Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Squid logs are not sent to syslog #3454

Closed
netranger512 opened this issue Apr 30, 2019 · 5 comments
Closed

Squid logs are not sent to syslog #3454

netranger512 opened this issue Apr 30, 2019 · 5 comments
Assignees
@fichtner
Labels
bug Production bug
Milestone
19.7

Comments

@netranger512
Copy link

netranger512 commented Apr 30, 2019 •
edited
Loading

Description

Squid access logs are sent to the captive portal logs when Web Proxy > Log Target > Syslog is selected. This stops them from being sent to the syslog server at all (probably because Captive Portal is not used in my setup)
Other logtypes get correctly sent to the syslog server (firewall logs, surricata logs etc.)

To Reproduce

  • Set Remote Syslog Servers to your syslog server IP
  • Activate Web Proxy > Log Target > Syslog
  • Use the webproxy to access some sites, the logs will end up in the captive portal log

Expected behavior

  • The squid access logs should end up in the correct log file and/or be sent to the server configured under Remote Syslog Servers

Screenshots

log_captive
log_wp

Environment

SW: OPNsense 19.1.4-amd64/ FreeBSD 11.2-RELEASE-p9-HBSD / OpenSSL 1.0.2r 26 Feb 2019
HW: APU2C4
NIC: Intel i210AT LAN
@fichtner fichtner self-assigned this May 3, 2019
@fichtner fichtner added the bug Production bug label May 3, 2019
@fichtner fichtner added this to the 19.7 milestone May 3, 2019
@AdSchellevis AdSchellevis assigned AdSchellevis and unassigned fichtner Jun 3, 2019
@AdSchellevis
Copy link
Member

oops, it seems that dd2f34f was accidentally removed in 86d290e. There probably aren't a lot of people using this. I'll re-add and close the issue when done.

@fichtner
Copy link
Member

This wasn't a head-on accident, "/var/ log/squid.syslog.log" is a really weird way to name a file for a service that throws its logs into /var/log/squid/" to begin with. I think the preferred way was to have something like a "proxy.log" file, but that would be reserved for core services then since we can't "plug" the file name at the moment from separate plugins.

@AdSchellevis
Copy link
Member

The naming is weird indeed, but we can't mix syslog and file targets due to clog at the moment. The target was used, so we should place something back to make sure the feature can work. /var/log/squid.log is probably the closest thing to logic within the boundaries we have at the moment.

AdSchellevis added a commit that referenced this issue Jun 18, 2019
@AdSchellevis
Proxy, access log over syslog. This is at the moment the best I can t…
464495b 
…hink of, since we can't combine clog and plain log it's better to make the choices explicit in our code.

Access log over syslog will write to /var/log/squid.log, where the normal plain log would write to /var/log/squid/access.log

For #3454
@AdSchellevis
Copy link
Member

@fichtner within the available constraints, this 464495b is the best I can think of at the moment. Feel free to revert and replace for something better.

fichtner pushed a commit that referenced this issue Jun 24, 2019
@AdSchellevis @fichtner
Proxy, access log over syslog. This is at the moment the best I can t…
7544175 
…hink of, since we can't combine clog and plain log it's better to make the choices explicit in our code.

Access log over syslog will write to /var/log/squid.log, where the normal plain log would write to /var/log/squid/access.log

For #3454

(cherry picked from commit 464495b)
@fichtner
Copy link
Member

Will be in 19.1.10.

EugenMayer pushed a commit to KontextWork/opnsense_core that referenced this issue Jul 22, 2019
@AdSchellevis @EugenMayer
Proxy, access log over syslog. This is at the moment the best I can t…
4938fb7 
…hink of, since we can't combine clog and plain log it's better to make the choices explicit in our code.

Access log over syslog will write to /var/log/squid.log, where the normal plain log would write to /var/log/squid/access.log

For opnsense#3454
EugenMayer pushed a commit to KontextWork/opnsense_core that referenced this issue Jul 22, 2019
@AdSchellevis @EugenMayer
Proxy, access log over syslog. This is at the moment the best I can t…
acff5a5 
…hink of, since we can't combine clog and plain log it's better to make the choices explicit in our code.

Access log over syslog will write to /var/log/squid.log, where the normal plain log would write to /var/log/squid/access.log

For opnsense#3454
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@fichtner fichtner

Labels
bug Production bug
Milestone
19.7
Development

No branches or pull requests
3 participants
@fichtner @AdSchellevis @netranger512