Re: [squid-users] Help Understanding Access Log

 On Tue, 20 Sep 2011 22:31:29 +0000, Momen, Mazdak wrote:
> Hi,
>
> We're configuring our site which is hosted on an IIS server to use
> our squid server as a proxy (using the defaultproxy setting in
> machine.config). I'm trying to decipherer the access log, or more
> understand why it is using the same IP address. For example, one
> entry
> is:
>
> 1316557568.358 14937 10.51.1.61 TCP_MISS/000 0 GET
> http://10.51.1.61:3128/ - DIRECT/10.51.1.61 -
>
> We have two interfaces on the squid server, one for internal access
> and one for external. The external interface is configured with a
> default gateway and we have a static route for any internal requests
> to go out the internal interface. The 10.51.1.61 IP is the external
> one, we have pointed our site to 10.52.1.61 (the internal IP). Why is
> the external IP address being shown in the log three times? All lines
> are similar to the above line but with the duration time different.

 The client machine ("10.51.1.61") is requesting Squid to fetch the URL
 "http://10.51.1.61:3128/".
 Squid did not have a saved object ("MISS") so contacted the domain
 server ("DIRECT/10.51.1.61") using TCP ("TCP_") to fetch it and no
 response came back ("/000 0") after a long wait ("14937" milliseconds).

 This is a forwarding loop. HTTP uses the Via: header to prevent this
 type of failure. Ensure that "via on" (the default setting) is
 configured in your squid.conf. That will abort the loop at the first
 cycle and leave you in a better position to track down how it is
 starting.

 After a set of these lines in access.log there will usually be another
 entry from the actual source of the problem, some non-10.51.1.61 client
 requesting "http://10.51.1.61:3128/" URL. If that does not show up,
 check for a re-writer producing wrong URLs.

 Amos
Received on Wed Sep 21 2011 - 00:51:31 MDT