hi, I have a configuration problem of sending squid logs to my windows syslog server with linux syslog.conf(do i call it correct ?).

The problem is squid logs pattern is something like this :

1205355737.228 722 172.25.65.122 TCP_MISS/304 368 GET http://www.goals365.com/feed/com/min0.gif - DIRECT/83.170.72.207 -
1205355737.235 620 172.25.65.122 TCP_MISS/304 368 GET http://www.goals365.com/feed/com/min1.gif - DIRECT/83.170.72.207 -

But when logs arrive my syslog server some field are added :

(1152)squid(11276) 1205355737.235 620 172.25.65.122 TCP_MISS/304 368 GET http://www.goals365.com/feed/com/min1.gif - DIRECT/83.170.72.207 -


How can I get rid of additional field ? ((1152)squid(11276))

Squid.conf,syslog.conf ?

Thanks

PorX

I'd assume that that was the windows service doing that, where did syslog.conf come into the equation? what's the linux side squid config set up?

Thank you for your suggestion. I'm test on it and if i found something i will update again

Can you pls tell me how you are getting squid logs in syslog server. I am struggling to get that for long time

Sakthi.S

Let's try this steps.

1. change configuration of squid.conf at it's logging path from
"/usr/local/squid/var/logs/access.log" to "/var/logs/access.log"

2. edit /etc/syslog.conf to send squid's log to your syslog server
access.* @(syslogserver)

3. restart service

Hope It may help.

PorX

I finally found where the addition field of squid logs comes from.
The latest admin(who work before me) using kiwi syslog daemon to sent squid log to the log server. So, The addition's created by the process of kiwi. ><
Thx all
PorX