The optional referer.log contains Referer header values from client requests. To use this feature, you must run ./configure with the enable-referer-log option. You must also enter a pathname for the referer_log directive. For example:
referer_log /usr/local/squid/var/logs/referer.log
Set the filename to none if you want to disable referer logging.
The Referer header normally contains the URI from which the request was obtained (see Section 14.36 of RFC 2616). For example, when a web browser issues a request for an embedded image, the Referer header is set to the URI of the (HTML) page containing the images. It is also set when you click on an HTML link. Some web site operators use Referer values to find so-called dead links. You may find referer.log particularly useful if you use Squid as a surrogate.
The referer.log has a simple format, with only four fields. Here are a few examples:
1068047502.377 3.0.168.206 http://www.amazon.com/exec/obidos/search-handle-form/002-7230223-8205634 http://www.amazon.com/exec/obidos/ASIN/0596001622/qid=1068047396/sr=2-1/... 1068047503.109 3.0.168.206 http://www.amazon.com/exec/obidos/ASIN/0596001622/qid=1068047396/sr=2-1/... http://g-images.amazon.com/images/G/01/gourmet/gourmet-segway.gif 1068047503.196 3.0.168.206 http://www.amazon.com/exec/obidos/ASIN/0596001622/qid=1068047396/sr=2-1/... http://g-images.amazon.com/images/G/01/marketing/cross-shop/arnold/appar... 1068047503.198 3.0.168.206 http://www.amazon.com/exec/obidos/ASIN/0596001622/qid=1068047396/sr=2-1/... http://g-images.amazon.com/images/G/01/marketing/cross-shop/arnold/appar... 1068047503.825 3.0.168.206 http://www.amazon.com/exec/obidos/ASIN/0596001622/qid=1068047396/sr=2-1/... http://images.amazon.com/images/P/B00005R8BC.01.TZZZZZZZ.jpg 1068047503.842 3.0.168.206 http://www.amazon.com/exec/obidos/ASIN/0596001622/qid=1068047396/sr=2-1/... http://images.amazon.com/images/P/0596001622.01._PE_PI_SCMZZZZZZZ_.jpg
Note that requests that lack a Referer header aren't logged. The four fields are as follows:
The time of the request, expressed as the number of seconds since Unix epoch with millisecond resolution.
Note that, unlike access.log, a referer.log entry is made as soon as Squid receives the complete request. Thus, the referer.log entry occurs before the access.log, which waits for the end of the response.
The same as the client address in access.log. The log_fqdn and client_netmask directives affect this log file as well.
The value of the Referer header from the client's request. Note that the referer value might have whitespace (or any other) characters. Squid doesn't encode the value before writing to referer.log.
The URI that the client is requesting. It matches the URI in access.log.