[ubuntu] Squid WARNING

[Hightower]

I'm getting the following:

 

WARNING: you should probably remove 'DOMAIN NAME HERE' from the ACL named squid

(repeated for however many domains I have in the ACL)

 

Whenever I try to do a squid -k rotate

 

Any ideas?

[keithu]

It sounds like your acl definitions in squid.conf have some unwanted text. If you post your squid.conf (or the relevant part) I'll have a look. Edited April 6, 2009 by keithu
typo

[Hightower]

Cheers - here's the conf file. Not sure whats bits you need so here's the whole lot. (had to zip it to upload it)

[keithu]

That looks okay to me. You're including a file called "/var/www/allowedsites" which might contain the problem lines. What's in there?

[Hightower]

Just the sites that we allow access to (see attached).

[keithu]

I think this line in squid.conf is the problem:

 

access_log /var/log/squid3/access.log squid

 

You need to take 'squid' off the end. It's interpreting 'squid' as the name of an acl which you haven't defined.

[Hightower]

Just tried that and it didn't work - same warning

[keithu]

I can't see anything else wrong at the moment. Did you reload the squid config file? You have to either stop and restart squid or do a 'squid -k reconfigure'.

[Hightower]

I can't see anything else wrong at the moment. Did you reload the squid config file? You have to either stop and restart squid or do a 'squid -k reconfigure'.

 

Yeah, I did a sudo /etc/init.d/squid3 restart and as soon as squid started up again it gave the same list of warnings.

[keithu]

uuh

 

How about if you run 'squid -k parse'

 

That should check the config file and spit out the bits it doesn't like.

[Hightower]

Just gives me the warnings as before. Here's an example:

 

2009/04/06 14:38:40| WARNING: You should probably remove '.teachit.co.uk' from t                                                                             he ACL named 'allowedsites'
2009/04/06 14:38:40| WARNING: '.teachit.co.uk' is a subdomain of '.teachit.co.uk                                                                             '
2009/04/06 14:38:40| WARNING: because of this '.teachit.co.uk' is ignored to kee                                                                             p splay tree searching predictable
2009/04/06 14:38:40| WARNING: You should probably remove '.teachit.co.uk' from t                                                                             he ACL named 'allowedsites'
2009/04/06 14:38:40| WARNING: '.bbc.co.uk' is a subdomain of '.bbc.co.uk'
2009/04/06 14:38:40| WARNING: because of this '.bbc.co.uk' is ignored to keep sp                                                                             lay tree searching predictable
2009/04/06 14:38:40| WARNING: You should probably remove '.bbc.co.uk' from the A                                                                             CL named 'allowedsites'
2009/04/06 14:38:40| WARNING: '.bbc.co.uk' is a subdomain of '.bbc.co.uk'
2009/04/06 14:38:40| WARNING: because of this '.bbc.co.uk' is ignored to keep sp                                                                             lay tree searching predictable
2009/04/06 14:38:40| WARNING: You should probably remove '.bbc.co.uk' from the A                                                                             CL named 'allowedsites'
2009/04/06 14:38:40| WARNING: '.wikipedia.org' is a subdomain of '.en.wikipedia.                                                                             org'
2009/04/06 14:38:40| WARNING: because of this '.en.wikipedia.org' is ignored to                                                                              keep splay tree searching predictable
2009/04/06 14:38:40| WARNING: You should probably remove '.wikipedia.org' from t                                                                             he ACL named 'allowedsites'
2009/04/06 14:38:40| WARNING: '.wikipedia.org' is a subdomain of '.en.wikipedia.                                                                             org'
2009/04/06 14:38:40| WARNING: because of this '.en.wikipedia.org' is ignored to                                                                              keep splay tree searching predictable
2009/04/06 14:38:40| WARNING: You should probably remove '.wikipedia.org' from t                                                                             he ACL named 'allowedsites'
2009/04/06 14:38:40| WARNING: '.tanfieldschool.co.uk' is a subdomain of '.marks.                                                                             tanfieldschool.co.uk'
2009/04/06 14:38:40| WARNING: because of this '.marks.tanfieldschool.co.

[keithu]

You said the message was:

 

"WARNING: you should probably remove 'DOMAIN NAME HERE' from the ACL named squid"

 

The only problem here is that your allowed sites file has repeated entries. I've cleaned it up for you - see attached.

 

You've also defined some subdomains which are already included in a larger domain. For instance, if you allow bbc.co.uk there's no point allowing news.bbc.co.uk as well since bbc.co.uk is equivalent to *.bbc.co.uk. You can either take news.bbc.co.uk out of the list or just put up with the warning message.

allowedsites.zip

Edited April 6, 2009 by keithu
more info

[Hightower]

Ah, sorry - I think I copied that error from a one I found on Google when I was searching for the error - as opposed to my exact error. That's a school boy error on my part.

 

Is this actually stopping the logs from rotating? Or just generating a warning?

[keithu]

It won't stop the logs rotating. You're only seeing the warnings because when you do a 'squid -k rotate' it reloads the config.

 

I'm using the logrotate daemon to rotate the logs here, rather than squid itself. I've got the following lines tacked on the end of /etc/logrotate.conf:

 

# system-specific logs may be also be configured here.

 

# Rotate Squid access log daily, keeping 3 weeks. Compress with gzip.

 

/usr/local/squid/var/logs/access.log {

daily

rotate 21

copytruncate

#notifempty

missingok

compress

}

 

#keep cache.log and store.log for 2 days

 

/usr/local/squid/var/logs/cache.log {

daily

rotate 2

copytruncate

#notifempty

missingok

compress

}

 

/usr/local/squid/var/logs/store.log {

daily

rotate 2

copytruncate

#notifempty

missingok

compress

 

}

[Hightower]

Thanks,

 

I've just added:

 

# Rotate Squid access log daily, keeping 3 weeks. Compress with gzip.

/var/log/squid3/access.log {
daily
rotate 21
copytruncate
#notifempty
missingok
compress
}

#keep cache.log and store.log for 2 days

/var/log/squid3/cache.log {
daily
rotate 2
copytruncate
#notifempty
missingok
compress
}

/var/log/squid3/store.log {
daily
rotate 2
copytruncate
#notifempty
missingok
compress
}

 

To my logrotate.conf (the locations are different for my setup for some reason). Will this start working automatically? Do I need to restart the daemon (if so how?)?

 

Also, this only cleans up the squid logs - I also have SARG installed (so I can make head and tails of the logs), how would I go about rotating these so they don't build up and build up?

[keithu]

logrotate is almost certainly already configured to run via cron. There will probably be a link to it in /etc/cron.daily.

 

Assuming your logrotate.conf is in /etc, you can check your configuration by running 'logrotate -d /etc/logrotate.conf'. That will print a summary of what your config does.

 

To do a test rotate, run 'logrotate -f /etc/logrotate.conf'.

 

I've made my own reporting utilities so I'm not sure what SARG does, but if you have lots of reports building up there's no reason not to use logrotate to manage them.

[Hightower]

Using logrotate -d and logrotate -f produces the error:

 

error: /etc/logrotate.conf:36 duplicate log entry for /var/log/squid3/access.log

[keithu]

It sounds like you already had logrotate set up to rotate access.log. The configuration is probably in an include file in the /etc/logrotate.d/ directory. You just need to rationalize where you're going to keep the config - either in logrotate.conf or in the include file.