View source for Identify the Filter by using SafeSquid Extended Logs or Detailed Logs


= Overview =

Find the filter name which is causing the blocking&nbsp; of the specific website or Application. Once you find the reason for blocking then you can take an action to allow the website or application

= Prerequisites =

You must have knowledge of [[Analyze_The_SafeSquid_Logs|Analysis of SafeSquid Logs]]

= Finding from SafeSquid Console =

== Access the SafeSquid server or console ==

Run the below command to find the current SafeSquid logs by which the website or the application is blocking&nbsp;&nbsp;

<code>tail -F /var/log/safesquid/extended/extended.log | grep "\"403\""</code>

the output will display results in the following order:&nbsp;
<div style="background:#eee;border:1px solid #ccc;padding:5px 10px;">"record_id" &nbsp; &nbsp; "client_id" &nbsp; &nbsp; "request_id" &nbsp; &nbsp;"date_time" &nbsp; &nbsp; "elapsed_time" &nbsp;"status" &nbsp; &nbsp; &nbsp; &nbsp;"size" &nbsp;"upload" &nbsp; &nbsp; &nbsp; &nbsp;"download" &nbsp; &nbsp; &nbsp;"bypassed" &nbsp; &nbsp; &nbsp;"client_ip" &nbsp; &nbsp; "username" &nbsp; &nbsp; &nbsp; "method" &nbsp; &nbsp; &nbsp; &nbsp;"url" &nbsp; "http_referer" &nbsp;"useragent" &nbsp; &nbsp; "mime" &nbsp;"<u>'''''filter_name'''''</u>" &nbsp; "filtering_reason" &nbsp; &nbsp; &nbsp;"interface" &nbsp; &nbsp; "cachecode" &nbsp; &nbsp; "peercode" &nbsp; &nbsp; &nbsp;"peer" &nbsp;"request_host" &nbsp; "request_tld" &nbsp; "referer_host" &nbsp;"referer_tld" &nbsp; "range" "time_profiles" "user_groups" &nbsp; "request_profiles" &nbsp; &nbsp; &nbsp;"application_signatures" &nbsp; &nbsp; &nbsp; &nbsp;"categories" &nbsp; &nbsp;"response_profiles" &nbsp; &nbsp; &nbsp;"upload_content_types" &nbsp;"download_content_types" &nbsp; &nbsp; &nbsp; &nbsp;"profiles"</div> 
You can find the filtername on 18th column of SafeSquid Extended logs&nbsp;

Example&nbsp;:
<div style="background:#eee;border:1px solid #ccc;padding:5px 10px;">"15198252557612zPcLB" &nbsp; "761" &nbsp; "2" &nbsp; &nbsp; "28/Feb/2018:19:10:55" &nbsp;"15" &nbsp; &nbsp;"403" &nbsp; "1518" &nbsp;"0" &nbsp; &nbsp; "1518" &nbsp;"FALSE" "192.168.0.27" &nbsp;"anonymous@192.168.0.27" &nbsp; &nbsp; &nbsp; &nbsp;"GET" &nbsp; "[https://scontent.fbom8-1.fna.fbcdn.net:443/v/t1.0-1/p50x50/28168712_185447622069230_6889621589669762501_n.jpg?oh=40820039a0b53ca9046ac03c0d13136b&oe=5B07F816 https://scontent.fbom8-1.fna.fbcdn.net:443/v/t1.0-1/p50x50/28168712_185447622069230_6889621589669762501_n.jpg?oh=40820039a0b53ca9046ac03c0d13136b&oe=5B07F816]" &nbsp;"[https://www.facebook.com/ https://www.facebook.com/]" &nbsp; &nbsp; &nbsp;"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:58.0) Gecko/20100101 Firefox/58.0" &nbsp; &nbsp; &nbsp; &nbsp;"image/jpeg" &nbsp; &nbsp;<u>'''''"image-filter"'''''</u>&nbsp;"7.194000" &nbsp; &nbsp; &nbsp;"192.168.27.50:8080" &nbsp; &nbsp;"TCP_DENIED" &nbsp; &nbsp; "DIRECT" &nbsp; &nbsp; &nbsp; &nbsp;"safesquid" &nbsp; &nbsp; "scontent.fbom8-1.fna.fbcdn.net" &nbsp; &nbsp; &nbsp; &nbsp;"fbcdn.net" &nbsp; &nbsp; "www.facebook.com" &nbsp; &nbsp; &nbsp;"facebook.com" &nbsp;"1K-10K" &nbsp; &nbsp; &nbsp; &nbsp;"" &nbsp; &nbsp; &nbsp;"ADMINS" &nbsp; &nbsp; &nbsp; &nbsp;"" &nbsp; &nbsp; &nbsp; "Firefox Browser,Browsers,Facebook,Social Networking" &nbsp; "WHITELIST,hi,instantmessaging,my,socialnetworks" &nbsp; &nbsp; &nbsp; "POTENTIAL MALWARE THREATS,SMALL DOWNLOADS" &nbsp; &nbsp; "-" &nbsp; &nbsp; "image/jpeg" &nbsp; &nbsp; ""<br/> &nbsp;</div> 
In the above log line&nbsp;:

<code>&nbsp;[https://scontent.fbom8-1.fna.fbcdn.net:443/v/t1.0-1/p50x50/28168712_185447622069230_6889621589669762501_n.jpg?oh=40820039a0b53ca9046ac03c0d13136b&oe=5B07F816 https://scontent.fbom8-1.fna.fbcdn.net:443/v/t1.0-1/p50x50/28168712_185447622069230_6889621589669762501_n.jpg?oh=40820039a0b53ca9046ac03c0d13136b&oe=5B07F816]</code>

Is blocked due to the filter&nbsp; '''Image filter'''

= Finding from SafeSquid User Interface =

If you don't have the access to SafeSquid Server, then you can also find the filtername by using SafeSquid Interface

Read more about&nbsp;[[Identify_the_filter_name_using_SafeSquid_Detailed_logs_from_the_interface|Finding from SafeSquid User Interface]]