syslog-ng and squid (remove extra data...)

[symedeot]

Hi,

I moved to syslog-ng to centralize squid server logs and it's working great.

But I still have one issue and can't find a way to solve it :

The standard logs looks like this :
192.168.3.68 - - [27/May/2009:10:28:54 +0200] "CONNECT particuliers.secure.lcl.fr:443 HTTP/1.0" 200 30934 TCP_MISS:DIRECT

but with syslog_ng the program name and pid are added at the beginning of the log.

squid[4393]: 192.168.3.68 - - [27/May/2009:10:28:54 +0200] \"CONNECT particuliers.secure.lcl.fr:443 HTTP/1.0\" 200 30934 TCP_MISS:DIRECT

It is a problem since I use squid log analyzers and they won't work with these extra data...

my syslog_ng.conf :
filter f_squid { program("squid"); };

destination ndf_squid {
        file("/home/squidlog/$HOST/$YEAR/$MONTH/$DAY/access.log" template("$MSG\n")
        owner("root")
        group("proxy")
        perm(0600)
        create_dirs(yes));
};

log {
        source(s_all);
        filter(f_squid);
        destination(ndf_squid);
};

my squid.conf syslog details :
access_log /var/log/squid/access.log common    # logging to file, works well
access_log syslog:daemon common                   # logging to syslog, add extra info

Any help welcome,

Regards,

Sylvain

[mutex]

try this:

Code:

filter f_squid { program("squid"); };

destination ndf_squid {
        file("/home/squidlog/$HOST/$YEAR/$MONTH/$DAY/access.log" template("$MSG\n")
        owner("root")
        group("proxy")
        perm(0600)
        create_dirs(yes));
        template(t_test);
};

log {
        source(s_all);
        filter(f_squid);
        destination(ndf_squid);
};
template t_test { template("${MONTH} ${DAY} ${HOUR}:${MIN}:${SEC} ${HOST}: ${MSG}\n");  template_escape(no); };

[symedeot]

Hi,

Many thanks but it is still the same...

I get this :

05 29 10:54:42 proxy: squid[5198]: 192.168.3.69 - - [29/May/2009:10:54:42 +0200] "GET http://www.cinemapassion.com/covers_temp/covers3/Les_aventures_de_Winnie_l_ourson___SLIM-11211114012009.jpg HTTP/1.1" 304 398 TCP_MISS:DIRECT

I found a partial solution using sed prior to run the log analyser :
sed "s/squid\[.*\]: //g" access.log | sed '/^$/d' > test

The resulting file test is then ok.

If you have any other idea...

Regards,

Sylvain

[mutex]

If you are feeling adventurous, try adding the "store-legacy-msghdr" to the source statement.