Bug #4615
closed/var/logs/c-icap/server.log & access.log growing without being rotated
0%
Description
/var/logs/c-icap/server.log and access.log aren't rotated and don't contain useful information.
It can be very large after a unique month (more than 1Gb in my case)
To reduce amount of log, please set :- DebugLevel 0
- AccessLog /dev/null
- ServerLog /dev/null
in c-icap.conf.default(for everybody)
The same in squidclamav.conf.default
Updated by Nicolas Liaudat over 9 years ago
Sry, do not set AccessLog for squidclamav.conf.default
Updated by Chris Buechler over 9 years ago
- Project changed from pfSense to pfSense Packages
Updated by Kill Bill about 9 years ago
This is fixed properly in https://github.com/pfsense/pfsense-packages/pull/1080, namely this commit: https://github.com/doktornotor/pfsense-packages/commit/7ebe5d0978f0246f5170dc7e86ea1dd4ff5d1056
Instead of /dev/null, the c-icap log location honors the Squid's logdir location configuration (so it should get rotated properly). DebugLevel dropped to 0.
Updated by Kill Bill about 9 years ago
The above will be reverted in 0.4.0, except for the DebugLevel. It breaks things badly and I wasted two days debugging inexplicable issues resulting from moving the logs. The log stays where it is, period. Read the forum thread for the fun: https://forum.pfsense.org/index.php?topic=100167.60 and following.
Updated by Kill Bill about 9 years ago
P.S. And just to be explicit here: /dev/null does NOT work. It causes C-ICAP to spit Error: [No Error] and makes it unusable for people.
Updated by Nicolas Liaudat about 9 years ago
6 months ago, I have tested the code in 3 different (2x x64, 1x x86) machines for squid3 ver 0.3.4 without any king of problem.
I think I am not responsible to retest the patch for later updates.
I used this setup effectively until the 4.0 update, which, moreover, erased all trace of any previous configuration.
Regards
Nicolas
Updated by Kill Bill about 9 years ago
There is "manual configuration" option in the Antivirus GUI which lets you edit the files manually put those where-ever you want and pick up the broken pieces. By default, this stays where it stays, because otherwise things break for people. The default setup needs to work and not randomly break in inexplicable ways. (BTW, pointing logs to /dev/null makes any sort of debugging completely impossible, another reason why it's a horrible default.)
Updated by Chris Buechler almost 9 years ago
- Status changed from New to Resolved
Updated by Stephan Berger about 3 years ago
Hi,
so I took a look: /var/log/c-icap/access.log - 272MB
the mentioned bugfix was meant for squid, I think?
So it seems that this still is not solved?
Cheers, Stephan