thanks, my issue was with security. thanks 2012/8/1 Amos Jeffries <squid3@xxxxxxxxxxxxx>: > On 02.08.2012 09:37, Usuário do Sistema wrote: >> >> Hello, I have been asked what are external ip address in the sarg reports. >> >> so I had done a search in access.logs and I found follow access among >> others. >> >> 795035 112.215.36.175 TCP_MISS/200 96944 GET >> http://ads.xlxtra.com%2Ferrors%2F%3Ftype=40 >> 4@xxxxxxxxxxxxxx/pictures/9612330624e58d492b8555.jpg - >> DIRECT/74.204.173.205 image/jpeg >> >> please, released there are two external ip address at the initial >> 112.215.36.175 and at the end 74.204.173.205. >> >> when I run a sarg report that access it appear like the most used! it >> is very strange why it doesn't show a internal ip address instead ? > > > One would assume you know the Squid machine IP address(es) without needing > them logged on every request. If you have a multi-IP box where that is also > needed, you can use a custom log format to display the IP at Squids end of > each TCP connections. > http://www.squid-cache.org/Doc/config/logformat/ > > >> >> what is this external access ? > > > http://wiki.squid-cache.org/Features/LogFormat > > The one on the right (next to DIRECT/) is the IP of the server providing the > response. Every MISS or REFRESH will have a server where the upstream data > came from. > > The one on left (next to TCP_MISS) is the IP of the client making the > request. One would expect you to know who your users are and where they are > located. If that IP is known not to be a legit customer/client of your Squid > something is wrong with your security access controls. > > > Amos >
