4.4 Log File Pathnames

I'll discuss all the details of Squid's log files in Chapter 13. For now the only thing you may need to worry about is where you want Squid to put its log files. The default location is a directory named logs under the installation prefix. For example, if you don't use the ”prefix= option with ./configure , the default log file directory is /usr/local/squid/var/logs .

You need to make sure that log files are stored on a disk partition with enough space. When Squid receives a write error for a log file, it exits and restarts. The primary reason for this behavior is to grab your attention. Squid wants to make sure you don't miss any important logging information, especially if your system is being abused or attacked .

Squid has three main log files: cache.log , access.log , and store.log . The first of these, cache.log , contains informational and debugging messages. When you start Squid the first few times, you should closely watch this file. If Squid refuses to run, the reason is probably at the end of cache.log . Under normal conditions, this log file doesn't become large enough to warrant any special attention. Also note that if you start Squid with the -s option, the important cache.log messages are also sent to your syslog daemon. You can change the location for this log file with the cache_log directive:

 cache_log /squid/logs/cache.log 

The access.log file contains a single line for each client request made to Squid. On average, each line is about 150 bytes. In other words, it takes about 150 MB to log one million client requests . Use the cache_access_log directive to change the location of this log file:

 cache_access_log /squid/logs/access.log 

If, for some reason, you don't want Squid to log client requests, you can specify the log file pathname as /dev/null .

The store.log file is probably not very useful to most cache administrators. It contains a record for each object that enters and leaves the cache. The average record size is typically 175-200 bytes. However, Squid doesn't create an entry in store.log for cache hits, so it contains fewer records than access.log . Use the cache_store_log directive to change the location:

 cache_store_log /squid/logs/store.log 

You can easily disable store.log altogether by specifying the location as none :

 cache_store_log none 

If you're not careful, Squid's log files increase in size without limit. Some operating systems enforce a 2-GB file size limit, even if you have plenty of free disk space. Exceeding this limit results in a write error, which then causes Squid to exit. To keep log file sizes reasonable, you should create a cron job that regularly renames and archives the log files. Squid has a built-in feature to make this easy. See Section 13.7 for an explanation of log file rotation.