Squid logs

It is absolutely necessary to watch the Squid logs size (they are in /var/log/squid for Fedora and RHEL), because if logs get bigger than 2G, Squid will stop working and give out some strange reasons for doing so 😉
There are two ways to solve this problem :
1. Regular log rotation
2. Regulate the very size of logs (that is the amount of information that goes into them)

1. Log rotation
It is best to leave tis to the local logrotate daemon (which is the case in the default Squid setup)
Its configuration file is in /etc/logrotate.d/squid, and for the everyday log rotation, and if you want to keep the last 5 ones (that is last 5 days of logs), it should look something like this :
/var/log/squid/access.log {
daily
rotate 5
copytruncate
compress
notifempty
missingok
}
/var/log/squid/cache.log {
daily
rotate 5
copytruncate
compress
notifempty
missingok
}

/var/log/squid/store.log {
daily
rotate 5
copytruncate
compress
notifempty
missingok
# This script asks squid to rotate its logs on its own.
# Restarting squid is a long process and it is not worth
# doing it just to rotate logs
postrotate
/usr/sbin/squid -k rotate
endscript
}

2. Regulate the size of logs is done through Squid configuration file : /etc/squid/squid.conf using the option : debug_options
If Squid is working correctly, and you do not need any debugging, this option is best left unactive (hashed). Default logs are quite enough for monitoring user activity, or its graphical representation (MySAR program is very good for this, and I will write about this in later posts).

Short description and definition of this option (debug_options) is given here.

For debugging purposes, this option is best set up as :
debug_options ALL,1
Which means that ALL is logged, at level 1 (info).

This entry was posted in Linux and tagged , . Bookmark the permalink.

Comments are closed.