Created attachment 361194 [details] Output from grep "HTTP/1.1" /var/log/httpd/access_log |grep "\ 403\ " Description of problem: When using squidGuard to prevent hosts on an intranet to access certain sites, the squidGuard.cgi generates "HTTP/1.1 403" error in access.log for every blocked url. The 403 errors are then shown every day in daily logwatch report which is causing a lot of overhead: --------------------- httpd Begin ------------------------ Requests with error response codes 403 Forbidden /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... &meta=&aq=f&oq=: 2 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... ,1,282,0,283,0,: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... -09-2009/52246/: 2 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... -09-2009/52247/: 2 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... -pictures/1/10/: 2 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... -pictures/1/11/: 2 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... -pictures/1/12/: 2 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... -pictures/1/13/: 2 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... -pictures/1/14/: 2 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... -pictures/1/15/: 2 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... .1_scrambled.js: 3 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... .nl/468x60.aspx: 2 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... .nl/binnenland/: 3 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... .nl/buitenland/: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... /1/map_icon.png: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... /2/map_icon.png: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... /300x250_nl.swf: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... /61/v728x90.gif: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... /a/bb728x90.jpg: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... /ads/FFE_2x.jpg: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... /bestrating.jpg: 6 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... /cancer-chef/1/: 2 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... /googleafc.html: 2 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... /nuonsolarrace&: 2 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... /pageid=5043643: 3 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... /sfp_banner.gif: 6 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... /spcjs.php?id=2: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... /www.aecinfo.nl: 2 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... 00shop120_2.gif: 9 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... 0209/728x90.gif: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... 0333/728x90.gif: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... 08347845255508?: 2 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... 0_nl_guitar.swf: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... 17321046933504?: 2 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... 2&adSize=728x90: 2 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... 20echo%20$_GET[: 2 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... 21&domId=116925: 8 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... 21&domId=149370: 8 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... 21&domId=180880: 5 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... 21&domId=186105: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... 21&domId=203690: 8 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... 21&domId=234426: 8 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... 21&domId=261707: 6 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... 21&domId=463050: 8 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... 21&domId=610120: 8 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... 21&domId=742262: 8 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... 21&domId=855196: 4 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... 21&domId=907785: 6 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... 21&domId=943429: 8 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... 21&domId=969799: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... 22&domId=150767: 6 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... 22&domId=430355: 6 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... 22&domId=459401: 6 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... 28827543463359?: 2 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... 36x280_dart.swf: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... 3951/1;;~sscs=?: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... 42024528943554?: 2 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... 4is_152_200.png: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... 5&p=files&t=126: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... 5&p=files&t=129: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... 521&domId=29475: 8 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... 521&domId=45374: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... 59281795175191?: 2 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... 5987611;ct.1/01: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... 5989527;ct.1/01: 2 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... 5989536;ct.1/01: 3 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... 5989758;ct.1/01: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... 65973600598737?: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... 65;type=js;tP=1: 3 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... 66881967572699?: 2 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... 6_banner_nl.swf: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... 7235881;ct.1/01: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... 80&uiculture=nl: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... 80386756770011?: 2 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... 80_Taktisch.swf: 5 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... 8516-145-1.aspx: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... 8573009@x11!x11: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... 8629;39112812;k: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... 8x60_200809.gif: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... 9013/1;;~sscs=?: 3 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... 9155667;ct.1/01: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... 9315455@x11!x11: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... 97209_click.asp: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... 97212_click.asp: 2 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... 97213_click.asp: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... 97215_click.asp: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... 97218_click.asp: 5 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... 97254_click.asp: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... 97256_click.asp: 2 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... 97263_click.asp: 2 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... 97267_click.asp: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... =NLAHPT&AP=1440: 5 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... =NLDENR&AP=1089: 3 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... =NLDHPR&AP=1089: 5 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... =NLSPE7&AP=1390: 5 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... =title&resnum=1: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... ?$$&ord=4549798: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... ?$$&ord=4785017: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... ?$$&ord=6700357: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... ?