Squid doesn't display User Agent in Access Log

eskiesirius · Feb 21, 2019, 3:52 PM

Hi! I have a problem.. when i checked the access_log, there is no user agent.. it only display blank..

tell me what kind of information you want to know so you can help me in this problem..

KOM · Feb 21, 2019, 8:29 PM

I think there is only a user displayed if you configured squid to require authentication. It's showing the user, not the browser's user-agent string.

eskiesirius · Feb 21, 2019, 11:55 PM

ahhh ok.. so it was User not user-agent.. but how can i display the user-agent in access_log?

KOM · Feb 22, 2019, 2:05 PM

https://wiki.squid-cache.org/Features/LogFormat

"user The eighth column may contain the user identity for the requesting client. This may be sourced from one of HTTP authentication, an external ACL helper, TLS authentication, or IDENT lookup (RFC 931) - checked in that order with the first to present information displayed. If no user identity is available a "-" will be logged."

I don't think there is a way to log the user-agent via squid. Why do you need that anyway?

eskiesirius · Feb 22, 2019, 2:38 PM

for statistics.. our currently setup is that all logs from squid will be send to kibana..

so i need to create a custom log?

KOM · Feb 22, 2019, 2:43 PM

I did a minute or two of research and found that squid can indeed log the user-agent but it seems to be disabled by default.

http://squid-web-proxy-cache.1019090.n4.nabble.com/useragent-log-td4672505.html

https://www.oreilly.com/library/view/squid-proxy-server/9781849513906/ch05s15.html

eskiesirius · Feb 22, 2019, 2:46 PM

i already did my research before posting here but sadly.. those links didnt worked for me..

KOM · Feb 22, 2019, 3:08 PM

Works for me. The first link had the solution. Add this to your squid config under Show Advanced Options - Integrations:

access_log stdio:/var/squid/logs/useragent.log useragent

If you already have something there, append with a ; like this:

url_rewrite_program /usr/local/bin/squidGuard -c /usr/local/etc/squidGuard/squidGuard.conf;url_rewrite_bypass off;url_rewrite_children 16 startup=8 idle=4 concurrency=0;access_log stdio:/var/squid/logs/useragent.log useragent

eskiesirius · Feb 22, 2019, 3:20 PM

ok2 thank you i will try this

eskiesirius · Feb 22, 2019, 3:29 PM

anyway i did append useragent so what happened was that.. it only displayed user agent.. the other parameters were removed..

KOM · Feb 22, 2019, 3:39 PM

Yes, it writes it to separate log. You will have to figure out how to ingest useragent.log as well as access.log.

eskiesirius · Feb 22, 2019, 3:40 PM

thank you for that.. i will fix it from here..

again thank you for your guidance