Heavy logs Creation In squid access logs

vijaybhandari · 08-16-2017, 02:19 AM

Hi,

While monitoring my squid server access logs I had noticed heavy
logs creation through multiple IPs

Following is the logs

Quote:

1502867095.990 0 10.1.228.249 NONE/400 10326 GET http://209.58.139.151:10001/?valid=null&count=12860&case=unknown_case&source=160by2_2.7&eid=knlhpefpakgilecjmidpainkjlclbpej&ver sion=160by2_2.7&email=%3C!DOCTYPE%20html%20PUBLIC%20%22-//W3C//DTD%20HTML%204.01//EN%22%20%22http://www.w3.org/TR/html4/strict.dtd%22%3E%3Chtml%3E%3Chead%3E%3Cmeta%20http-equiv=%22Content-Type%22%20content=%22text/html;%20charset=utf-8%22%3E%3Ctitle%3EERROR:%20The%20requested%20URL%20could%20not%20be%20retrieved%3C/title%3E%3Cstyle%20type=%22text/css%22%3E%3C!--%20%20body:lang(fa)%20{%20direction:%20rtl;%20font-size:%20100%;%20font-family:%20Tahoma,%20Roya,%20sans-serif;%20float:%20right;%20}:lang(he)%20{%20direction:%20rtl;%20float:%20right;%20}%20--%3E%3C/style%3E%3C/head%3E%3Cbody%3E%3Cdiv%20id=%22titles%22%3E%3Ch1%3EERROR%3C/h1%3E%3Ch2%3EThe%20requested%20URL%20could%20not%20be%20retrieved%3C/h2%3E%3C/div%3E%3Chr%3E%3Cdiv%20id=%22content%22%3E%3Cp%3EThe%20following%20error%20was%20encountered%20while %20trying%20to%20retrieve%20the%20URL:%20%3Ca%20href=%22http://209.58.139.151:10001/?valid=null&count=12859&case=unknown_case&source=160by2_2.7&eid=knlhpefpakgilecjmidp ainkjlclbpej&version=160by2_2.7&email=%3C!DOCTYPE%20html%20PUBLIC%20%22-//W3C//DTD%20HTML%204.01//EN%22%20%22http://www.w3.org/TR/html4/strict.dtd%22%3E%3Chtml%3E%3Chead%3E%3Cmeta%20http-equiv=%22Content-Type%22%20content=%22text/html;%20charset=utf-8%22%3E%3Ctitle%3EERROR:%20The%20requested%20URL%20could%20not%20be%20retrieved%3C/title%3E%3Cstyle%20type=%22text/css%22%3E%3C!--%20%20body:lang(fa)%20{%20direction:%20rtl;%20font-size:%20100%;%20font-family:%20Tahoma,%20Roya,%20sans-serif;%20float:%20right;%20}:lang(he)%20{%20direction:%20rtl;%20float:%20right;%20}%20--%3E%3C/style%3E%3C/head%3E%3Cbody%3E%3Cdiv%20id=%22titles%22%3E%3Ch1%3EERROR%3C/h1%3E%3Ch2%3EThe%20requested%20URL%20could%20not%20be%20retrieved%3C/h2%3E%3C/div%3E%3Chr%3E%3Cdiv%20id=%22content%22%3E%3Cp%3EThe%20following%20error%20was%20encountered%20while %20trying%20to%20retrieve%20the%20URL:%20%3Ca%20href=%22http://209.58.139.151:10001/?valid=null&amp;count=12858&amp;case=unknown_case&amp;source=160by2_2.7&amp;eid=knlh pefpakgilecjmidpainkjlclbpej&amp;version=160by2_2.7&amp;email=%3C!DOCTYPE%20html%20PUBLIC%20 %22-//W3C//DTD%20HTML%204.01//EN%22%20%22http://www.w3.org/TR/html4/strict.dtd%22%3E%3Chtml%3E%3Chead%3E%3Cmeta%20http-equiv=%22Content-Type%22%20content=%22text/html;%20charset=utf-8%22%3E%3Ctitle%3EERROR:%20The%20requested%20URL%20could%20not%20be%20retrieved%3C/title%3E%3Cstyle%20type=%22text/css%22%3E%3C!