Skip to main content
CLI man page: safesquid-feeds(7)
SafeSquid categorises websites and refreshes signature databases using cloud services, scheduled updates, and local caches. Categories and signature tags feed Access Profiles, filters, and Detailed logs.
Valid Subscription is required for cloud signature downloads and for Application Signatures / SSqore processing on each connection. Check Reports → License/Users Info and Modules Status when feeds stop updating.

​
Pieces

  • SSqore — CCS URL categorisation during request profiling. Globals: Enabled (Heuristic is stored but unused in the current build).
  • Categorize Web-Sites — Local category overrides you maintain. Takes precedence over cloud results for matching hosts on the hot path.
  • Application Signatures — Vendor applications4 database plus custom rules. Downloaded on UPDATE schedule; skipped when subscription expired.
  • Content Signatures — Vendor content4.xml plus libmagic MIME database under /var/lib/safesquid/content_signatures/.
  • DNS_CAT_ZONE — In startup.ini (default .c.ssquid.in). Set to . to disable DNS categorisation zone use.
  • UPDATE_INTVL / UPDATE_RETRY_DELAY — How often the appliance fetches signature and feed updates (startup.ini).

​
Update cycle (overview)

  1. Background hooks on the UPDATE schedule call signature updaters (update_application_signatures, update_content_signatures, and related).
  2. Downloaded files land under /var/lib/safesquid/ (application_signatures, content_signatures, ssqore cache, and similar).
  3. Config reload or init hooks merge vendor data with custom dev XML from the Web UI.
  4. Per-request labelling runs in the pipeline: SSqore and local category editor for website categories; Application Signatures for application tags.

​
Offline behaviour

When cloud lookups or downloads fail, SafeSquid relies on the last loaded on-disk databases and SSqore cache entries. New hosts may receive no categories until connectivity returns. Enable CATEGORY log level and check Modules Status in Reports.

​
Examples

​
Block Social Networking by cloud category

  1. Enable SSqore; confirm subscription valid.
  2. In Access Profiles Secondary Policies, DENY when Categories matches the SSqore name for social sites (exact string from Detailed logs).
Result: categorized social hosts are blocked; uncategorized hosts may pass until CCS returns a category.

​
Override one miscategorised partner

  1. Use Categorize Web-Sites to assign Business-Partners to partner.example.com.
  2. Allow that category in Access Profiles for trusted users.
Result: local override applies even if SSqore still lists a different cloud category.

​
How to verify

  1. Reports → Modules Status — application/content signature load times and errors.
  2. Detailed logs — categories and application_signatures columns on test URLs.
  3. Native logs with CATEGORY enabled for SSqore lines.

​
See also

CLI: man safesquid-feeds

Related topics

IntegrationsSafeSquid daemonCategorize Web-Sitesstartup.ini tunablesSSqore