Menu

Enable Search Term logging

sarg
2014-01-31
2014-01-31
  • threehappypenguins

    I made sure to enable the search query in squid (strip_query_terms), but I don't know how to make this show up in Sarg.

    What I went is which computer (and will it show different users on the same computer) is accessing what website, and what time; and what search queries they are using.

     
    • Frederic Marchal

      Have a look at the long_url option in sarg.conf. I never use it myself but it is supposed to log the full URL found in the squid log file.

      The reason I don't use it and seldom test it is because it takes a lot of memory and disk space to produce the report and the resulting reports are huge.

      You have been warned :-)

       
  • threehappypenguins

    If I can even see what images they are looking at as well, that would be awesome.

     
    • Frederic Marchal

      Sorting log entries by file type is highly unreliable with a standard squid log. You just can't look for ".jpg", ".png", ".tif", ".gif" and the like somewhere in the URL. It would produce a lot of false detections. And if the search is restricted to the last URL characters, it will miss every image whose name is embedded inside the request string (for instance, it occurs when a user is viewing images in a google image page).

      Note that sarg tries to list downloaded executables but it doesn't work well. It is left for historical reason with the hope that some extended log file will one day be able to provide the actual mime-type of the downloaded file.

       

Log in to post a comment.