--%20%20body:lang(fa)%20{%20direction:%20rtl;%20font-size:%20100%;%20font-family:%20Tahoma,%20Roya,%20sans-serif;%20float:%20right;%20}:lang(he)%20{%20direction:%20rtl;%20float:%20right;%20}%20--%3E%3C/style%3E%3C/head%3E%3Cbody%3E%3Cdiv%20id=%22titles%22%3E%3Ch1%3EERROR%3C/h1%3E%3Ch2%3EThe%20requested%20URL%20could%20not%20be%20retrieved%3C/h2%3E%3C/div%3E%3Chr%3E%3Cdiv%20id=%22content%22%3E%3Cp%3EThe%20following%20error%20was%20encountered%20while %20trying%20to%20retrieve%20the%20URL:%20%3Ca%20href=%22http://209.58.139.151:10001/?valid=null&amp;amp;count=12857&amp;amp;case=unknown_case&amp;amp;source=160by2_2.7& amp;amp;eid=knlhpefpakgilecjmidpainkjlclbpej&amp;amp;version=160by2_2.7&amp;amp;email=%3C!DO CTYPE%20html%20PUBLIC%20%22-//W3C//DTD%20HTML%204.01//EN%22%20%22http://www.w3.org/TR/html4/strict.dtd%22%3E%3Chtml%3E%3Chead%3E%3Cmeta%20http-equiv=%22Content-Type%22%20content=%22text/html;%20charset=utf-8%22%3E%3Ctitle%3EERROR:%20The%20requested%20URL%20could%20not%20be%20retrieved%3C/title%3E%3Cstyle%20type=%22text/css%22%3E%3C!--%20%20body:lang(fa)%20{%20direction:%20rtl;%20font-size:%20100%;%20font-family:%20Tahoma,%20Roya,%20sans-serif;%20float:%20right;%20}:lang(he)%20{%20direction:%20rtl;%20float:%20right;%20}%20--%3E%3C/style%3E%3C/head%3E%3Cbody%3E%3Cdiv%20id=%22titles%22%3E%3Ch1%3EERROR%3C/h1%3E%3Ch2%3EThe%20requested%20URL%20could%20not%20be%20retrieved%3C/h2%3E%3C/div%3E%3Chr%3E%3Cdiv%20id=%22content%22%3E%3Cp%3EThe%20following%20error%20was%20encountered%20while %20trying%20to%20retrieve%20the%20URL:%20%3Ca%20href=%22http://209.58.139.151:10001/?valid=null&amp;amp;amp;count=12856&amp;amp;amp;case=unknown_case&amp;amp;amp;source=160 by2_2.7&amp;amp;amp;eid=knlhpefpakgilecjmidpainkjlclbpej&amp;amp;amp;version=160by2_2.7& amp;amp;amp;email=%3C!DOCTYPE%20html%20PUBLIC%20%22-//W3C//DTD%20HTML%204.01//EN%22%20%22http://www.w3.org/TR/html4/strict.dtd%22%3E%3Chtml%3E%3Chead%3E%3Cmeta%20http-equiv=%22Content-Type%22%20content=%22text/html;%20charset=utf-8%22%3E%3Ctitle%3EERROR:%20The%20requested%20URL%20could%20not%20be%20retrieved%3C/title%3E%3Cstyle%20type=%22text/css%22%3E%3C!--%20%20body:lang(fa)%20{%20direction:%20rtl;%20font-size:%20100%;%20font-family:%20Tahoma,%20Roya,%20sans-serif;%20float:%20right;%20}:lang(he)%20{%20direction:%20rtl;%20float:%20right;%20}%20--%3E%3C/style%3E%3C/head%3E%3Cbody%3E%3Cdiv%20id=%22titles%22%3E%3Ch1%3EERROR%3C/h1%3E%3Ch2%3EThe%20requested%20URL%20could%20not%20be%20retrieved%3C/h2%3E%3C/div%3E%3Chr%3E%3Cdiv%20id=%22content%22%3E%3Cp%3EThe%20following%20error%20was%20encountered%20while %20trying%20%22%3Ehttp://209.58.139.151:10001/?valid=null&count=12859&case=unknown_case&source=160by2_2.7&eid=knlhpefpakgilecjmidp ainkjlclbpej&version=160by2_2.7&email=%3C!DOCTYPE%20html%20PUBLIC%20%22-//W3C//DTD%20HTML%204.01//EN%22%20%22http://www.w3.org/TR/html4/strict.dtd%22%3E%3Chtml%3E%3Chead%3E%3Cmeta%20http-equiv=%22Content-Type%22%20content=%22text/html;%20charset=utf-8%22%3E%3Ctitle%3EERROR:%20The%20requested%20URL%20could%20not%20be%20retrieved%3C/title%3E%3Cstyle%20type=%22text/css%22%3E%3C!