Squid_ The Definitive Guide - Duane Wessels [127]
% ls -l 0D/CD/000DCD06
-rw------- 1 squid squid 391 Jun 3 12:40 0D/CD/000DCD06
% less 0D/CD/000DCD06
referer.log
The optional referer.log contains Referer header values from client requests. To use this feature, you must run ./configure with the —enable-referer-log option. You must also enter a pathname for the referer_log directive. For example:
referer_log /usr/local/squid/var/logs/referer.log
Set the filename to none if you want to disable referer logging.
The Referer header normally contains the URI from which the request was obtained (see Section 14.36 of RFC 2616). For example, when a web browser issues a request for an embedded image, the Referer header is set to the URI of the (HTML) page containing the images. It is also set when you click on an HTML link. Some web site operators use Referer values to find so-called dead links. You may find referer.log particularly useful if you use Squid as a surrogate.
The referer.log has a simple format, with only four fields. Here are a few examples:
1068047502.377 3.0.168.206
http://www.amazon.com/exec/obidos/search-handle-form/002-7230223-8205634
http://www.amazon.com/exec/obidos/ASIN/0596001622/qid=1068047396/sr=2-1/...
1068047503.109 3.0.168.206
http://www.amazon.com/exec/obidos/ASIN/0596001622/qid=1068047396/sr=2-1/...
http://g-images.amazon.com/images/G/01/gourmet/gourmet-segway.gif
1068047503.196 3.0.168.206
http://www.amazon.com/exec/obidos/ASIN/0596001622/qid=1068047396/sr=2-1/...
http://g-images.amazon.com/images/G/01/marketing/cross-shop/arnold/appar...
1068047503.198 3.0.168.206
http://www.amazon.com/exec/obidos/ASIN/0596001622/qid=1068047396/sr=2-1/...
http://g-images.amazon.com/images/G/01/marketing/cross-shop/arnold/appar...
1068047503.825 3.0.168.206
http://www.amazon.com/exec/obidos/ASIN/0596001622/qid=1068047396/sr=2-1/...
http://images.amazon.com/images/P/B00005R8BC.01.TZZZZZZZ.jpg
1068047503.842 3.0.168.206
http://www.amazon.com/exec/obidos/ASIN/0596001622/qid=1068047396/sr=2-1/...
http://images.amazon.com/images/P/0596001622.01._PE_PI_SCMZZZZZZZ_.jpg
Note that requests that lack a Referer header aren't logged. The four fields are as follows:
1: timestamp
The time of the request, expressed as the number of seconds since Unix epoch with millisecond resolution.
Note that, unlike access.log, a referer.log entry is made as soon as Squid receives the complete request. Thus, the referer.log entry occurs before the access.log, which waits for the end of the response.
2: client address
The same as the client address in access.log. The log_fqdn and client_netmask directives affect this log file as well.
3: referer
The value of the Referer header from the client's request. Note that the referer value might have whitespace (or any other) characters. Squid doesn't encode the value before writing to referer.log.
4: URI
The URI that the client is requesting. It matches the URI in access.log.
useragent.log
The optional useragent.log contains User-Agent header values from client requests. To use this feature, you must supply the —enable-useragent-log option when running ./configure. You also must enter a pathname for the useragent_log directive. For example:
useragent_log /usr/local/squid/var/logs/useragent.log
The User-Agent header normally contains a description of the agent that made the request. In most cases, the description is simply a list of product names with optional version information. You should be aware that applications can easily provide false user-agent information. Modern user-agents provide a way to customize the description. Even Squid can alter the User-Agent header in forwarded requests.
The useragent.log format is relatively simple. It looks like this:
3.0.168.206 [05/Nov/2003:08:51:43 -0700]
"Mozilla/5.0 (compatible; Konqueror/3; FreeBSD)"
3.0.168.207 [05/Nov/2003:08:52:18 -0700]
"Opera/7.21 (X11; FreeBSD i386; U) [en]"
4.241.144.204 [05/Nov/2003:08:55:11 -0700]
"Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/103u (KHTM..."
3.0.168.206 [05/Nov/2003:08:51:43 -0700]
"Java1.3.1_01"