<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">
I am seeing this occasionally in my squid logs and am little confused because I don't know how to troubleshoot this one. I normally see in the squid logs the destination IP address as dst_ip in my custom logs but in these cases, the field is blank. I'd expect
the destination IP to be blank when it encounters a DNS Failure but then the Squid message is ERR_DNS_FAIL not ERR_CONNECT_FAIL. Here is part of an log example:
<div class=""><br class="">
<div class=""><span style="color: rgb(60, 68, 77); font-family: "Splunk Platform Mono", Inconsolata, Consolas, "Droid Sans Mono", Monaco, "Courier New", Courier, monospace; font-size: 14px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(255, 255, 255); text-decoration-thickness: initial;" class="">...
** </span><span class="t" style="color: rgb(60, 68, 77); font-family: "Splunk Platform Mono", Inconsolata, Consolas, "Droid Sans Mono", Monaco, "Courier New", Courier, monospace; font-size: 14px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(255, 255, 255); text-decoration-thickness: initial;">Flow2</span><span style="color: rgb(60, 68, 77); font-family: "Splunk Platform Mono", Inconsolata, Consolas, "Droid Sans Mono", Monaco, "Courier New", Courier, monospace; font-size: 14px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(255, 255, 255); text-decoration-thickness: initial;" class="">**
</span><span class="t" style="color: rgb(60, 68, 77); font-family: "Splunk Platform Mono", Inconsolata, Consolas, "Droid Sans Mono", Monaco, "Courier New", Courier, monospace; font-size: 14px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(255, 255, 255); text-decoration-thickness: initial;"><span class="t"><span class="t"><span class="t"><span class="t">squid</span>_<span class="t">egress</span></span>_<span class="t">ip</span></span>=</span>-</span><span style="color: rgb(60, 68, 77); font-family: "Splunk Platform Mono", Inconsolata, Consolas, "Droid Sans Mono", Monaco, "Courier New", Courier, monospace; font-size: 14px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(255, 255, 255); text-decoration-thickness: initial;" class="">
</span><span class="t" style="color: rgb(60, 68, 77); font-family: "Splunk Platform Mono", Inconsolata, Consolas, "Droid Sans Mono", Monaco, "Courier New", Courier, monospace; font-size: 14px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(255, 255, 255); text-decoration-thickness: initial;"><span class="t"><span class="t"><span class="t"><span class="t">squid</span>_<span class="t">egress</span></span>_<span class="t">port</span></span>=</span>-</span><span style="color: rgb(60, 68, 77); font-family: "Splunk Platform Mono", Inconsolata, Consolas, "Droid Sans Mono", Monaco, "Courier New", Courier, monospace; font-size: 14px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(255, 255, 255); text-decoration-thickness: initial;" class="">
</span><span class="t" style="color: rgb(60, 68, 77); font-family: "Splunk Platform Mono", Inconsolata, Consolas, "Droid Sans Mono", Monaco, "Courier New", Courier, monospace; font-size: 14px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(255, 255, 255); text-decoration-thickness: initial;"><span class="t"><span class="t"><span class="t">dst</span>_<span class="t">ip</span></span>=</span>-</span><span style="color: rgb(60, 68, 77); font-family: "Splunk Platform Mono", Inconsolata, Consolas, "Droid Sans Mono", Monaco, "Courier New", Courier, monospace; font-size: 14px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(255, 255, 255); text-decoration-thickness: initial;" class="">
</span><span class="t" style="color: rgb(60, 68, 77); font-family: "Splunk Platform Mono", Inconsolata, Consolas, "Droid Sans Mono", Monaco, "Courier New", Courier, monospace; font-size: 14px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(255, 255, 255); text-decoration-thickness: initial;"><span class="t"><span class="t"><span class="t">dst</span>_<span class="t">host</span></span>=</span>-</span><span style="color: rgb(60, 68, 77); font-family: "Splunk Platform Mono", Inconsolata, Consolas, "Droid Sans Mono", Monaco, "Courier New", Courier, monospace; font-size: 14px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(255, 255, 255); text-decoration-thickness: initial;" class="">
