digests --with-large-files
编译结束后, 在 squid.conf 中添加:
logformat combined %>a - %un [%{%d/%b/%Y:%H:%M:%S +0800}tl] "%rm %ru HTTP/%rv" %Hs %
cache_access_log /var/squid/logs/access.log combined
一个支持 combined 日志模式的 Squid 即告完成。
注意, 这里用了 +0800 ,绕过了使用 tl 的 %z 或者 %Z 的问题,用 z% ,将显示为 25%z ,可能是 patch 有问题。
Squid custom log format
Basic syntax: %...field where ... is an optional field width. On numeric fields the output will be 0 padded if the field width starts with a 0. If the field width starts with a - then the output will be aligned right within the field.
Field names
Field name syntax keys:
{} modifier or argument. Also used to specify header names
> request (client)
< reply (server)
a address
A address name
h all headers
i ident
p port
r request line (no query)
t time
u user
l local address/port (where request was accepted)
%>a
Client source IP address
%>A
Client FQDN
%>p
Client source port
%Server or peer IP address
%Server or peer port number
%Server IP address or peer name
%la
Local IP address where the request was accepted
%lp
Local port where the request was accepted
%lA
Local port name where the request was accepted
%ts
Date of request, seconds since epoch
%{format}tl
Date of request, strftime format (localtime)
%{format}tg
Date of request, strftime format (gmt)
%tu
Date of request, sub-second component
%tr
Time to serve the request, in milliseconds
%{header}>h
Request header
%{header:element}>h
Named request header field element (list headers)
%{header:separator element}>h
Named request header field element, using "separator" as field separator (it can be any non-alphanumeric single character)
%>h
All request header
%{header}
%un
Authenticated user name or dash
%ur
Authenticated user realm or dash
%us
Authenticated user scheme or dash
%ui
Ident user name
%Hs
HTTP status code (200, 404, 407, etc)
%Ht
HTTP status text (Not found, etc)
%Ss
Squid status code (TCP_HIT, TCP_MISS etc)
%Se
Squid error code (ERR_DENIED, ERR_...)
%Sh
Squid hierarchy code (FIRST_UP_PARENT, etc)
%mt
MIME type of the request
%rm
Request method
%ru
Request URL, without the query string
%rq
Request query string, including ?
%rp
Request protocol (i.e. HTTP/1.1)
%ps
Peer selection status (DIRECT, PARENT, CD_PARENT_HIT, etc. including the TIMEDOUT_ variant)
%>sl
Size of request line
%>sh
Size of request headers, including request line
%>sH
Size of request headers, excluding request line
%>sb
Size of request body, raw received bytes
%>sB
Size of request body, excluding transfer encoding
%>st
Total size of request
%
%
%
%
%
%
%%
A literal %
评论