On Tue, 20 Sep 2011 22:31:29 +0000, Momen, Mazdak wrote:
Hi,
We're configuring our site which is hosted on an IIS server to use
our squid server as a proxy (using the defaultproxy setting in
machine.config). I'm trying to decipherer the access log, or more
understand why it is using the same IP address. For example, one
entry
is:
1316557568.358 14937 10.51.1.61 TCP_MISS/000 0 GET
http://10.51.1.61:3128/ - DIRECT/10.51.1.61 -
We have two interfaces on the squid server, one for internal access
and one for external. The external interface is configured with a
default gateway and we have a static route for any internal requests
to go out the internal interface. The 10.51.1.61 IP is the external
one, we have pointed our site to 10.52.1.61 (the internal IP). Why is
the external IP address being shown in the log three times? All lines
are similar to the above line but with the duration time different.
The client machine ("10.51.1.61") is requesting Squid to fetch the URL
"http://10.51.1.61:3128/";.
Squid did not have a saved object ("MISS") so contacted the domain
server ("DIRECT/10.51.1.61") using TCP ("TCP_") to fetch it and no
response came back ("/000 0") after a long wait ("14937" milliseconds).
This is a forwarding loop. HTTP uses the Via: header to prevent this
type of failure. Ensure that "via on" (the default setting) is
configured in your squid.conf. That will abort the loop at the first
cycle and leave you in a better position to track down how it is
starting.
After a set of these lines in access.log there will usually be another
entry from the actual source of the problem, some non-10.51.1.61 client
requesting "http://10.51.1.61:3128/"; URL. If that does not show up,
check for a re-writer producing wrong URLs.
Amos
