Squid doesn't display User Agent in Access Log

KOM

I think there is only a user displayed if you configured squid to require authentication. It's showing the user, not the browser's user-agent string.

eskiesirius

ahhh ok.. so it was User not user-agent.. but how can i display the user-agent in access_log?

KOM

https://wiki.squid-cache.org/Features/LogFormat

"user The eighth column may contain the user identity for the requesting client. This may be sourced from one of HTTP authentication, an external ACL helper, TLS authentication, or IDENT lookup (RFC 931) - checked in that order with the first to present information displayed. If no user identity is available a "-" will be logged."

I don't think there is a way to log the user-agent via squid. Why do you need that anyway?

eskiesirius

for statistics.. our currently setup is that all logs from squid will be send to kibana..

so i need to create a custom log?

KOM

I did a minute or two of research and found that squid can indeed log the user-agent but it seems to be disabled by default.

http://squid-web-proxy-cache.1019090.n4.nabble.com/useragent-log-td4672505.html

https://www.oreilly.com/library/view/squid-proxy-server/9781849513906/ch05s15.html

eskiesirius

i already did my research before posting here but sadly.. those links didnt worked for me..

KOM

Works for me. The first link had the solution. Add this to your squid config under Show Advanced Options - Integrations:

access_log stdio:/var/squid/logs/useragent.log useragent

If you already have something there, append with a ; like this:

url_rewrite_program /usr/local/bin/squidGuard -c /usr/local/etc/squidGuard/squidGuard.conf;url_rewrite_bypass off;url_rewrite_children 16 startup=8 idle=4 concurrency=0;access_log stdio:/var/squid/logs/useragent.log useragent

eskiesirius

ok2 thank you i will try this

eskiesirius

anyway i did append useragent so what happened was that.. it only displayed user agent.. the other parameters were removed..

KOM

Yes, it writes it to separate log. You will have to figure out how to ingest useragent.log as well as access.log.

eskiesirius

thank you for that.. i will fix it from here..

again thank you for your guidance