Here's a line from the access.log 1048773867.696 15 165.178.74.56 TCP_MISS/200 221 HEAD http://windowsupdate.microsoft.com/ident.cab - DIRECT/161.193.116.160 text/html
I'm getting about 10 of these a second per client (about 25 last count). cache.log has a few sslreadserver errors, but nothing pertaining to this problem, other than the out of disk space errors from when the logs filled the disks. We have this narrowed down to rouge installs of MSN Messenger that are trying to run updates and failing on the indent.cab file, probably because of the customizations to our workstation's file structure. Unfortunately for us as these were unsupported installs on unlocked workstations, we can't easily script a push to remove them. Thanks so much for the help Fred -----Original Message----- From: Rick Matthews [SMTP:[EMAIL PROTECTED] Sent: Wednesday, March 26, 2003 4:37 PM To: Dave Duncan Cc: [EMAIL PROTECTED] Org Subject: RE: Question on suppressing log entries for a particular URL Forgot to ask... What does squid's access.log show for the failed transactions? Any messages in squid's cache log? Rick > -----Original Message----- > From: Rick Matthews [mailto:[EMAIL PROTECTED] > Sent: Wednesday, March 26, 2003 3:30 PM > To: Dave Duncan; [EMAIL PROTECTED] Org > Subject: RE: Question on suppressing log entries for a particular URL > > > > One thing we have come across, is that Windows Update does not seem > > to work through squid/squidguard. It scans the system but the > > downloads always fail. Has anyone else seen this? or is it a config > > error on our part? > > What version of squid? (squid -v) > > Running as transparent? > > Are your clients using the squid proxy for https? > > Rick > > > > > -----Original Message----- > > From: [EMAIL PROTECTED] > > [mailto:[EMAIL PROTECTED] Behalf Of Dave Duncan > > Sent: Wednesday, March 26, 2003 12:28 PM > > To: [EMAIL PROTECTED] Org > > Subject: Re: Question on suppressing log entries for a particular URL > > > > > > I have had a similiar problem. One thing we have come across, is > > that Windows Update does not seem to work through squid/squidguard. It scans > > the system but the downloads always fail. Has anyone else seen this? or is > > it a config error on our part? > > ----- Original Message ----- > > From: "Fred Clark" <[EMAIL PROTECTED]> > > To: "[EMAIL PROTECTED] Org" <[EMAIL PROTECTED]> > > Sent: Wednesday, March 26, 2003 6:31 AM > > Subject: Question on suppressing log entries for a particular URL > > > > > > > Hi all > > > > > > Last week we started having trouble with our logs filling up with requests > > > to windowsupdate.microsoft.com from numerous machines across our network. > > > Our guess is that these are XP machines with the auto update feature > > > enabled, but while we try tracking them down we have blocked access to the > > > site. Unfortunately, we are still finding the logs are filling up with > > > requests to the site. Is there a way to suppress logging of that URL? > > > > > > Thanks in advance for any advice > > > > > > Fred Clark > > > > > > > > > >