--%20%20body:lang(fa)%20{%20direction:%20rtl;%20font-size:%20100%;%20font-family:%20Tahoma,%20Roya,%20sans-serif;%20float:%20right;%20}:lang(he)%20{%20direction:%20rtl;%20float:%20right;%20}%20--%3E%3C/style%3E%3C/head%3E%3Cbody%3E%3Cdiv%20id=%22titles%22%3E%3Ch1%3EERROR%3C/h1%3E%3Ch2%3EThe%20requested%20URL%20could%20not%20be%20retrieved%3C/h2%3E%3C/div%3E%3Chr%3E%3Cdiv%20id=%22content%22%3E%3Cp%3EThe%20following%20error%20was%20encountered%20while %20trying%20to%20retrieve%20the%20URL:%20%3Ca%20href=%22http://209.58.139.151:10001/?valid=null&amp;count=12858&amp;case=unknown_case&amp;source=160by2_2.7&amp;eid=knlh pefpakgilecjmidpainkjlclbpej&amp;version=160by2_2.7&amp;email=%3C!DOCTYPE%20html%20PUBLIC%20 %22-//W3C//DTD%20HTML%204.01//EN%22%20%22http://www.w3.org/TR/html4/strict.dtd%22%3E%3Chtml%3E%3Chead%3E%3Cmeta%20http-equiv=%22Content-Type%22%20content=%22text/html;%20charset=utf-8%22%3E%3Ctitle%3EERROR:%20The%20requested%20URL%20could%20not%20be%20retrieved%3C/title%3E%3Cstyle%20type=%22text/css%22%3E%3C!--%20%20body:lang(fa)%20{%20direction:%20rtl;%20font-size:%20100%;%20font-family:%20Tahoma,%20Roya,%20sans-serif;%20float:%20right;%20}:lang(he)%20{%20direction:%20rtl;%20float:%20right;%20}%20--%3E%3C/style%3E%3C/head%3E%3Cbody%3E%3Cdiv%20id=%22titles%22%3E%3Ch1%3EERROR%3C/h1%3E%3Ch2%3EThe%20requested%20URL%20could%20not%20be%20retrieved%3C/h2%3E%3C/div%3E%3Chr%3E%3Cdiv%20id=%22content%22%3E%3Cp%3EThe%20following%20error%20was%20encountered%20while %20trying%20to%20retrieve%20the%20URL:%20%3Ca%20href=%22http://209.58.139.151:10001/?valid=null&amp;amp;count=12857&amp;amp;case=unknown_case&amp;amp;source=160by2_2.7& amp;amp;eid=knlhpefpakgilecjmidpainkjlclbpej&amp;amp;version=160by2_2.7&amp;amp;email=%3C!DO CTYPE%20html%20PUBLIC%20%22-//W3C//DTD%20HTML%204.01//EN%22%20%22http://www.w3.org/TR/html4/strict.dtd%22%3E%3Chtml%3E%3Chead%3E%3Cmeta%20http-equiv=%22Content-Type%22%20content=%22text/html;%20charset=utf-8%22%3E%3Ctitle%3EERROR:%20The%20requested%20URL%20could%20not%20be%20retrieved%3C/title%3E%3Cstyle%20type=%22text/css%22%3E%3C!--%20%20body:lang(fa)%20{%20direction:%20rtl;%20font-size:%20100%;%20font-family:%20Tahoma,%20Roya,%20sans-serif;%20float:%20right;%20}:lang(he)%20{%20direction:%20rtl;%20float:%20right;%20}%20--%3E%3C/style%3E%3C/head%3E%3Cbody%3E%3Cdiv%20id=%22titles%22%3E%3Ch1%3EERROR%3C/h1%3E%3Ch2%3EThe%20requested%20UR

