Forwarding Squid Logs to remote Syslog Server -
-
Hi everyone.
I would like to know if I can forward the Squid logs from pfsense located /var/squid/logs to TWO remote syslog server? Upon some googling and research I discovered I need to make the following changes.
/usr/local/etc/squid/squid.conf
ADD access_log syslog:local5.info squid << will this foward ALL type of SQUID logs ? >>
restart squid:
/usr/local/etc/rc.d/squid.sh restartthen make change to:
/etc/syslog.conf /
local5.* @192.168.1.123 << this is the part I am bit confused. Can I add another server here? @192.168.1.123,192.168.1.124 >>
then restart the services.
/etc/rc.d/syslogd restart
finally, upon more reading and research it seems that I will probably end up making the changes at squid.inc as the server overwrites the conf file?
thanks again everyone for your support! you guys ROCK !
-
I'd frankly suggest to install the syslog-ng package rather than messing with the pfSense logger. (And yes, you need squid.inc patched for this kind of changes.)