Squidguard blacklist logging problem

spYro

Hi there :)
I have a question about the logging for the squidguard blacklist.
first my Versions:

PFSense
2.1-BETA1 (amd64)
built on Thu Feb 14 04:54:03 EST 2013

Lightsquid
1.8.2 pkg v.2.32

squid
2.7.9 pkg v.4.3.3

Squidguard
1.4_4 pkg v.1.9.5

Now to my problem/question:
I have a blacklist with a manual rule (lets say I blacklisted google).
I then go to Services -> Proxy filter -> Log and click "blocked".
Nothing there, that's allright.
Then i open a new tab with google and the google-page wont come.
I look into the blocked-log again and see my ip and the attempt to open google.
So far, everything is ok.

Now i refresh the google-tab.
I look into the blocked-log again and see… nothing more. Just the first attempt to open google.

I tried many things and it seems, that the block-list only lists one site/domain for each ip.
So if i go to another pc and open google, the new entry with ip and site is created. Then i go back to my pc and refresh google, but that doesn't create a new entry.

I don't know, if this is a bug or a feature. But i want it configured, so it shows ANY attempt for a blocked site call.

Is there an easys way to get to the solution?
If not, can someone at least tell me, where i can modify the logging-option of this method?

Best wishes and thanks in advance :)

spYro

spYro

Come on, nobody has an answer to this? :/

I could try to get myself into the code itself, but that wouldn't be as easy and meant to be as getting an easy answer for this solution, if there is any ;)

Nachtfalke

I did not mention such an issue on my environment.
Which version of squid and squidguard do you use?

And can you check with clearing the browser cache and/or different browsers on the same system?

Further check the access.log file of squid if it blocks every attempt. As far as I know squidguard just checks the access.log file.

And if the squidguard - log menu does not work as expected then try with SARG package.

spYro

Hi :)
My versions are listed in the first Post.
Further, i tried this with different browsers and cleared cache.

I will check the access.log file tomorror and report back here.l

Best wishes

spYro