RE: [squid-users] Logging failed authentication requests

>-----Original Message-----
>From: Amos Jeffries [mailto:squid3_at_treenet.co.nz]
>Sent: Wednesday, April 07, 2010 10:56 PM
>
>Mellem, Dan wrote:
>> Hi,
>>
>> Thanks for your response. Please see below.
>>
>>> From: Amos Jeffries [mailto:squid3_at_treenet.co.nz]
>>> Sent: Wednesday, April 07, 2010 7:33 PM
>>> On Wed, 07 Apr 2010 19:12:53 -0700, "Mellem, Dan"
>>
>> I do a:
>> tail -f access.log | fgrep '<my IP address>'
>>
>> and only get responses for allowed traffic. I also don't
>have any 407s
>> at all in the log.
>> You said the logging is on by default. Is there a way to it off or to
>> turn on debugging that would show where it's getting dropped?
>>
[...]
>>
>> If I type the wrong password, I get re-prompted for authentication
>> again. I get the normal:
>>
>> GET
>> 407 Proxy Authentication Required
>> GET w/Proxy-Authorization: Basic (wrong password)
>> 407 Proxy Authentication Required
>> GET w/Proxy-Authorization: Basic (right password)
>> 200 OK
>>
>
>Okay thats good then. Those 407 _should_ be in the access.log.
>
>If you grep the log for " 407 " (note the spaces) or the date
>and minute
>when the tests were done instead of your IP you may see them.
>It should
>have been visible with an IP though.
>
>The only ways to get things not logged is to add ACL after the
>specific
>access_log line, or to add "log_access" lines preventing things being
>logged globally.
>
>Amos

Hi, Amos,

I searched the logs for 407 results and didn't find any at all (I
searched for '" 407 ' since I was getting some file sizes of 407 bytes
[the pattern '" 404 ' did find matches]).

The access log is the default, and has no ACL associated.
access_log /usr/local/squid/var/logs/access.log

There are no log_access entries in the configuration, either.

Update: OK, I found the problem. The accessLogLog() function in
access_log.c had been altered to only log successful requests. It was
left over from an old Smartfilter installation. I commented out the
lines and I'm now getting the 407 entries in the log. Thanks for your
help.

-Dan
Received on Fri Apr 09 2010 - 18:46:07 MDT