By default Squid logs all access information including 'successes' and 'failures'. I'm interested in logging only 'failures'. In other words, I want to do something like log only Squid DENIED result codes, or, alternatively, don't log successful HTTP transactions. Regardless of how I define 'success' and 'failure', I need to be able to define more specifically what sort of access information Squid will write to the log file. Does anybody know how to do this?
SnapOverflow
You can achieve this functionality with ACLs, though there are some tricks to it.
The main trick is to make sure that you don't accidentally check binary connections for
http_statuscodes. Squid never sees status codes for binary connections and will throw a warning incache.logfor binary connection it sees if you mess this up.Here is a sample config that will write all http success and redirections as well as all binary connections that finish opening a socket (we don't have success/failure visibility beyond that) to
success.log, and all http failure codes and binary connections that fail to open a socket tofailure.log.The problem with this config is that it disables the default log file and will not log anything that doesn't match one of those two ACLs. Now, I'm pretty confident that I've written my ACLs well and that I've accounted for all possibilities, but this would still make me nervous, so you might want to add another log file just to catch anything that happens to miss both ACLs
Or you can just define
successand set failure to!success