4

We all know that access.log file logs the access Info of Squid:

1286536351.746  41762 192.168.1.17 TCP_MISS/200 5340945 GET http://v15.lscache3.c.youtube.com/videoplayback? - DIRECT/122.160.120.150 video/x-flv
1286536351.746  41762 192.168.1.18 TCP_MISS/200 5340945 GET http://v15.lscache3.c.youtube.com/videoplayback? - DIRECT/122.160.120.150 video/x-flv

We all also know that Squid use the file /etc/resolv.conf to determine the DNS server it is dealing with, so if we want Squid to deal with a local DNS server we enter the local DNS server in the file /etc/resolv.conf.

What if the local DNS server has a record like this (in its reverse zone (1.168.192.in-addr.arpa)):

$TTL 60 ; 1 minute
17          PTR Mark.
18          PTR Mike.

Can I configure Squid to do a reverse lookup (asking about the name of the IP address in the log file) and add the names to the access.log record, for example:

I want to make this record:

1286536351.746  41762 192.168.1.17 ......

to be something like this:

1286536351.746  41762 192.168.1.17 Mark ......

How can I reach this?

Can I use Squid logformats like %>a and %>A to get what I want?

2
  • This sounds like what you're asking for: packtpub.com/article/configuring-squid-use-dns-servers. Additionally you could forgo this and use a post-mortem program to insert the hostnames into an already existing access.log file. This file should be in the standard Apache "combined" format and there are a number of scripts that will do this floating around the web.
    – slm
    Commented Jun 2, 2014 at 17:13
  • for every request received from a client, Squid needs to resolve the domain name before it can contact the target web server. For this purpose, Squid can either use the built-in internal DNS client or, external DNS program to resolve the hostnames , that what the page you give me have, but that isn't what I want, I want Squid to do a reverse lookup @slm
    – Nidal
    Commented Jun 3, 2014 at 13:51

1 Answer 1

5

One method would be to make use of this directive in the squid.conf file to get the log file to show FQDNs instead of the IPs:

log_fqdn on

Source: http://www.squid-cache.org/Doc/config/log_fqdn/

But this will omit the <IP> <Name> format that you're showing in your question. For that if you look at the documentation for the logformat directive the following default formats are listed:

logformat squid      %ts.%03tu %6tr %>a %Ss/%03>Hs %<st %rm %ru %[un %Sh/%<a %mt
logformat common     %>a %[ui %[un [%tl] "%rm %ru HTTP/%rv" %>Hs %<st %Ss:%Sh
logformat combined   %>a %[ui %[un [%tl] "%rm %ru HTTP/%rv" %>Hs %<st "%{Referer}>h" "%{User-Agent}>h" %Ss:%Sh
logformat referrer   %ts.%03tu %>a %{Referer}>h %ru
logformat useragent  %>a [%tl] "%{User-Agent}>h"

And these options are listed as parameters that you can use in building up your own format:

>a  Client source IP address
>A  Client FQDN

So I would expect that you could put this together to get the format that you're asking about.

References

2
  • 1
    @Networker - glad it solved your issue. Sorry it took so long to figure it out 8-).
    – slm
    Commented Jun 3, 2014 at 23:20
  • In 2020 the "log_fqdn" option is obsolate, deprecated, and will go away. Modifying the logformat line is the current answer.
    – Criggie
    Commented Jul 26, 2020 at 1:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .