Squid, google search logging

[Quackers]

Im having a play with Squid and got Sarg working to look at the logs, but it does not seem able to log google search queries. Does anybody here use anything to do this with squid?

[ReBoot]

Check your logging level in Squid is set to the appropriate level of detail (details in squid.conf). Squid logs won't break out search terms but they will obviously be embedded in the URL fetched. I'm not familiar with Sarg but as a first step you could look at the raw Squid logs just to make sure they are recording the information you are looking for.

 

/var/log/squid3/access.log

[OB1]

Google searches are conducted over https now, so you'll probably need to be doing some kind of man in the middle to view anything after the domain (i.e. https://www.google.co.uk) as the path and parameters will be encrypted.

[SpaceInvader83]

Yep Google searches are https now so you are unable to log search phrases etc. We currently forward all traffic for google to 216.239.32.20 which forces nossl , it works fine here until Google change it at there end.. which undoubtedly they will.

[Geoff]

If you are intercepting SSL you need to put this in your squid.conf to preserve the queries.

 

strip_query_terms off

[Opendium_Steve]

As other people have mentioned, Google searches now go over HTTPS, and the old nosslsearch.google.com DNS hack that everyone used to use to force searches onto HTTP has been replaced with forcesafesearch.google.com (turns safe search on, but the search itself still goes over https).

 

Our servers analyse the users' Google search queries by intercepting the HTTPS session. Basically, the proxy forges the certificate - clients need to have the proxy's certificate installed in order to accept the forged certificates. Have a look at Squid's "ssl_bump server-first" configuration options.