Help for c-icap/e2guardian access.log rotation and low free memory



  • Hello,

    in my company I have put in production a proxy/filtering solution based on pfSense 2.2.3 for 140 users with this architecture:

    VM configured with 2 vCPU, 8 GB RAM and 20 GB virtual disk;
    installed packages Squid3, Lightsquid, E2guardian, Suricata, pfBlockerNG.

    Everything works very well and the performance is good, but I have two problems that worries me because still I have not managed to solve.

    The first is that after some time of use, the disk fills up mainly due to the growth without limit of these files:

    /var/log/c-icap/access.log (that actually does not contain useful data)
    /var/log/e2guardian/access.log (that despite the setting even records the traffic allowed and not only blocked sites as I would)

    Given that I was unable to find the right solution in this forum, I ask a help to know if there is a way for rotate and delete these files, so that that I do not have to worry about it.

    the second thing that puzzles me is that the free memory rapidly decreases below the threshold of 10%, though the memory usage showed in the dashboard usually does not exceed the 18%.

    I originally configured the machine with 4 GB RAM, that I had estimated to be enough, but in this configuration after a few weeks
    I noticed a swap usage despite a memory usage of 50%, so I had to reconfigure the VM to 8 GB RAM.

    I thank in advance all those who will have the patience to read my post and who can help me.

    Best Regards.

    Claudio



  • @CBRom:

    /var/log/c-icap/access.log (that actually does not contain useful data)

    Hi.

    I've just been struggling to disable this file. It was receiving several lines of useless information every few seconds.

    The c-icap configuration file is located in /usr/local/etc/c-icap/c-icap.conf. You can edit it but, somehow, the webinterface replaces it while saving the configuration so this is what I (blindly) did. I'm sure there has to be a better way:

    • Edit /usr/local/etc/c-icap/c-icap.conf.pfsense

    • Locate the line AccessLog /var/log/c-icap/access.log

    • Replace it with AccessLog /dev/null

    • Go to Services/Squid Proxy Server and just save the configuration

    • Check that both /usr/local/etc/c-icap/c-icap.conf.pfsense and /usr/local/etc/c-icap/c-icap.conf have the "AccessLog /dev/null" line

    • Reboot the server (maybe restarting the icap service would be enough)

    • Browse some site and check for modifications to the access.log file

    Regards.


Log in to reply