13.4 referer.log

The optional referer.log contains Referer header values from client requests . To use this feature, you must run ./configure with the ”enable-referer-log option. You must also enter a pathname for the referer_log directive. For example:

 referer_log /usr/local/squid/var/logs/referer.log 

Set the filename to none if you want to disable referer logging.

The Referer header normally contains the URI from which the request was obtained (see Section 14.36 of RFC 2616). For example, when a web browser issues a request for an embedded image, the Referer header is set to the URI of the (HTML) page containing the images. It is also set when you click on an HTML link. Some web site operators use Referer values to find so-called dead links. You may find referer.log particularly useful if you use Squid as a surrogate.

The referer.log has a simple format, with only four fields. Here are a few examples:

 1068047502.377 3.0.168.206     http://www.amazon.com/exec/obidos/search-handle-form/002-7230223-8205634     http://www.amazon.com/exec/obidos/ASIN/0596001622/qid=1068047396/sr=2-1/... 1068047503.109 3.0.168.206     http://www.amazon.com/exec/obidos/ASIN/0596001622/qid=1068047396/sr=2-1/...     http://g-images.amazon.com/images/G/01/gourmet/gourmet-segway.gif 1068047503.196 3.0.168.206     http://www.amazon.com/exec/obidos/ASIN/0596001622/qid=1068047396/sr=2-1/...     http://g-images.amazon.com/images/G/01/marketing/cross-shop/arnold/appar... 1068047503.198 3.0.168.206     http://www.amazon.com/exec/obidos/ASIN/0596001622/qid=1068047396/sr=2-1/...     http://g-images.amazon.com/images/G/01/marketing/cross-shop/arnold/appar... 1068047503.825 3.0.168.206     http://www.amazon.com/exec/obidos/ASIN/0596001622/qid=1068047396/sr=2-1/...     http://images.amazon.com/images/P/B00005R8BC.01.TZZZZZZZ.jpg 1068047503.842 3.0.168.206     http://www.amazon.com/exec/obidos/ASIN/0596001622/qid=1068047396/sr=2-1/...     http://images.amazon.com/images/P/0596001622.01._PE_PI_SCMZZZZZZZ_.jpg 

Note that requests that lack a Referer header aren't logged. The four fields are as follows :

1: timestamp

The time of the request, expressed as the number of seconds since Unix epoch with millisecond resolution.

Note that, unlike access.log , a referer.log entry is made as soon as Squid receives the complete request. Thus, the referer.log entry occurs before the access.log , which waits for the end of the response.

2: client address

The same as the client address in access.log . The log_fqdn and client_netmask directives affect this log file as well.

3: referer

The value of the Referer header from the client's request. Note that the referer value might have whitespace (or any other) characters . Squid doesn't encode the value before writing to referer.log .

4: URI

The URI that the client is requesting. It matches the URI in access.log .