$$&ord=6787116: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... FE_IBG_Logo.jpg: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... G=WLMNL1&UC=127: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... G=WLMNL1&UC=142: 4 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... G=WLMNL2&UC=142: 2 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... G=WLMNL8&UC=127: 4 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... G=WLMNL8&UC=142: 34 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... G=WLMNLA&UC=127: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... G=WLMNLA&UC=142: 4 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... G=WLMNLB&UC=142: 2 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... G=WLMNLC&UC=127: 5 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... G=WLMNLC&UC=142: 42 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... GetAd?PG=NL9IV2: 2 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... N-S_965050a.gif: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... O12usYFQA%3d%3d: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... Top2,Position1?: 31 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... X450h_01_V2.swf: 2 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... _Rihanna__.html: 3 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... _fotografie.jpg: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... _hmg_sept09.gif: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... _per_sms__.html: 3 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... _product_type=5: 2 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... _right_rail.gif: 12 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... a.nl/nieuwbouw/: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... a.swf?clickTAG=: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... acaturebank.nl/: 2 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... ad_onderweg.png: 2 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... ads.html?101-01: 2 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... ads.html?110-01: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... ads.html?121-01: 2 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... ads.html?703-01: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... ads.html?704-01: 2 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... ads.html?705-01: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... ads.html?769-05: 2 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... ads.html?769-06: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... adserver/adx.js: 5 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... adspace/2010.js: 2 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... ag09-468x60.gif: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... alue=0000758799: 6 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... alue=0000758800: 3 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... alue=0000764928: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... ama-120x120.gif: 6 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... angertotaal.png: 6 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... aren%20GN__NL_5: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... beveiliging.gif: 6 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... c/js/tii_ads.js: 76 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... c=1252997844136: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... c=1252997844433: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... c=1252997846841: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... c=1252997847091: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... c=1252997865419: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... c=1252997865701: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... c=1253010671262: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... c=1253011527451: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... c=1253011527691: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... c=1253016897234: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... c=1253016897640: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... c=1253018549826: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... c=1253018550232: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... c=1253018552044: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... c=1253018552247: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... c=1253023236137: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... c=1253023236356: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... c=1253023238590: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... c=1253023238934: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... c=1253023241699: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... c=1253023245027: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... c=1253023245137: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... c=1253023247356: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... cadeaushop.html: 2 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... callout-bot.png: 6 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... callout-mid.png: 6 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... callout-top.png: 6 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... cript/WebAds.js: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... d/google_ads.js: 106 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... d/palsgroep.gif: 6 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... d_huilt___.html: 3 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... de_armen__.html: 3 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... ds_1123246a.gif: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... ds_300x250.html: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... e/chev/20090907: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... e_04032009_.swf: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... ed_1147240a.gif: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... edivisie_v1.swf: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... eethoehetzit.nl: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... ek=invix&page=1: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... ek=invix&page=2: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... elijkamsterdams: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... en_04032009.swf: 2 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... eot?gl=NL&hl=nl: 4 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... er/js/showad.js: 7 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... er=us1.21.02.03: 4 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... er_1222787a.gif: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... eren_468x60.gif: 2 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... ering/index.jsp: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... erm=N2571.funda: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... es&domId=267701: 6 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... es/ad/fivel.gif: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... eving.infonu.nl: 2 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... f&bannerid=1548: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... f.nl/telesport/: 6 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... fLiRYX4eA%3d%3d: 26 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... frgb=69;139;116: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... g-50133518.html: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... gel-336x280.gif: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... get_rood_v2.gif: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... go_1162568a.gif: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... google-ads.html: 4 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... graaf.nl/prive/: 27 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... h=1024&c=32&v=1: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... holonite_v3.swf: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... ia_20090820.swf: 4 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... ide120x60_2.gif: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... idwell/split/1/: 2 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... ingkoeriers.gif: 2 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... inks.585x114.ad: 4 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... ion1!Position1?: 31 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... it_vrede__.html: 3 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... j_120x120_3.gif: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... jfde-laptop.htm: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... jven/c1192.html: 3 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... l/160x600AM.htm: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... l/reclame/tt.js: 4 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... letype=webImage: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... lomagazine.com/: 16 