รวมคำสั่งที่ใช้ในการ configure squid3 proxy

Command
#Install
apt-get update ; apt-get install -y squid3 apache2-utils

#configure
mv /etc/squid/squid.conf /etc/squid/squid.conf.bkp --> Backup configure
# แยกเอา comment ออกเหลือไว้เฉพาะค่าคอนนฟิก
grep -Eiv '(^#|^$)' /etc/squid/squid.conf.bkp
or
grep -ve ^# -ve ^$ /etc/squid/squid.conf.bkp > /etc/squid/squid.conf

#Authentication & create new user
touch /etc/squid3/passwd
htpasswd -c /etc/squid3/passwd user

การเช็ค user ที่เราสร้าง
#/usr/lib/squid3/ncsa_auth /etc/squid3/passwd
username password กด Enter
OK  --> Status

#Delete user
*ลบ user ในไฟล์ /etc/squid3/passwd ทิ้ง

#Rotate log file
30 0 * * *    /usr/sbin/squid3 -k rotate

1. squid3 -v = show version
2. ps aux|grep squid = check process squid
3. squid3 -z = create swap directory
4. squid 3 -k reconfigure = update configure immediately
5. service squid3 restart = restart service
6. view squid log
    6.1 tail -f /var/log/squid3/access.log
    6.2 tail -f /var/log/squid3/access.log | grep user ดูเฉพาะ user คนนี้
    6.3 tail -f /var/log/squid3/access.log | grep -oE 'http.*'

** แก้ไขปัญหา squid3 ออกเว็บไซต์ www.google.com ไม่ได้
ให้เพิ่ม dns_v4_first on เข้าไปแล้ว service squid3 restart เปิดได้แล้ว
Ref: squid3-cant-access-google-com-or-bing-com

custome squid log

ปรับแต่ง access.log ใน squid เพื่อให้แสดงวันที่ด้วย ดังนี้

Setting Maximum Download Size

Ref. linuxquestions.org

ตัวอย่าง

Old




New

Such as when an allstaff email goes out saying "check this site out..."

• TCP_MISS/200 means that the requested document was not in the cache but it could fetch it OK from the web server. The direct at the end says that the file was fetched from the webserver.
• TCP_IMS_HIT/304 means that the client asked if the file has changed, and squid checked its date/time on the webserver and found it had not changed, so it gave a copy of the file to the client out of its local cache.

Ref: imrgill.com
การปรับแต่ง log ให้เอาชื่อ user Authen ขึ้นมาก่อน
อันเก่าเรียง ตาม date, repornse time, ip, website, user login, ....

อันใหม่เรียง date, response time, user login, ....
ให้แก้ไขโดยนำ %un ขึ้นมาก่อน %>a
*สามารถใส่คำ เช่น user=[%un] ได้ดังรูปด้านล่าง

ตรวจสอบ log ดูภาพด้านล่าง
log formate code

Log format codes  

Field name syntax keys:

     {} modifier or argument. Also used to specify header names
     >  request (client)
     <  reply (server)
     a  address
     A  address name
     h  all headers
     i  ident
     p  port
     r  request line (no query)
     t  time
     u  user
     l  local address/port (where request was accepted)

Add caption

Squid Format
Ref. trafficserver.apache.org



 





1
    cqtq The client request timestamp in Squid format; the time of the client request in seconds since January 1, 1970 UTC (with millisecond resolution).
2
    ttms The time Traffic Server spent processing the client request; the number of milliseconds between the time the client established the connection with Traffic Server and the time Traffic Server sent the last byte of the response back to the client.
3
    chi The IP address of the client’s host machine.
4

    crc/pssc The cache result code; how the cache responded to the request: HIT, MISS, and so on. Cache result codes are described here.

        The proxy response status code (the HTTP response status code from

    Traffic Server to client).
5
    psql The length of the Traffic Server response to the client in bytes, including headers and content.
6
    cqhm The client request method: GET, POST, and so on.
7
    cquc The client request canonical URL; blanks and other characters that might not be parsed by log analysis tools are replaced by escape sequences. The escape sequence is a percentage sign followed by the ASCII code number of the replaced character in hex.
8
    caun The username of the authenticated client. A hyphen (-) means that no authentication was required.
9
    phr/pqsn The proxy hierarchy route; the route Traffic Server used to retrieve the object.

    The proxy request server name; the name of the server that fulfilled the request. If the request was a cache hit, then this field contains a hyphen (-).
10
    psct The proxy response content type; the object content type taken from the Traffic Server response header.