On 6/15/21 1:57 PM, Garbacik, Joe wrote: > I am seeing this occasionally in my squid logs and am little confused > because I don't know how to troubleshoot this one. I normally see in the > squid logs the destination IP address as dst_ip in my custom logs but in > these cases, the field is blank. I'd expect the destination IP to be > blank when it encounters a DNS Failure but then the Squid message is > ERR_DNS_FAIL not ERR_CONNECT_FAIL. Here is part of an log example: > > ... ** Flow2** > squid_egress_ip=-squid_egress_port=-dst_ip=-dst_host=-dst_port=-request_method=CONNECTrequest="CONNECT > foo.com:443HTTP/1.1" status_code_from_server=503total_response_time=59480... Too many possibilities for me to offer a good working theory. Squid error reporting behavior is often Squid version-specific and usually module-specific. It is possible that your Squid just forgot to relay the failed connection details (a bug), or that a DNS timeout problem was somehow overwritten with ERR_CONNECT_FAIL, or that Squid was thinking that it is not talking to an origin server (only origin server name resolution problems may result in ERR_DNS_FAIL for some unknown to me reason), etc., etc. You can try logging %dt, %<pt, and %<tt to get more details, but figuring this out may require many iterations if you cannot reproduce the problem at will. N.B. If you post more details, please share your logformat. It is often impossible to guess which exact logformat %code was used for which of your custom labels. Alex. _______________________________________________ squid-users mailing list squid-users@xxxxxxxxxxxxxxxxxxxxx http://lists.squid-cache.org/listinfo/squid-users
