Q. I'm using squid proxy server under CentOS Linux version 5. How to filter a particular MAC address under squid?
A. Not all operating system supports Mac address based filtering. For some operating systems. Squid calls these "ARP ACLs" and they are supported on Linux, Solaris, and BSD variants.
How do I set up ACL's based on MAC address?
# vi /etc/squid/squid.conf
Local acl, section and append ACL as follows:
acl macf1 arp mac-address
acl macf2 arp 00:11:22:33:44:55
http_access allow macf1
http_access allow macf2
http_access deny all
Save and close the file. Restart squid server:
# /etc/init.d/squid restart
Q. How do I view squid proxy server log files under CentOS Linux server 5.0?
A. squid is a high-performance proxy caching server for web clients, supporting FTP, gopher, and HTTP data objects. Unlike traditional caching software, squid handles all requests in a single, non-blocking, I/O-driven process.
/var/log/squid/ log file directory
The logs are a valuable source of information about Squid workloads and performance. The logs record not only access information, but also system configuration errors and resource consumption (eg, memory, disk space). There are several log file maintained by Squid. Some have to be explicitely activated during compile time, others can safely be deactivated during.
- /var/log/squid/access.log : Most log file analysis program are based on the entries in access.log. You can use this file to find out who is using squid server and what they are doing etc
- /var/log/squid/cache.log : The cache.log file contains the debug and error messages that Squid generates. If you start your Squid using the default RunCache script, or start it with the -s command line option, a copy of certain messages will go into your syslog facilities. It is a matter of personal preferences to use a separate file for the squid log data.
- /var/log/squid/store.log : The store.log file covers the objects currently kept on disk or removed ones. As a kind of transaction log it is ususally used for debugging purposes. A definitive statement, whether an object resides on your disks is only possible after analysing the complete log file. The release (deletion) of an object may be logged at a later time than the swap out (save to disk).
How do I view Squid Log files / logs?
You can use standard UNIX / Linux command such as grep / tail to view log files. You must login as root or sudo command to view log files.
Display log files in real time
Use tail command as follows:
# tail -f /var/log/squid/access.log
$ sudo tail -f /var/log/squid/access.log
Search log files
Use grep command as follows:
grep 'string-to-search' /var/log/squid/access.log
View log files
Finally you can use text editor such as vi to view log files:
# vi /var/log/squid/access.log