these type of logs are generating from various IP address
which resulted in high hard disk space utilization of squid logs
A day space utilization of access.log file amount to around 8GB whereas before this problem access.log file utilize only 4-6GB space for a week

how to resolve this problem as it leads to harddisk space problem in our Server

vijaybhandari · 08-16-2017, 02:24 AM

Following is my squid.conf configuration file

Quote:

#/ NETWORK OPTIONS
# -----------------------------------------------------------------------------
http_port 80
icp_port 0 # by default port is 3130, set to 0 to accelerate

# PEER CACHE SERVER
#------------------------------------------------------------------------------
#hierarchy_stoplist cgi-bin ? jsp asp
#acl QUERY urlpath_regex cgi-bin \?

#THE CACHE SIZE
# -----------------------------------------------------------------------------
max_filedescriptors 8192
maximum_object_size 5048 KB
minimum_object_size 0 KB
cache_replacement_policy heap LFUDA
#LOG FILE PATHNAMES & CACHE DIRECTORIES
#------------------------------------------------------------------------------
#cache_dir ufs /var/spool/squid 100 16 256
cache_dir aufs /var/spool/squid 8000 16 256
#logformat squid %tl.%03tu %6tr %>a %Ss/%03Hs %<st %rm %ru %un %Sh/%<A %mt
cache_access_log /var/log/squid/access.log squid
cache_log /var/log/squid/cache.log
cache_store_log /var/log/squid/store.log
#cache_mem 0MB
cache_mem 500 MB
# SUPPORT FOR EXTERNAL FUNCTIONS
#------------------------------------------------------------------------------

#######To allow website www.iirs.gov.in ####### -Date 17 July 2013
via off
forwarded_for delete
#######To allow website www.iirs.gov.in ####### -Date 17 July 2013

dns_nameservers 172.16.104.51
#dns_namedservers 172.16.104.41
#authenticate_program /usr/lib/squid/ncsa_auth /etc/squid/squid_passwd
authenticate_ip_ttl 60 seconds #duplicate users
#authenticate_ip_ttl_is_strict on
# TUNING THE CACHE
# -----------------------------------------------------------------------------
# TIMEOUTS
#------------------------------------------------------------------------------
connect_timeout 150 seconds
client_lifetime 500 minutes
half_closed_clients off #connection closed if client shutdown
pconn_timeout 60 seconds #timeout for ideal connections
# ACCESS CONTROL LISTS
#------------------------------------------------------------------------------
#acl ncsa_users proxy_auth REQUIRED

#------------------------------------------------------------------------------

#Allow everything for goverment sites. Script created on 24-06-11 by Mr. Kapil
acl govtsites src 10.0.0.0/8 172.16.0.0/16
acl gov dstdom_regex "/etc/squid/gov"
http_access allow govtsites gov

acl vlan4 src 10.0.0.0/8
acl vlan4 src 172.16.107.0/24
acl vlan4 src 172.16.106.0/24
#acl vlan4 src 172.16.105.0/24

#tcp_outgoing_address 172.16.104.31 vlan4
tcp_outgoing_address 172.16.105.31 vlan4

acl vlan5 src 172.16.21.0/24
acl vlan5 src 172.16.22.0/24
acl vlan5 src 172.16.23.0/24
acl vlan5 src 172.16.24.0/24
acl vlan5 src 172.16.25.0/24
acl vlan5 src 172.16.26.0/24
acl vlan5 src 172.16.27.0/24
acl vlan5 src 172.16.28.0/24
acl vlan5 src 172.16.29.0/24
acl vlan5 src 172.16.30.0/24
acl vlan5 src 172.16.31.0/24
acl vlan5 src 172.16.32.0/24
acl vlan5 src 172.16.33.0/24
tcp_outgoing_address 172.16.105.31 vlan5

tcp_outgoing_address 172.16.104.31 all

#ACL for Allowed IPs of e-procurement

acl stg1 src "/etc/squid/PolicyObjects/eprocurement_PC_allow"
reply_body_max_size 10 GB stg1
http_access allow stg1

