The pfSense Store

Author Topic: Squid - multiple interfaces - possible to only log on a specific interface/IP ?  (Read 1090 times)

0 Members and 1 Guest are viewing this topic.

Offline Nachtfalke

  • Hero Member
  • *****
  • Posts: 2793
  • Karma: +11/-0
    • View Profile
Hello,

I have got a question about squid. I am using squid2 package since over a year. I have logging disable because my company does not want to log the traffic. But Now there could be a situation where I only should log one specific IP but not the others. I am using 6 different VLANs on which squid is listening.

My question is now:
Is it possible to tell squid only to log the traffic of one specific IP address but not all the others ?
Is it possible to only log on a specific interface but not on the others ?

I know - I can log all interfaces and just filter out the specific IP but that is not the way I want to go.

Thank you for your help!

Offline marcelloc

  • Hero Member
  • *****
  • Posts: 11164
  • Karma: +257/-2
    • View Profile
I think the best way is to use a report package to create reports to a specific ip(s), then rotate de logs and flush it.

Sarg can do this if you create a every hour schedule with log rotate.

Offline Nachtfalke

  • Hero Member
  • *****
  • Posts: 2793
  • Karma: +11/-0
    • View Profile
So the squid access.log will be rotated every hour and nothing will be cached longer than this time but the repor sarg builded will be persistant longer ?
I think this would be ok - if sarg can filter one specific IP or some defined IPs - and build a report based on this IP(s).

Is your sarg package compatible with squid2 ?

Thank you!

Offline marcelloc

  • Hero Member
  • *****
  • Posts: 11164
  • Karma: +257/-2
    • View Profile
Is your sarg package compatible with squid2 ?

Yes  :)