On 02.08.2012 09:37, Usuário do Sistema wrote:
Hello, I have been asked what are external ip address in the sarg
reports.
so I had done a search in access.logs and I found follow access among
others.
795035 112.215.36.175 TCP_MISS/200 96944 GET
http://ads.xlxtra.com%2Ferrors%2F%3Ftype=40
4@xxxxxxxxxxxxxx/pictures/9612330624e58d492b8555.jpg -
DIRECT/74.204.173.205 image/jpeg
please, released there are two external ip address at the initial
112.215.36.175 and at the end 74.204.173.205.
when I run a sarg report that access it appear like the most used! it
is very strange why it doesn't show a internal ip address instead ?
One would assume you know the Squid machine IP address(es) without
needing them logged on every request. If you have a multi-IP box where
that is also needed, you can use a custom log format to display the IP
at Squids end of each TCP connections.
http://www.squid-cache.org/Doc/config/logformat/
what is this external access ?
http://wiki.squid-cache.org/Features/LogFormat
The one on the right (next to DIRECT/) is the IP of the server
providing the response. Every MISS or REFRESH will have a server where
the upstream data came from.
The one on left (next to TCP_MISS) is the IP of the client making the
request. One would expect you to know who your users are and where they
are located. If that IP is known not to be a legit customer/client of
your Squid something is wrong with your security access controls.
Amos