#acl all src all

acl stg src 172.16.106.65/32, 10.1.148.174/32, 172.16.24.91/32,
reply_body_max_size 20 GB stg
http_access allow stg

acl stg_log_ip src 172.16.106.65/32,
log_access deny stg_log_ip

#reply_body_max_size 20 MB all

acl vayam src 10.2.6.8/32, 172.16.107.116/32
acl local dstdomain .vayamtech.com
http_access allow vayam local

acl siteblock src 10.1.250.254/32, 10.1.253.252/32, 10.1.234.224/32, 10.1.240.218/32, 10.1.237.251/32, 10.1.245.227/32, 10.2.6.8/32, 10.1.253.232/32, 172.16.33.15/32
acl egov1 time 15:01-23:59
acl egov2 time 00:00-12:59
http_access deny siteblock egov1
http_access deny siteblock egov2

#---------ACL FOR scopees.elsevier.com Add on 8Jan.2014 Requested by jatender Sir-----#
acl siteblock1 src 172.16.21.0-172.16.33.0/24
acl nknblock dstdomain .wileyonlinelibrary.com
http_reply_access deny siteblock1 nknblock

#----ACL for Allowing mginger.com for a Particular Sudhir Sir IP DATED 07March2014 --------#
acl allowsite dstdomain .mginger.com, .youtube.com
acl allowip src 10.1.228.249/32, 10.1.247.221/32
http_access allow allowsite allowip

#----ACL for Allowing A website for complete videos 10 Dec 2015 --------#
#acl allowedusite dstdomain .361dm.com
#acl allowNetwork src 172.16.107.0/24
#reply_body_max_size 10 GB allowNetwork
#http_access allow allowedusite allowNetwork

#---------ACL for yahoo.com-----------------#
acl testurl dstdomain .yahoo.com
http_access allow testurl
#---------ACL for yahoo.com-----------------#

#------------------------Good URLs to Allow-------------------------------
acl goodUrl dstdomain .****.org
acl goodUrl dstdomain .****.gov.in
acl goodUrl dstdomain .nrsc.gov.in
acl goodUrl dstdomain .landcover.org
acl goodUrl dstdomain .usgs.gov.in
acl goodUrl dstdomain .yimg.com # Allow Url on Date 25-08-2011 On user Request
#acl goodUrl dstdomain .yahoo.com
acl goodUrl dstdomain .airtel.in
acl goodUrl dstdomain .google.com
#acl goodurl dstdomain .bit.ly/1Ra9DXq
acl goodurl dstdomain .gmail.com
acl goodUrl dstdomain .rediff.com
acl goodUrl dstdomain .forestgamespb.com
acl goodUrl dstdomain helpbiotech.blogspot.com
acl goodUrl dstdomain paycommissionnews.blogspot.com
acl goodUrl dstdomain enggcollegeadmission.blogspot.com
acl goodUrl dstdomain rfri-demovillage.blogspot.com
acl goodUrl dstdomain .sussex.ac.uk
acl goodUrl dstdomain .ndtv.com
acl goodUrl dstdomain .tolicjorhat.blogspot.com
acl goodUrl dstdomain .blogger.com
acl goodUrl dstdomain 4.bp.blogspot.com
acl goodUrl dstdomain 3.bp.blogspot.com
#acl goodUrl dstdomain 2.bp.blogspot.com
acl goodUrl dstdomain .speakasiaonline.com
acl goodUrl dstdomain 164.100.194.5:8080
acl goodUrl dstdomain .skype.com
acl goodUrl dstdomain .90paisa.blogspot.com
acl goodUrl dstdomain .duckduckgo.com
acl goodUrl dstdomain .way2sms.com
acl goodUrl dstdomain vedvikas.blogspot.in
acl goodUrl dstdomain mail.lycos.com
acl goodUrl dstdomain ad.yieldmanager.com
acl goodUrl dstdomain .accti.in
acl goodUrl dstdomain .scopees.elsevier.com
acl goodUrl dstdomain .incometaxindiaefiling.gov.in
acl goodUrl dstdomain .cressexpress.org
acl goodUrl dstdomain .aiimsexams.org
acl goodUrl dstdomain .rajyasabha.nic.in
acl goodurl dstdomain .rajyasabha.nic.in/rsnew/Parliament_of_India.pdf
acl goodUrl dstdomain .alibaba.com
acl goodUrl dstdomain .youtube.com/embed/ZXFHxMRErDI?
acl goodUrl dstdomain .urvashisharmalucknow.blogspot.in
acl goodUrl dstdomain .editorialmanager.com
acl goodUrl dstdomain .cimap.res.in
acl goodUrl dstdomain .kotaksecurities.com
acl goodUrl dstdomain .msn.com
acl goodUrl dstdomain www8.hp.com
acl goodurl dstdomain www.interadsadvertising.com
#acl goodurl dstdomain .feedproxy.google.com
acl goodUrl dstdomain .outlook.office365.com
acl goodUrl dstdomain .ftp.iirs.gov.in
acl goodUrl dstdomain .outlook.live.com
acl goodUrl dstdomain .encrypted-tbn0.gstatic.com
acl goodUrl dstdomain .iuu.ac
acl goodUrl dstdomain .kea.kar.nic.in/cet_2017.htm
http_access allow goodUrl
#------------------------Good URLs to Allow-------------------------------

