Proxy not sending data to Syslog

[anotheruser]

Hello!

Im testing an Opnsense installation with Captive portal and transparent proxy.

Im using an upgraded installation of opnsense (18->19), squid was not sending data to syslog, so i upgrade it to 19.1 and the problem remains.

The syslog server works, i can receive messages from other components, like the firewall or the dhcp, but i can't get a single line from squid proxy.

Where should i look?

Thanks

[franco]

Hi there,

Services: Web Proxy: Administration: General Proxy Settings.

Click "advanced mode".

Set "Log target" to "Syslog".


Cheers,
Franco

[anotheruser]

It's on, i'm not receiving any lines. That's why im posting here.  ::)

[franco]

Works for me: logs are redirected to Services: Captive Portal: Log File. I'm not sure why but that's what it is.

And you can forward "Portal Auth events" remotely then (System: Settings: Logging).


Cheers,
Franco

[anotheruser]

Franco: I I can receive everything from every service, except from proxy. Yes i have the authentication events from the captive portal. I works. DCHCP, Firewall, you name it. Those are OK. But Squid is not.

If i go to the proxy settings and set the loggin mode to FILE, i can see the lines on the GUI, so squid is actually loggin the users activity. but if i set it to SYSLOG, i receive nothing. Squid does not send a single line to my syslog.

Also, it seems im not the only one.

https://forum.opnsense.org/index.php?topic=8497.0

[franco]

I repeat. The squid access log messages when Syslog is enabled in web proxy are being sent to *Services: Captive Portal: Log File*.


Cheers,
Franco

[netranger]

Works for me: logs are redirected to Services: Captive Portal: Log File. I'm not sure why but that's what it is.

And you can forward "Portal Auth events" remotely then (System: Settings: Logging).


Cheers,
Franco

Hi guys,
sorry I'm probably misunderstanding something obvious here. But does this mean in order to get the squid logs into my syslog server I need to activate the Captive Portal (which I'm not using)?
I can see the squid logs in the captive portal page and "Portal Auth events" forwarding is activated, but I don't get those logs at my syslog server.

Thank you and good start into the week,
NR

[franco]

If you raise a ticket I can take a closer look.

https://github.com/opnsense/core/issues/new/choose


Cheers,
Franco

[netranger]

If you raise a ticket I can take a closer look.

https://github.com/opnsense/core/issues/new/choose

Ticket created! https://github.com/opnsense/core/issues/3454

I'll be happy to provide more configs or log files if you need them. Thanks a lot for looking into this.

Cheers,
NR

[anotheruser]

Hi, currently using 19.1.10 and i still can't send the proxy data to syslog. Ticking the checkmark does nothing and
the access lines are forwarded to the gui, on the access tab. No lines on the syslog.

Thanks.