squidのログファイル形式をapacheの形式へ変更する

■squidのログファイル形式をapacheの形式へ変更する

/etc/squid/squid.conf　の修正

----------------------------------
#Default:
# emulate_httpd_log off
emulate_httpd_log on
----------------------------------

/etc/init.d/squid restart
# restartが必要です

http://www.turbolinux.com/support/document/knowledge/550.html


サンプルログ

emulate_httpd_log off

1453897970.995    491 127.0.0.1 TCP_MISS/200 9157 GET http://search.yahoo.co.jp/search?p=gppppppppppppppppppppppp - DIRECT/182.22.11.59 text/html

emulate_httpd_log on

logformatの設定も必要です。

Pattern#1
## Httpd log file format With Header:
logformat squid %>a %ui %un [%tl] "%rm %ru HTTP/%rv" %Hs %<st %Ss:%Sh [%>h] [%<h]

127.0.0.1 - - [27/Jan/2016:04:42:38 -0800] "GET http://search.yahoo.co.jp/search?p=gppppppppppppppppppppppp HTTP/1.0" 200 9162 TCP_MISS:DIRECT [User-Agent: Wget/1.11.4 Red Hat modified\r\nAccept: */*\r\nHost: search.yahoo.co.jp\r\n] [HTTP/1.0 200 OK\r\nServer: ATS\r\nDate: Wed, 27 Jan 2016 12:42:38 GMT\r\nContent-Type: text/html; charset=UTF-8\r\nP3P: policyref="http://privacy.yahoo.co.jp/w3c/p3p_jp.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV"\r\nCache-Control: private\r\nVary: Accept-Encoding\r\nAge: 0\r\nConnection: close\r\n\r]


Pattern#2
logformat squid %>a %ui %un [%tl] "%rm %ru HTTP/%rv" %Hs %<st "%{Referer}>h" "%{User-Agent}>h" %Ss:%Sh

127.0.0.1 - - [27/Jan/2016:04:48:06 -0800] "GET http://search.yahoo.co.jp/search?p=gppppppppppppppppppppppp HTTP/1.0" 200 9157 "-" "Wget/1.11.4 Red Hat modified" TCP_MISS:DIRECT

Pattern#3
logformat squid %>a %ui %un [%tl] "%rm %ru HTTP/%rv" %Hs %<st %Ss:%Sh

127.0.0.1 - - [27/Jan/2016:04:51:03 -0800] "GET http://search.yahoo.co.jp/search?p=gppppppppppppppppppppppp HTTP/1.0" 200 9158 TCP_MISS:DIRECT

emulate_httpd_log on/off しなくてもlogformat変更すればいけるのだが?

んー何度か試したが、logformatの変更だけでよい気がしてきた。

ただ単に emulate_httpd_log on にしても変わらない。

どんな意味があるんだろ
#  TAG: emulate_httpd_log       on|off
#       The Cache can emulate the log file format which many 'httpd'
#       programs use.  To disable/enable this emulation, set
#       emulate_httpd_log to 'off' or 'on'.  The default
#       is to use the native log format since it includes useful
#       information Squid-specific log analyzers use.
#
#Default:
# emulate_httpd_log off
# emulate_httpd_log on