#------------------ NEW Rule FOR Time Base Access to blocked URLS-----------
#acl allowtime time MTWHF 11:00-12:00
#acl ipaddtoallow src 10.1.241.149/32
#http_access allow allowtime ipaddtoallow
#------------------ NEW Rule FOR Time Base Internet 04_Feb_2014------------

#---Allow Facebook in two host Ip in Each Instituteref: reference to letter No.4-53/IT/****/2013-14 dated the 16th March, 2016 -----------------------------#
acl urlToAccess dstdomain .facebook.com .twitter.com
acl ipToAccess src "/etc/squid/PolicyObjects/facebookips"
http_access allow urlToAccess ipToAccess
#----------------------------------------------------------------------------------#

#-------------------------suspecious URLs-word to Block location--------------------------------
acl badurl url_regex -i "/etc/squid/PolicyObjects/word"
http_access deny badurl

acl restrictedGroup url_regex "/etc/squid/PolicyObjects/restrictedGroup1"
http_access deny restrictedGroup

acl blockdomain dstdomain "/etc/squid/PolicyObjects/restricdomain"
http_access deny blockdomain

acl BadSites dstdomain "/usr/local/etc/restricted-sites.squid"
http_access deny BadSites
#-------------------------suspecious URLs-word to Block location --------------------------------

#------------------ NEW Rule Add for facebook Change 10-08-2010--------------------------------------
acl face dstdomain .facebook.com .twitter.com
acl mynet time MTWHF 9:00-17:30
http_access deny face mynet
#------------------ NEW Rule End for facebook Change 10-08-2010--------------------------------------

#------------------ Audio/Video Formats blocked --------------------#
acl mp3s url_regex -i \.mp3$
acl mp3s url_regex -i \.wav$
acl mp3s url_regex -i \.piff$
acl mp3s url_regex -i \.scr$
#acl mp3s url_regex -i \.avi$
#acl mp3s url_regex -i \.dat$
acl mp3s url_regex -i \.rm$
acl mp3s url_regex -i \.exe$
#acl mp3s url_regex -i \.mpeg$
acl mp3s url_regex -i \.asf$
acl mp3s url_regex -i \.divx$
acl mp3s url_regex -i \.dv$
acl mp3s url_regex -i \.gxf$
acl mp3s url_regex -i \.m2v$
acl mp3s url_regex -i \.m1v$
acl mp3s url_regex -i \.rm$
acl mp3s url_regex -i \.rmvb$
acl mp3s url_regex -i \.vob$
acl mp3s url_regex -i \.b4s$
acl mp3s url_regex -i \.vlc$
acl mp3s url_regex -i \.vob$
acl mp3s url_regex -i \.mp4$
acl mp3s url_regex -i \.crx$
acl mp3s url_regex -i \.xpi$

http_access deny mp3s
#------------------ Audio/Video Formats blocked --------------------#

#------------ACL For Google Docs-----------------------------#
acl urlToAccess dstdomain .fsigeoportal.gov.in
acl ipToAccess src 172.16.107.101/32
http_access allow urlToAccess ipToAccess
#------------------------------------------------------------#

#------ACL to allow particular IPBased Website After Ultra surf Blocking---------#

acl IpToAllow url_regex "/etc/squid/PolicyObjects/urlToallow"
http_access allow IpToAllow

acl RajyaSabhaIp url_regex http://164.100.47.[0-9]
http_access allow RajyaSabhaIp

acl allowedIp url_regex http://164.100.34.62, 172.16.104.37
http_access allow allowedIp

#------------ACL FOR Downloading Files More than 20MB 11-May-2015---------------------------#
acl geo src 10.1.227.250/32
reply_body_max_size 50 GB geo
http_access allow geo

