<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p>I have an issue with access_log acls when a load balancer sends a
TCP probe.</p>
<p>The goal is to not log errors caused by the TCP probes of the
load balancer. All other errors must be logged.<br>
</p>
<p>I did a test with the following acls on one of our test systems
to illustrate the issue:<br>
</p>
<tt>logformat combha %>a %ui %un [%tl] "%rm %ru HTTP/%rv" %>Hs
%<st %Ss:%Sh %>ha</tt><tt><br>
</tt><tt>acl src_lb src 10.2.2.254/32</tt><tt><br>
</tt><tt>acl src_lb src 10.2.2.107/32</tt><tt><br>
</tt><tt>access_log stdio:/local/squid4/logs/<b>lb</b>access.log
combha src_lb</tt><tt><br>
access_log stdio:/local/squid4/logs/access.log combha !src_lb</tt>
<p><br>
The logging is almost as expected: all HTTP(S) traffic from
10.2.2.107 goes to lbaccess.log and all other traffic to
access.log,<br>
<b>but</b> imitating the TCP probe of the LB with a telnet session
from 10.2.2.107 to the squid server which is immediately
terminated or sends garbage, is logged with
transaction-end-before-headers to access.log, not lbaccess.log.</p>
<p>It seems that Squid, at the moment that it logs the
transaction-end-before-headers error, does not consider the
access_log acls or maybe has not yet processed the source IP to
make the right decision.</p>
<p>Should the above acls send the errors to lbaccess.log ? If not,
what set of acls can do it?<br>
</p>
<p>Thanks,</p>
<p>Marcus<br>
</p>
<p><br>
</p>
<p><tt><br>
</tt></p>
<p><tt><br>
</tt></p>
</body>
</html>