Hi, I am trying to log username from a ntlm auth with fakeauth. And everything works with logging, but sometimes, specially with a few sites there is a few TCP_DENIED/407. But it looks like it's passes anyway further down the log. -----------------8X----------------- 1211121397.788 0 host.name.x TCP_DENIED/407 1802 GET http://www.expressen.se/logger/logger? - NONE/- text/html 1211121397.792 11 host.name.x TCP_CLIENT_REFRESH_MISS/304 324 GET http://www.expressen.se/polopoly_fs/1.629160!slot33slotWide25/3447786819.jpg domain\user.name DIRECT/193.180.57.70 - 1211121397.792 1 host.name.x TCP_DENIED/407 1888 GET http://www.expressen.se/logger/logger? - NONE/- text/html 1211121397.793 18 host.name.x TCP_CLIENT_REFRESH_MISS/200 4649 GET http://pics.fordonslagret.se/190f3d/140/104/1 domain\user.name DIRECT/85.24.138.6 image/jpeg 1211121397.797 9 host.name.x TCP_CLIENT_REFRESH_MISS/304 345 GET http://www.expressen.se/img/pil_upp_vit.gif domain\user.name DIRECT/193.180.57.70 - 1211121397.800 0 host.name.x TCP_DENIED/407 1895 GET http://www.expressen.se/polopoly_fs/1.161!defaultImage/2919991123.gif - NONE/- text/html 1211121397.804 0 host.name.x TCP_DENIED/407 1981 GET http://www.expressen.se/polopoly_fs/1.161!defaultImage/2919991123.gif - NONE/- text/html 1211121397.804 11 host.name.x TCP_CLIENT_REFRESH_MISS/304 345 GET http://www.expressen.se/img/pil_bakat_vit.gif domain\user.name DIRECT/193.180.57.70 - 1211121397.806 12 host.name.x TCP_MISS/200 409 GET http://www.expressen.se/logger/logger? domain\user.name DIRECT/193.180.57.70 image/gif ---------------------------- Any ideas? info: squid -v Squid Cache: Version 2.6.STABLE18