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... m?buienradar.nl: 7 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... n-pictures/1/1/: 2 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... n-pictures/1/2/: 2 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... n-pictures/1/3/: 2 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... n-pictures/1/4/: 2 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... n-pictures/1/5/: 2 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... n-pictures/1/6/: 2 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... n-pictures/1/7/: 2 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... n-pictures/1/8/: 2 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... n-pictures/1/9/: 2 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... nG=Search&meta=: 14 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... n_welkom_ll.gif: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... n_welkom_ul.gif: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... ner/300x250.gif: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... ngkanker__.html: 3 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... ningen.nl/home/: 4 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... nl/120x600.aspx: 6 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... nl/2009/tickets: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... nner-120x60.gif: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... nzoo_bed_V2.swf: 2 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... o_09_468x60.swf: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... oek=1&x=73&y=16: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... og_digitaal.jpg: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... ome/indexwm.asp: 60 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... onsnetwerk.html: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... oo_stoel_V2.swf: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... ool_shop_v1.jpg: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... op-de-mijne.jpg: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... ord=[timestamp]: 2 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... ory-obituary/1/: 2 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... ot_30072009.gif: 3 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... ource=telegraaf: 2 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... p://www.53j8.nl: 2 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... p?bannerid=1104: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... p?bannerid=1105: 2 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... p?bannerid=1106: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... p?bannerid=1118: 6 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... p?bannerid=1119: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... p?bannerid=1231: 3 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... p?bannerid=1285: 2 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... p?bannerid=1340: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... p?bannerid=1341: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... p?bannerid=1472: 2 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... pageid=16754910: 3 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... pageid=32972472: 3 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... pageid=34292672: 3 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... pageid=45794772: 3 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... pageid=52022183: 2 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... pageid=56907189: 2 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... pageid=62487608: 3 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... pageid=76122406: 3 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... pageid=80983207: 3 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... pageid=84057703: 3 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... pageid=86737828: 4 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... pageid=98440827: 3 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... pen_120x600.gif: 3 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... pen_336x280.gif: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... php?raw=270|11|: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... raaf.nl/&refer=: 2 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... richt&pid=84961: 5 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... rte_dag___.html: 9 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... s-cb-468x60.gif: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... s/14-09-2009/0/: 4 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... s/15-09-2009/1/: 2 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... s/FFE_Auto3.jpg: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... sdag_728x90.swf: 3 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... sel_336x280.gif: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... selfstorage.gif: 6 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... set1_468x60.gif: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... shop_468_60.gif: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... shop_anigif.gif: 2 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... show/id=3119491: 4 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... show_afs_ads.js: 17 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... smarttags.v2.js: 18 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... spec_468_60.swf: 2 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... spec_468_60.xml: 2 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... spec_728_90.swf: 2 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... spec_728_90.xml: 2 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... spiratie_V3.swf: 2 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... ssel_468x60.gif: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... st_04032009.swf: 2 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... t=1253020066406: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... tats4u.com/m.js: 3 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... tiz_300x250.swf: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... tiz_336x280.swf: 2 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... uis-120x120.jpg: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... upport.nl/event: 4 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... vac_zoeken.html: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... verleden__.html: 6 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... vertisement.gif: 13 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... w.telegraaf.nl/: 10 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... w.wooncheck.nu/: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... wPaintIdeas.jpg: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... ws/indexwm.asp?: 7 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... ww.burendag.nl/: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... ww.rtlgemist.nl: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... x250verhuis.swf: 3 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... x280_holder.swf: 3 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... zaKl21NNw%3d%3d: 1 Time(s) /cgi-bin/squidGuard.cgi?clientaddr=192.168 ... zoo_lamp_V2.swf: 1 Time(s) 404 Not Found /nu.nl: 1 Time(s) /wpad.dat%20?Type=WMT: 3 Time(s) ---------------------- httpd End ------------------------- Version-Release number of selected component (if applicable): squidGuard-1.4-4.fc11.i586 How reproducible: Steps to Reproduce: 1. 2. 3. Actual results: Expected results: Additional info:
Is this: http://squidguard.org/Doc/extended.html#blocklog relevant?
(In reply to comment #1) > Is this: > > http://squidguard.org/Doc/extended.html#blocklog > > relevant? I don't think so. I think it's more an logwatch issue that detects the "403" in the apache's access log and reports it as denied entries on the apache web server. Maybe logwatch should be adapted to "ignore" squidGuards cgi "HTTP/1.1 403" entries in the access log? Ore maybe the squidGuard.cgi should be changed not to report "HTTP/1.1 403"? However, that does not seem to be logic to me. The access to a blocked source is correctly denied this way. So, to me it looks like something that is being reported by logwatch but actually doesn't need to be done so. What do you think? Regards, Eddie.
Sounds like it ought to be configurable in a config file somewhere.
