<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">ok in squid 3.x<div class=""><blockquote type="cite" class=""><blockquote type="cite" class="">logformat squid %tl %6tr %>a %>p %>la %>lp %Ss/%03Hs %<st %rm %ru %un %Sh/ %<A %<a %<la</blockquote></blockquote></div><div class="">check the syntax :</div><div class=""><br class=""></div><div class=""><font color="#0433ff" class="">01/Aug/2019:11:29:11</font> -0400 <font color="#ff2600" class="">837 11.11.81.74 50223</font> <font color="#aa7942" class="">22.158.182 11961</font> TCP_TUNNEL/200 3205 CONNECT <a href="http://www.googletagservices.com:443" class="">www.googletagservices.com:443</a> <font color="#0433ff" class="">mwckpf</font> HIER_DIRECT/ <a href="http://www.googletagservices.com" class="">www.googletagservices.com</a> <font color="#e32400" class="">172.217.15.66 </font><font color="#77bb41" class="">22.22.158.182</font><br class=""><div><br class=""></div><div><br class=""></div><div>lets analyse above .:</div><div><br class=""></div><div>1st thing i see the time/date of the request .</div><div><br class=""></div><div>then the source ip and source port who hit squid ————> <span style="caret-color: rgb(255, 38, 0); color: rgb(255, 38, 0);" class=""> 11.11.81.74 50223</span></div><div>then destination ip and port of squid sender connected to ————><font color="#ff2600" class=""> </font><span style="caret-color: rgb(170, 121, 66); color: rgb(170, 121, 66);" class="">22.158.182 11961</span></div><div><span style="caret-color: rgb(170, 121, 66);" class="">Dst URL —></span><a href="http://www.googletagservices.com:443" class="">www.googletagservices.com:443</a> </div><div>User of the connection ——> <span style="caret-color: rgb(4, 51, 255); color: rgb(4, 51, 255);" class="">mwckpf</span></div><div><span style="caret-color: rgb(4, 51, 255);" class="">IP resolution of the destination ——————> </span><a href="http://www.googletagservices.com" class="">www.googletagservices.com</a> <font color="#e32400" class="">172.217.15.66</font></div><div>last thing the external ip address for that connection ———————> <span style="caret-color: rgb(119, 187, 65); color: rgb(119, 187, 65);" class="">22.22.158.182</span></div><div><span style="caret-color: rgb(119, 187, 65); color: rgb(119, 187, 65);" class=""><br class=""></span></div><div><span style="caret-color: rgb(119, 187, 65); color: rgb(119, 187, 65);" class=""><br class=""></span></div><div><span style="caret-color: rgb(119, 187, 65); color: rgb(119, 187, 65);" class=""><br class=""></span></div><div><font color="#77bb41" class="">Now on squid5.x</font></div><div><font color="#77bb41" class="">i add </font></div><div><blockquote type="cite" class=""><blockquote type="cite" class="">logformat squid %tl %6tr %>a %>p %>la %>lp %Ss/%03Hs %<st %rm %ru %un %Sh/ %<A %<a %<la</blockquote></blockquote><br class=""></div><div>but the result is as :</div><div>1564669418.690 770 18.212.116.217 TCP_TUNNEL/200 40757 CONNECT <a href="http://www.bing.com:443" class="">www.bing.com:443</a> abc HIER_DIRECT/204.79.197.200 -</div><div><br class=""></div><div>as you see , there is no date , so src port no dst ip/dst port .</div><div>no external ip </div><div><br class=""></div><div>i would like as possible to see results as the results in 3.5 .</div><div><br class=""></div><div>hope that is clear </div><div><br class=""></div><div>Thanks Alex :)</div><div><br class=""></div><div><br class=""></div><div><font color="#aa7942" class=""><span style="caret-color: rgb(170, 121, 66);" class=""><br class=""></span></font><blockquote type="cite" class=""><div class="">On 1 Aug 2019, at 16:55, Alex Rousskov <<a href="mailto:rousskov@measurement-factory.com" class="">rousskov@measurement-factory.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="">On 8/1/19 9:23 AM, --Ahmad-- wrote:<br class=""><blockquote type="cite" class="">i use :<br class="">logformat squid %tl %6tr %>a %>p %>la %>lp %Ss/%03Hs %<st %rm %ru %un %Sh/ %<A %<a %<la<br class=""><br class="">in squid 3.x and its working fine , but in 5.x it dont work as i want <br class=""></blockquote><br class="">We still do not have enough information to understand the problem you<br class="">are trying to solve. Please be specific. For example, describe a<br class="">transaction that logs X in v3.5 and Y in v5, and, unless it is really<br class="">obvious from X and Y, please explain why you want X and not Y.<br class=""><br class="">Alex.<br class=""></div></div></blockquote></div><br class=""></div></body></html>