Reference manual for squid's configuraiton directives
| Index | Alphabetical Index |
ICAP log files record ICAP transaction summaries, one line per
transaction.
The icap_log option format is:
icap_log <filepath> [<logformat name> [acl acl ...]]
icap_log none [acl acl ...]]
Please see access_log option documentation for details. The two
kinds of logs share the overall configuration approach and many
features.
ICAP processing of a single HTTP message or transaction may
require multiple ICAP transactions. In such cases, multiple
ICAP transaction log lines will correspond to a single access
log line.
ICAP log supports many access.log logformat %codes. In ICAP context,
HTTP message-related %codes are applied to the HTTP message embedded
in an ICAP message. Logformat "%http::>..." codes are used for HTTP
messages embedded in ICAP requests while "%http::<..." codes are used
for HTTP messages embedded in ICAP responses. For example:
http::>h To-be-adapted HTTP message headers sent by Squid to
the ICAP service. For REQMOD transactions, these are
HTTP request headers. For RESPMOD, these are HTTP
response headers, but Squid currently cannot log them
(i.e., %http::>h will expand to "-" for RESPMOD).
http::<h Adapted HTTP message headers sent by the ICAP
service to Squid (i.e., HTTP request headers in regular
REQMOD; HTTP response headers in RESPMOD and during
request satisfaction in REQMOD).
ICAP OPTIONS transactions do not embed HTTP messages.
Several logformat codes below deal with ICAP message bodies. An ICAP
message body, if any, typically includes a complete HTTP message
(required HTTP headers plus optional HTTP message body). When
computing HTTP message body size for these logformat codes, Squid
either includes or excludes chunked encoding overheads; see
code-specific documentation for details.
For Secure ICAP services, all size-related information is currently
computed before/after TLS encryption/decryption, as if TLS was not
in use at all.
The following format codes are also available for ICAP logs:
icap::<A ICAP server IP address. Similar to <A.
icap::<service_name ICAP service name from the icap_service
option in Squid configuration file.
icap::ru ICAP Request-URI. Similar to ru.
icap::rm ICAP request method (REQMOD, RESPMOD, or
OPTIONS). Similar to existing rm.
icap::>st The total size of the ICAP request sent to the ICAP
server (ICAP headers + ICAP body), including chunking
metadata (if any).
icap::<st The total size of the ICAP response received from the
ICAP server (ICAP headers + ICAP body), including
chunking metadata (if any).
icap::<bs The size of the ICAP response body received from the
ICAP server, excluding chunking metadata (if any).
icap::tr Transaction response time (in
milliseconds). The timer starts when
the ICAP transaction is created and
stops when the transaction is completed.
Similar to tr.
icap::tio Transaction I/O time (in milliseconds). The
timer starts when the first ICAP request
byte is scheduled for sending. The timers
stops when the last byte of the ICAP response
is received.
icap::to Transaction outcome: ICAP_ERR* for all
transaction errors, ICAP_OPT for OPTION
transactions, ICAP_ECHO for 204
responses, ICAP_MOD for message
modification, and ICAP_SAT for request
satisfaction. Similar to Ss.
icap::Hs ICAP response status code. Similar to Hs.
icap::>h ICAP request header(s). Similar to >h.
icap::<h ICAP response header(s). Similar to <h.
The default ICAP log format, which can be used without an explicit
definition, is called icap_squid:
logformat icap_squid %ts.%03tu %6icap::tr %>A %icap::to/%03icap::Hs %icap::<st %icap::rm %icap::ru %un -/%icap::<A -
See also: logformat and %adapt::<last_h
| Index | Alphabetical Index |