In my squidGuard.conf the redirect to squidGuard.cgi is configured as: redirect 302:http://ls2ka.elton-intra.net/cgi-bin/squidGuard.cgi?clientaddr=%a&clientname=%n&clientident=%i&srcclass=%s&targetgroup=%t&url=%u Now, the last bits of that line which take care of passing the denied url to the squidGuard.cgi are "&url-%u". The %u contains the referring url. Looking at one of the entries in the access.log, I see that variable %u gets filled with a very long string: &url=http://www.google.com/afsonline/show_afs_ads.js HTTP/1.1" 403 1553 "http://kopen.marktplaats.nl/doe-het-zelf-en-verbouw/platen-en-panelen/c263.html" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0)" Another example: &url=http://www.google.com/afsonline/show_afs_ads.js HTTP/1.1" 403 1553 "http://kopen.marktplaats.nl/search.php?tab_adcount=1714&ds=to%3A1%3Bl1%3A239%3Bl2%3A263%3Blt%3Azip%3Bsfds%3A%3Bpt%3A0%3Bmp%3Anumeric%3Bosi%3A2&u=263&g=239&f=&pp=&vs=&ts_category_default=&pts=&t=&p=1&stop_force_description_search=&s=&show_thumbnails=1&show_summary=1&buildyear_min=&buildyear_max=&from_searchbox_advanced=1&q=trespa&g=239&u=263&postcode=&distance=&search=Zoek&ts=on" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0)" Could it perhaps be that there is a little change needed in the squidGuard redirector? So that it only fills variable %u with the part before HTTP/1.1? Regards, Eddie.
Created attachment 362938 [details] adblock files and configuration in a tarball Dear Jon, Hereby my adblock files and settings for squidGuard in a tarball. Maybe this information is useful. With kind regards, Eddie.
What about this? http://www2.squidguard.org/Bugs/show_bug.cgi?id=60
Sorry Jon, I don't see where/why that would be relevant. Can you elaborate?
Jon, do you want me to replace the &url=%u by something else? So that the HTTP/1.1" 403 is no longer present in the string?
Jon, why do you not respond?
Because I've been extraordinarily busy with real life and haven't had the time to investigate this bug further. My apologies. See 522038 for further comments.
Hello Jon, I hope I don't rush you this way, but are you are still thinking about fixing this? Regards, Eddie.
Sorry, my Fedora time has occupied with other issues. Essentially, I'm not really sure what a good fix might look like. Have you tried your suggestion from #8?
(In reply to comment #12) > Sorry, my Fedora time has occupied with other issues. Essentially, I'm not > really sure what a good fix might look like. Have you tried your suggestion > from #8? Can I try something in the squidGuard.conf like a simple shell command to "filter" it away? Like: &url=(%u |sed 's/HTTP\/1.1\"//g') ?
Makes sense to me. Does it work?
No
Crud. Back to the drawing board. . .
Jon, This really is a bug in squidGuard. If I could, I would open a bug for it on squidGuard.org (http://www2.squidguard.org/Bugs) but unfortunately I can not find a way to register my self at the squidGuard bugzilla. Can you tell me how I can register there? Or maybe you can relay this bug on to http://www2.squidguard.org/Bugs? Regards, Eddie.
I can't, all I can find is sg-bugs. I've emailed with a link to this bug.
Reponse: -------------------- I have checked the original sources and it seems that this behaviour was intended by the original author. Perhaps because the access to the final site was denied - but I don't know the true reason. For the logwatch problem a quick fix is to change the two lines status("403 Forbidden"); into status("200 OK"); Hope this helps. Cheers, Christine Kronberg. --------------------- I can easily patch this. Would you like a patched rpm to test, or do you want to edit your squidGuard.cgi yourself and run with it for a few days to be sure?
The squidGuard.cgi is not causing the problem.
The problem is caused by the way the squidGuard is handing over the %u to the squidGuard.cgi. In this %u variable, the "HTTP/1.1" 403" is already present and it makes no sence to me, to do -whatever- with it afterwards, when it's being processed by the squidGuard.cgi script.
I am trying a different approach now by modifying apache's configuration to stop logging squidGuard information. I added a line to /etc/httpd/conf/httpd.conf: SetEnvIf Request_URI "^/cgi-bin/squidGuard.*$" dontlog Right above the line: CustomLog logs/access_log combined Let see what happens. I will let you know the outcome. Kind regards, Eddie.
I solved it by modifying apache's httpd.conf. I changed the line: CustomLog logs/access_log combined to: SetEnvIf Request_URI "^/cgi-bin/squidGuard.cgi*" dontlog SetEnvIf Request_URI "^/images/your-logo.gif*" dontlog CustomLog logs/access_log combined env=!dontlog And no information is flooding the logwatch report anymore. This looks like a fine work-around to me. Please close this inquiry. Regards, Eddie.
Excellent! Thank you for your patience and assistance in chasing this.