I'm running Squid 4.14 with the following custom log format:
logformat MyLogFormat ---> local_time="[%tl]" squid_service=%{service}note squid_status=%Ss squid_hierarchy_status=%Sh ** lb_id=%{X-Request-Id}>h *FLOW0* orig_src_ip=%{X-Client-Egress-Ip}>h orig_src_port=%{X-Client-Egress-Port}>h lb_ingress_ip=%{X-LB-Ingress-Ip}>h lb_ingress_port=%{X-LB-Ingress-Port}>h *Flow1* lb_egress_ip=%>a lb_egress_port=%>p squid_ingress_ip=%>la squid_ingress_port=%>lp *FLOW2* squid_egress_ip=%<la squid_egress_port=%<lp dst_ip=%<a dst_host=%<A dst_port=%<p ident_username=%[ui username=%[un request_method=%rm request="%rm %ru HTTP/%rv" status_code_from_server=%>Hs status_code_to_client=%<Hs referer="%{Referer}>h" user_agent="%{User-Agent}>h" protocol_version=%rv ** dns_response_time=%dt response_time=%tr mime_type=%mt *XFER* total_request_size=%>st total_reply_size=%<st ** %{src_zone}note %{dst_zone}note %{method_category}note %{dst_category}note %{file_upload}note ** REQUEST HEADERS %>h *** RESPONSE HEADERS %<h *** tag_returned=%et tag_string="%ea" previous_
hop_mac=%>eui peer_response_time=%<pt total_response_time=%<tt *SSL* src_ssl_negotiated_version=%ssl::>negotiated_version dst_ssl_negotiated_version=%ssl::<negotiated_version src_tls_hello_version=%ssl::>received_hello_version dst_tls_hello_version=%ssl::<received_hello_version src_tls_max_version=%ssl::>received_supported_version dst_tls_max_version=%ssl::<received_supported_version src_tls_cipher=%ssl::>negotiated_cipher dst_tls_cipher=%ssl::<negotiated_cipher ssl_bump=%<bs ssl_bump_mode=%ssl::bump_mode ssl_sni=%ssl::>sni src_cert_subject="%ssl::>cert_subject" src_cert_issuer="%ssl::>cert_issuer" dst_cert_subject="%ssl::<cert_subject" dst_cert_issuer="%ssl::<cert_issuer" cert_errors="%ssl::<cert_errors" ssl_handshake="%>handshake" *** error_page_presented=%err_code err_detail="%err_detail" rule_id=%{ruleid}note rule_type=%{ruletype}note XFF="%{X-Forwarded-For}>h" squid_dst_app=%{dst_app}note
I normally don't see an issue as things are logged with %<a populated unless the destination doesn't resolve then %<a is blank with %err_code value being ERR_DNS_FAIL. Even then I see %>Hs=503, %<a contains an IP but I've noticed that on some very active destinations is just a hyphen.
_______________________________________________
squid-users mailing list
squid-users@xxxxxxxxxxxxxxxxxxxxx
http://lists.squid-cache.org/listinfo/squid-users
