4

We all know that access.log file logs the access Info of Squid:

1286536351.746  41762 192.168.1.17 TCP_MISS/200 5340945 GET http://v15.lscache3.c.youtube.com/videoplayback? - DIRECT/122.160.120.150 video/x-flv
1286536351.746  41762 192.168.1.18 TCP_MISS/200 5340945 GET http://v15.lscache3.c.youtube.com/videoplayback? - DIRECT/122.160.120.150 video/x-flv

We all also know that Squid use the file /etc/resolv.conf to determine the DNS server it is dealing with, so if we want Squid to deal with a local DNS server we enter the local DNS server in the file /etc/resolv.conf.

What if the local DNS server has a record like this (in its reverse zone (1.168.192.in-addr.arpa)):

$TTL 60 ; 1 minute
17          PTR Mark.
18          PTR Mike.

Can I configure Squid to do a reverse lookup (asking about the name of the IP address in the log file) and add the names to the access.log record, for example:

I want to make this record:

1286536351.746  41762 192.168.1.17 ......

to be something like this:

1286536351.746  41762 192.168.1.17 Mark ......

How can I reach this?

Can I use Squid logformats like %>a and %>A to get what I want?

  • This sounds like what you're asking for: packtpub.com/article/configuring-squid-use-dns-servers. Additionally you could forgo this and use a post-mortem program to insert the hostnames into an already existing access.log file. This file should be in the standard Apache "combined" format and there are a number of scripts that will do this floating around the web. – slm Jun 2 '14 at 17:13
  • for every request received from a client, Squid needs to resolve the domain name before it can contact the target web server. For this purpose, Squid can either use the built-in internal DNS client or, external DNS program to resolve the hostnames , that what the page you give me have, but that isn't what I want, I want Squid to do a reverse lookup @slm – Networker Jun 3 '14 at 13:51
4

One method would be to make use of this directive in the squid.conf file to get the log file to show FQDNs instead of the IPs:

log_fqdn on

Source: http://www.squid-cache.org/Doc/config/log_fqdn/

But this will omit the <IP> <Name> format that you're showing in your question. For that if you look at the documentation for the logformat directive the following default formats are listed:

logformat squid      %ts.%03tu %6tr %>a %Ss/%03>Hs %<st %rm %ru %[un %Sh/%<a %mt
logformat common     %>a %[ui %[un [%tl] "%rm %ru HTTP/%rv" %>Hs %<st %Ss:%Sh
logformat combined   %>a %[ui %[un [%tl] "%rm %ru HTTP/%rv" %>Hs %<st "%{Referer}>h" "%{User-Agent}>h" %Ss:%Sh
logformat referrer   %ts.%03tu %>a %{Referer}>h %ru
logformat useragent  %>a [%tl] "%{User-Agent}>h"

And these options are listed as parameters that you can use in building up your own format:

>a  Client source IP address
>A  Client FQDN

So I would expect that you could put this together to get the format that you're asking about.

References

  • 1
    @Networker - glad it solved your issue. Sorry it took so long to figure it out 8-). – slm Jun 3 '14 at 23:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.