[Ubuntu] Squid WARNING

[Hightower]

I'm getting the following:

WARNING: you should probably remove 'DOMAIN NAME HERE' from the ACL named squid
(repeated for however many domains I have in the ACL)

Whenever I try to do a squid -k rotate

Any ideas?

[keithu]

It sounds like your acl definitions in squid.conf have some unwanted text. If you post your squid.conf (or the relevant part) I'll have a look.

[Hightower]

Cheers - here's the conf file. Not sure whats bits you need so here's the whole lot. (had to zip it to upload it)

[keithu]

That looks okay to me. You're including a file called "/var/www/allowedsites" which might contain the problem lines. What's in there?

[Hightower]

Just the sites that we allow access to (see attached).

[keithu]

I think this line in squid.conf is the problem:

access_log /var/log/squid3/access.log squid

You need to take 'squid' off the end. It's interpreting 'squid' as the name of an acl which you haven't defined.

[Hightower]

Just tried that and it didn't work - same warning

[keithu]

I can't see anything else wrong at the moment. Did you reload the squid config file? You have to either stop and restart squid or do a 'squid -k reconfigure'.

[Hightower]

I can't see anything else wrong at the moment. Did you reload the squid config file? You have to either stop and restart squid or do a 'squid -k reconfigure'.

Yeah, I did a sudo /etc/init.d/squid3 restart and as soon as squid started up again it gave the same list of warnings.

[keithu]

uuh

How about if you run 'squid -k parse'

That should check the config file and spit out the bits it doesn't like.

[Hightower]

Just gives me the warnings as before. Here's an example:

2009/04/06 14:38:40| WARNING: You should probably remove '.teachit.co.uk' from t                                                                             he ACL named 'allowedsites'
2009/04/06 14:38:40| WARNING: '.teachit.co.uk' is a subdomain of '.teachit.co.uk                                                                             '
2009/04/06 14:38:40| WARNING: because of this '.teachit.co.uk' is ignored to kee                                                                             p splay tree searching predictable
2009/04/06 14:38:40| WARNING: You should probably remove '.teachit.co.uk' from t                                                                             he ACL named 'allowedsites'
2009/04/06 14:38:40| WARNING: '.bbc.co.uk' is a subdomain of '.bbc.co.uk'
2009/04/06 14:38:40| WARNING: because of this '.bbc.co.uk' is ignored to keep sp                                                                             lay tree searching predictable
2009/04/06 14:38:40| WARNING: You should probably remove '.bbc.co.uk' from the A                                                                             CL named 'allowedsites'
2009/04/06 14:38:40| WARNING: '.bbc.co.uk' is a subdomain of '.bbc.co.uk'
2009/04/06 14:38:40| WARNING: because of this '.bbc.co.uk' is ignored to keep sp                                                                             lay tree searching predictable
2009/04/06 14:38:40| WARNING: You should probably remove '.bbc.co.uk' from the A                                                                             CL named 'allowedsites'
2009/04/06 14:38:40| WARNING: '.wikipedia.org' is a subdomain of '.en.wikipedia.                                                                             org'
2009/04/06 14:38:40| WARNING: because of this '.en.wikipedia.org' is ignored to                                                                              keep splay tree searching predictable
2009/04/06 14:38:40| WARNING: You should probably remove '.wikipedia.org' from t                                                                             he ACL named 'allowedsites'
2009/04/06 14:38:40| WARNING: '.wikipedia.org' is a subdomain of '.en.wikipedia.                                                                             org'
2009/04/06 14:38:40| WARNING: because of this '.en.wikipedia.org' is ignored to                                                                              keep splay tree searching predictable
2009/04/06 14:38:40| WARNING: You should probably remove '.wikipedia.org' from t                                                                             he ACL named 'allowedsites'
2009/04/06 14:38:40| WARNING: '.tanfieldschool.co.uk' is a subdomain of '.marks.                                                                             tanfieldschool.co.uk'
2009/04/06 14:38:40| WARNING: because of this '.marks.tanfieldschool.co.

[keithu]

You said the message was:

"WARNING: you should probably remove 'DOMAIN NAME HERE' from the ACL named squid"

The only problem here is that your allowed sites file has repeated entries. I've cleaned it up for you - see attached.

You've also defined some subdomains which are already included in a larger domain. For instance, if you allow bbc.co.uk there's no point allowing news.bbc.co.uk as well since bbc.co.uk is equivalent to *.bbc.co.uk. You can either take news.bbc.co.uk out of the list or just put up with the warning message.

[Hightower]

Ah, sorry - I think I copied that error from a one I found on Google when I was searching for the error - as opposed to my exact error. That's a school boy error on my part.

Is this actually stopping the logs from rotating? Or just generating a warning?

[keithu]

It won't stop the logs rotating. You're only seeing the warnings because when you do a 'squid -k rotate' it reloads the config.

I'm using the logrotate daemon to rotate the logs here, rather than squid itself. I've got the following lines tacked on the end of /etc/logrotate.conf:

# system-specific logs may be also be configured here.

# Rotate Squid access log daily, keeping 3 weeks. Compress with gzip.

/usr/local/squid/var/logs/access.log {
daily
rotate 21
copytruncate
#notifempty
missingok
compress
}

#keep cache.log and store.log for 2 days

/usr/local/squid/var/logs/cache.log {
daily
rotate 2
copytruncate
#notifempty
missingok
compress
}

/usr/local/squid/var/logs/store.log {
daily
rotate 2
copytruncate
#notifempty
missingok
compress

}

[Hightower]

Thanks,

I've just added:

# Rotate Squid access log daily, keeping 3 weeks. Compress with gzip.

/var/log/squid3/access.log {
daily
rotate 21
copytruncate
#notifempty
missingok
compress
}

#keep cache.log and store.log for 2 days

/var/log/squid3/cache.log {
daily
rotate 2
copytruncate
#notifempty
missingok
compress
}

/var/log/squid3/store.log {
daily
rotate 2
copytruncate
#notifempty
missingok
compress
}

To my logrotate.conf (the locations are different for my setup for some reason). Will this start working automatically? Do I need to restart the daemon (if so how?)?

Also, this only cleans up the squid logs - I also have SARG installed (so I can make head and tails of the logs), how would I go about rotating these so they don't build up and build up?