#-------ACL for Blocking heavy Logs---------#
#acl IpToDeny url_regex "/etc/squid/PolicyObjects/urlToDeny"
#http_access deny IpToDeny

#------------ACL FOR Downloading Files---------------------------#

reply_body_max_size 200 MB all

#----ACL FOR SKYPE-------------#
acl skypetest url_regex 64.4.0.0/18
acl skypetest url_regex 65.52.0.0/14
http_access allow skypetest

#-----------------------Ultra Surf blocking------------------------#
acl ipbaseacl url_regex http://[0-9]*\.[0-9]*\.[0-9]*\.[0-9]*
http_access deny ipbaseacl
acl numeric_IPs url_regex ^[0-9]+.[0-9]+.[0-9]+.[0-9]+
http_access deny numeric_IPs
#------------------------Ultra Surf Blocking-----------------------#

# Hotmail MSN Block
acl msn url_regex messenger.hotmail.com
http_access deny msn

acl messenger_site dstdomain .msg.yahoo.com
acl messenger_site dstdomain messenger.yahoo.com
#acl messenger_site dstdomain .skype.com
acl messenger_site dstdomain .imagine-msn.com/messenger
#acl messenger_site dstdomain .talk.google.com
#acl messenger_site dstdomain talkx.l.google.com:443
acl messenger_site dstdomain .ebuddy.com
http_access deny messenger_site

#-Default------------------------------------------------------------
acl manager proto cache_object
acl localhost src 127.0.0.1/32
acl SSL_ports port 443 563 1935 1953 8080 80 995 587 993 465 5523 5528 4244 5242 5222 5223 5228 5060
# http ftp https snews gopher wais http-mgmt filemaker multiling-http
#acl Safe_ports port 20 21 443 563 70 210 280 488 591 777
acl Safe_ports port 25 96 443 563 8080 5060 1935 1953 995 587 993 465 5523 5528 4244 5242 5222 5223 5228 80
acl Safe_ports port 1025-65535 # unregistered ports
acl broken_sites dstdomain .whatsapp.com # whatsapp
acl CONNECT method CONNECT
acl ftp_port port 20 21
#--------------------------------------------------------------------

http_access allow all

# Rules---------------------------------------------------------------
http_access deny manager
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
# And finally deny all other access to this proxy
#http_access allow localhost
http_access deny all
icp_access deny all
#ident_lookup_access allow ident_hosts
#ident_lookup_access deny all
# ADMINISTRATIVE PARAMETERS
# -----------------------------------------------------------------------------
#cache_mgr servicedesk@****.org
#cachemgr_passwd servicedesk all
# CACHE REGISTRATION SERVICE
#------------------------------------------------------------------------------
# HTTPD ACCELERATOR OPTIONS
#------------------------------------------------------------------------------
#httpd_accel_host virtual
#httpd_accel_port 80
#visible_hostname proxy.****.org
visible_hostname internet.****.org
#httpd_accel_with_proxy on
#httpd_accel_uses_host_header on
# MISCELLANEOUS
#------------------------------------------------------------------------------
client_db on
client_persistent_connections off
#debug_options ALL 1, 28,9
# DELAYPOOL PARAMETERS
#------------------------------------------------------------------------------

vijaybhandari · 08-16-2017, 04:14 AM

Server : Redhat 6.4
Squid Version : squid 3.1.10

AwesomeMachine · 08-16-2017, 08:52 AM

You can either rotate the logs more frequently, or adjust the logformat to be shorter. https://wiki.squid-cache.org/Features/LogFormat

It looks like your server is encountering misconfigured web pages.

asnani_satish · 09-22-2017, 01:03 AM

Many of our squid clients are continuously accessing http://209.58.139.151:10001/?. What exactly is this site doing on port 10001 and how to avoid this?

TB0ne · 09-23-2017, 09:41 AM

Quote:

Originally Posted by asnani_satish

Many of our squid clients are continuously accessing http://209.58.139.151:10001/?. What exactly is this site doing on port 10001 and how to avoid this?

You need to read the LQ Rules...don't hijack someone elses thread with your own question. Open your own thread for your own question, and be sure to read the "Question Guidelines" and "How to ask a smart question" links as well.

Unless you provide actual details (version/distro of Linux, squid, what you've done/tried, etc.), we cannot help.