Re: [squid-users] logging options and performance effects

Thanks for the link Henrik. I have downloaded the patch and applied it against the latest stable source squid-2.5.STABLE3. I had 2 hunks get refected against client_side.c. I have attached that file in case you want to look at it. There didn't seem to be any problems with the compilation. However it doesn't appear to be logging any different that it was before.
I added
        logformat combined %>a %ui %un [%tl] "%rm %ru HTTP/%rv" %Hs %<st "%{Referer}>h" "%{User-Agent}>h" %Ss:%Sh
        access_log /usr/local/squid/var/logs/access.log

to my squid.conf file but couldn't see any mention of useragents or referers in the access.log. I tried the emulate_httpd_log on option and but that didn't show them up either. I then recompiled with the --enable-useragent-log and --enable-referer-log but the logging was still exactly the same as before I applied the patch.

Not sure exactly where I have gone wrong.
I applied the patch in this manner
 cd src/
 patch -p1 < ../customlog-2.5.patch
and then just told patch the name of the files as it came across them.

Thanks for any help

John

On Tue, 26 Aug 2003 01:06:07 +0200
Henrik Nordstrom <hno@squid-cache.org> wrote:

> On Monday 25 August 2003 15.10, Adam Aube wrote:
>
> > As for performance, it could cause a problem, but that will vary
> > depending on setup. All you can do is monitor and see if a disk
> > bottleneck occurs.
>
> It also risks running into the magic 2GB file size limit rather
> quickly unless you rotate your logs frequently.
>
> > > Just curious as to what is the most efficient way to get log
> > > files suitable for a log analyser
> >
> > Most log analyzers look only at the access.log anyway. Most of the
> > time you will only need access.log and cache.log.
>
> If your log analyzer need more information than logged in the two log
> formats normally available in Squid then see
> http://devel.squid-cache.org/customlog/. From there you can find a
> patch which adds support for custom log formats to Squid-2.5. The
> same functionality is also available as part of Squid-3.0 (no
> patching required), but Squid-3.0 is not yet production quality.
>
> --
> Donations welcome if you consider my Free Squid support helpful.
> https://www.paypal.com/xclick/business=hno%40squid-cache.org
>
> If you need commercial Squid support or cost effective Squid or
> firewall appliances please refer to MARA Systems AB, Sweden
> http://www.marasystems.com/, info@marasystems.com
>
>