> Mario Remy Almeida wrote: >> Hi I have not enabled squidmime. >> But logformat headers %ts.%03tu %tg %>a %rp [%>h] [%<h] >> > > I understand that. > > I am asking you to set up a log using the (defined by default) squidmime > format, and see if that displays the information you are interested in. > > Try and limit the source of the problem. > >> Regards, >> Remy >> > > Chris > In order to get "NONE:// [-]" out of "%ts.%03tu %tg %>a %rp [%>h] [%<h]" I believe %rp needs to be producing "NONE://" and %h producing "-" both of which mean no information available. Since the request-protocol (%rp) is unknown, its follows that no headers are available. This is likely seen when a request failed to parse. ie non-HTTP being pushed into Squid port or intercepted requests with URI longer than Squid can cope (>4KB or >8KB URL depending on squid version). If it can be shown that the request was correct HTTP on the wire I'm interested. Amos
