In squid proxy, access log is really important as it records all networking activities of the users.
The timestamp of the log play a big role, but default time format is not much useful, so most users like me 🙂 used to change it to Local time format to log something similar to below.
04/May/2015:11:28:19 Sri Lanka Standard Time 148 107984 192.168.64.130 TCP_MISS/200 50621 CONNECT www.google.lk:443 - DIRECT/222.165.163.24 -
I hope you are reading this because you are not satisfied with default output as I do. Let’s look at how to change it.
1) According squid.conf document.
Format code structure :-
#% ["|[|'|#] [-] [[0]width] [{argument}] formatcode
Time related format codes:-
#      tl   Local time. Optional strftime format argument
#Â Â Â Â Â Â Â Â Â default %d/%b/%Y:%H:%M:%S %z
2) Here I need year/month/date kind of timestamp while removing time zone, So I configured format like below, adjust it as you wish.
|
1 |
<strong>logformat squid %{%Y/%m/%d:%H:%M:%S}tl %6tr %>a %Ss/%03Hs %<st %rm %ru %un %Sh/%<A %mt</strong> |
3) Restart squid poxy, and check access log again. you will find log’s timestamp similar to below.
04/May/2015:11:28:19 Sri Lanka Standard Time 148 107984 192.168.64.130 TCP_MISS/200 50621 CONNECT www.google.lk:443 - DIRECT/222.165.163.24 -
That’s it 😀
Related post :- How to configure squid as transparent proxy
2 comments
Tajamul
July 3, 2017 at 3:50 pm (UTC 5.5) Link to this comment
Thanks 🙂
Jud
November 20, 2019 at 3:10 am (UTC 5.5) Link to this comment
Hey can you put the squid.conf logformat line in plain text? your fancy code box seems to be adding some markup stuff to it that causes it not to parse properly.