Hi, I'm using cascaded/hierarchical Squid instances, one per machine. To get the ability to correlate access.log entries between instances, I have extended the default squid log format by %>p and %<lp . For correlation, I use the following two sets of information: The parent proxy uses "URL", "timestamp", "client source port". The child proxy uses "URL", "timestamp", "local port number of the last server or peer connection". Even with some slight timing variations due to caching/lookups/network, the child proxy local port number of the last peer connection and the parent proxy client source port help tremendously matching those entries against each other.
This works great except for one oddity: Quite a few Squid log entries of the child proxy have "0" as local port number of the last server or peer connection. I have absolutely no idea why that would be the case. AFAICS cached entries have "-" as local port number and that's fine because it means there was no associated parent proxy connection. Am I doing something wrong? Are there any cases where the log format code %<lp would legitimately yield 0? Regards, Carl-Daniel _______________________________________________ squid-users mailing list squid-users@lists.squid-cache.org http://lists.squid-cache.org/listinfo/squid-users
