Re: [squid-users] log files problems

On Sun, 7 Mar 2004, Payal Rathod wrote:

> On Sun, Mar 07, 2004 at 06:53:32PM +0100, Henrik Nordstrom wrote:
> > Because your OS does not allow files larger than 2GB for "normal"
> > applications.
>
> OT, but any way I can increase this limit?

You could compile Squid with 64-bit file I/O. See what the
--enable-large-files option does in Squid-3.

Please note that Squid has not been actively tested with 64-bit file I/O
and there may be issues in servicing very large objects etc.. and in
addition the on-disk cache format differs so you must restart your Squid
with a clean cache when enabling this.

> > * rotate the logs more often before the magic 2GB file size limit is
> > reached.
>
> Ok. But that means I lose some control over the logging data.

Not at all. It just becomes a few more files to keep track of per day.

> > * write a little script monitoring access.log and when seeing suspicious
> > activity automatically add a firewall rule to block that IP from accessing
> > the proxy.
>
> Sounds good, can you give a bit more details on what the script should
> look for?

High rates of failed requests (TCP_MISS/5xx) is a good start.

Regards
Henrik
Received on Sun Mar 07 2004 - 11:28:47 MST