Squid - multiple interfaces - possible to only log on a specific interface/IP ?

[Nachtfalke]

Hello,

I have got a question about squid. I am using squid2 package since over a year. I have logging disable because my company does not want to log the traffic. But Now there could be a situation where I only should log one specific IP but not the others. I am using 6 different VLANs on which squid is listening.

My question is now:
Is it possible to tell squid only to log the traffic of one specific IP address but not all the others ?
Is it possible to only log on a specific interface but not on the others ?

I know - I can log all interfaces and just filter out the specific IP but that is not the way I want to go.

Thank you for your help!

[marcelloc]

I think the best way is to use a report package to create reports to a specific ip(s), then rotate de logs and flush it.

Sarg can do this if you create a every hour schedule with log rotate.

[Nachtfalke]

So the squid access.log will be rotated every hour and nothing will be cached longer than this time but the repor sarg builded will be persistant longer ?
I think this would be ok - if sarg can filter one specific IP or some defined IPs - and build a report based on this IP(s).

Is your sarg package compatible with squid2 ?

Thank you!

[marcelloc]

@Nachtfalke:

Is your sarg package compatible with squid2 ?

Yes  :)