squid_syslog_required = { # The name of the log format log.format.format_label = "Squid Log Format" log.miscellaneous.log_data_type = "syslog_required" log.miscellaneous.log_format_type = "proxy_server" # The log is in this format if any of the first ten lines match this regular expression log.format.autodetect_regular_expression = "[0-9.]* [A-Z_]*/[0-9]* [0-9]* [A-Z]* [^ ]* [^ ]* [A-Z_]*/[^ ]* [^ ]* *" # All log field parsing will be done using the parsing filters log.format.parse_only_with_filters = "true" # Log fields log.fields = { source_ip = { label = "$lang_stats.field_labels.source_ip" type = "host" index = 0 subindex = 0 hierarchy_dividers = "" left_to_right = false leading_divider = "false" } # source_ip action = { label = "$lang_stats.field_labels.action" type = "flat" index = 0 subindex = 0 } # action server_response = { label = "$lang_stats.field_labels.server_response" type = "response" index = 0 subindex = 0 hierarchy_dividers = "" left_to_right = false leading_divider = "false" } # server_response size = { label = "$lang_stats.field_labels.size" type = "size" index = 0 subindex = 0 hierarchy_dividers = "" left_to_right = false leading_divider = "false" } # size operation = { label = "$lang_stats.field_labels.operation" type = "flat" index = 0 subindex = 0 } # operation url = { label = "$lang_stats.field_labels.url" type = "page" index = 0 subindex = 0 hierarchy_dividers = "/?" left_to_right = "true" leading_divider = "true" } # url username = { label = "$lang_stats.field_labels.username" type = "flat" index = 0 subindex = 0 } # username hierarchy = { label = "$lang_stats.field_labels.hierarchy" type = "flat" index = 0 subindex = 0 } # hierarchy server_ip = { label = "$lang_stats.field_labels.server_ip" type = "flat" index = 0 subindex = 0 } # server_ip mime_type = { label = "$lang_stats.field_labels.mime_type" type = "flat" index = 0 subindex = 0 } # mime_type } # log.fields # This plug-in is intended to support Squid 1.1+ format. # From the Squid docs: # The native format is different for different major versions of Squid. For Squid-1.0 it is: # time elapsed remotehost code/status/peerstatus bytes method URL # For Squid-1.1, the information from the hierarchy.log was moved into access.log. The format is: # time elapsed remotehost code/status bytes method URL rfc931 peerstatus/peerhost type # For Squid-2 the columns stay the same, though the content within may change a little. # Log Parsing Filters log.parsing_filters = { # Parse out the router portions of line 1 = { label = "1" comment = "" value = "collect_fields_using_regexp('() ([^ ]*) ([A-Z_]*)/([0-9]*) ([0-9]*) ([A-Z]*) ([^ ]*) ([^ ]*) ([A-Z_]*)/([^ ]*) ([^ ]*)', '*KEY*,source_ip,action,server_response,size,operation,url,username,hierarchy,server_ip,mime_type')" } # 1 # Accept this log entry 2 = { label = "2" comment = "" value = "accept_collected_entry_using_regexp('^()', false)" } # 2 } # log.parsing_filters # Database fields database.fields = { source_ip = { label = "$lang_stats.field_labels.source_ip" log_field = "source_ip" type = "string" suppress_top = 0 suppress_bottom = 2 } # source_ip url = { label = "$lang_stats.field_labels.url" log_field = "url" type = "string" suppress_top = 1 suppress_bottom = 3 } # url file_type = { label = "$lang_stats.field_labels.file_type" log_field = "file_type" type = "string" suppress_top = 0 suppress_bottom = 2 } # file_type worm = { label = "$lang_stats.field_labels.worm" log_field = "worm" type = "string" suppress_top = 0 suppress_bottom = 2 } # worm server_response = { label = "$lang_stats.field_labels.server_response" log_field = "server_response" type = "string" suppress_top = 0 suppress_bottom = 2 } # server_response action = { label = "$lang_stats.field_labels.action" log_field = "action" type = "string" suppress_top = 0 suppress_bottom = 2 } # action operation = { label = "$lang_stats.field_labels.operation" log_field = "operation" type = "string" suppress_top = 0 suppress_bottom = 2 } # operation username = { label = "$lang_stats.field_labels.username" log_field = "username" type = "string" suppress_top = 0 suppress_bottom = 2 } # username server_ip = { label = "$lang_stats.field_labels.server_ip" log_field = "server_ip" type = "string" suppress_top = 0 suppress_bottom = 2 } # server_ip hierarchy = { label = "$lang_stats.field_labels.hierarchy" log_field = "hierarchy" type = "string" suppress_top = 0 suppress_bottom = 2 } # hierarchy mime_type = { label = "$lang_stats.field_labels.mime_type" log_field = "mime_type" type = "string" suppress_top = 0 suppress_bottom = 2 } # mime_type } # database.fields # Log Filters log.filters = { remove_query = { label = "$lang_admin.log_filters.remove_query_label" comment = "$lang_admin.log_filters.remove_query_comment" value = "if (contains(url, '?')) then url = substr(url, 0, index(url, '?') + 1) . '(parameters)';" } # remove_query detect_page_views = { label = '$lang_admin.log_filters.detect_page_views_label' comment = '$lang_admin.log_filters.detect_page_views_comment' value = "if ((file_type eq 'JPEG') or (file_type eq 'JPG') or (file_type eq 'GIF') or (file_type eq 'ICO') or (file_type eq 'PNG') or (file_type eq 'CSS') or (file_type eq 'SWF') or (file_type eq 'JS')) then page_views = 0; else page_views = 1;" } # detect_page_views strip_non_page_views = { label = '$lang_admin.log_filters.strip_non_page_views_label' comment = '$lang_admin.log_filters.strip_non_page_views_comment' value = "if (page_views == 0) then url = substr(url, 0, last_index(url, '/') + 1) . '(nonpage)';" } # strip_non_page_views mark_entry = { label = '$lang_admin.log_filters.mark_entry_label' comment = '$lang_admin.log_filters.mark_entry_comment' value = 'hits = 1;' } # mark_entry } # log.filters log.field_options = { sessions_page_field = "url" sessions_visitor_id_field = "source_ip" sessions_event_field = "page_views" } # log.field_options database.numerical_fields = { hits = { label = "$lang_stats.field_labels.hits" default = false requires_log_field = false type = "int" display_format_type = "integer" entries_field = true } # hits page_views = { label = "$lang_stats.field_labels.page_views" default = true requires_log_field = false type = "int" display_format_type = "integer" } # page_views visitors = { label = "$lang_stats.field_labels.visitors" default = false requires_log_field = true log_field = "source_ip" type = "unique" display_format_type = "integer" } # visitors size = { label = "$lang_stats.field_labels.size" default = false requires_log_field = true log_field = "size" type = "float" display_format_type = "bandwidth" } # size } # database.numerical_fields create_profile_wizard_options = { host_tracking = true # How the reports should be grouped in the report menu report_groups = { date_time_group = "" content_group = { hierarchy = true url = true file_type = true mime_type = true } # content_group source_group = { source_ip = true username = true } # source_group server_group = { server_response = true server_ip = true } # server_group other_group = { logging_device = true action = true operation = true worm = true } # other } # report_groups } # create_profile_wizard_options not_supported = { } # not_supported } # squid_syslog_required