</span><span class="t" style="color: rgb(60, 68, 77); font-family: "Splunk Platform Mono", Inconsolata, Consolas, "Droid Sans Mono", Monaco, "Courier New", Courier, monospace; font-size: 14px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(255, 255, 255); text-decoration-thickness: initial;"><span class="t"><span class="t"><span class="t">dst</span>_<span class="t">port</span></span>=</span>-</span><span style="color: rgb(60, 68, 77); font-family: "Splunk Platform Mono", Inconsolata, Consolas, "Droid Sans Mono", Monaco, "Courier New", Courier, monospace; font-size: 14px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(255, 255, 255); text-decoration-thickness: initial;" class="">
</span><span class="t" style="color: rgb(60, 68, 77); font-family: "Splunk Platform Mono", Inconsolata, Consolas, "Droid Sans Mono", Monaco, "Courier New", Courier, monospace; font-size: 14px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(255, 255, 255); text-decoration-thickness: initial;"><span class="t"><span class="t">request</span>_<span class="t">method</span></span>=<span class="t">CONNECT</span></span><span style="color: rgb(60, 68, 77); font-family: "Splunk Platform Mono", Inconsolata, Consolas, "Droid Sans Mono", Monaco, "Courier New", Courier, monospace; font-size: 14px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(255, 255, 255); text-decoration-thickness: initial;" class="">
</span><span class="t" style="color: rgb(60, 68, 77); font-family: "Splunk Platform Mono", Inconsolata, Consolas, "Droid Sans Mono", Monaco, "Courier New", Courier, monospace; font-size: 14px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(255, 255, 255); text-decoration-thickness: initial;"><span class="t">request</span>=</span><span style="color: rgb(60, 68, 77); font-family: "Splunk Platform Mono", Inconsolata, Consolas, "Droid Sans Mono", Monaco, "Courier New", Courier, monospace; font-size: 14px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(255, 255, 255); text-decoration-thickness: initial;" class="">"</span><span class="t" style="color: rgb(60, 68, 77); font-family: "Splunk Platform Mono", Inconsolata, Consolas, "Droid Sans Mono", Monaco, "Courier New", Courier, monospace; font-size: 14px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(255, 255, 255); text-decoration-thickness: initial;">CONNECT
foo.</span><span class="t" style="color: rgb(60, 68, 77); font-family: "Splunk Platform Mono", Inconsolata, Consolas, "Droid Sans Mono", Monaco, "Courier New", Courier, monospace; font-size: 14px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(255, 255, 255); text-decoration-thickness: initial;"><span class="t a" style="background-color: rgb(254, 242, 215); border-top-width: 4px; border-top-style: solid; border-top-color: rgb(254, 242, 215); border-bottom-width: 4px; border-bottom-style: solid; border-bottom-color: rgb(254, 242, 215);"><span class="t"><span class="t">com</span></span></span>:<span class="t">443</span></span><span style="color: rgb(60, 68, 77); font-family: "Splunk Platform Mono", Inconsolata, Consolas, "Droid Sans Mono", Monaco, "Courier New", Courier, monospace; font-size: 14px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(255, 255, 255); text-decoration-thickness: initial;" class="">
</span><span class="t" style="color: rgb(60, 68, 77); font-family: "Splunk Platform Mono", Inconsolata, Consolas, "Droid Sans Mono", Monaco, "Courier New", Courier, monospace; font-size: 14px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(255, 255, 255); text-decoration-thickness: initial;"><span class="t"><span class="t">HTTP</span>/<span class="t">1</span></span>.<span class="t">1</span></span><span style="color: rgb(60, 68, 77); font-family: "Splunk Platform Mono", Inconsolata, Consolas, "Droid Sans Mono", Monaco, "Courier New", Courier, monospace; font-size: 14px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(255, 255, 255); text-decoration-thickness: initial;" class="">"
</span><span class="t" style="color: rgb(60, 68, 77); font-family: "Splunk Platform Mono", Inconsolata, Consolas, "Droid Sans Mono", Monaco, "Courier New", Courier, monospace; font-size: 14px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(255, 255, 255); text-decoration-thickness: initial;"><span class="t"><span class="t"><span class="t"><span class="t">status</span>_<span class="t">code</span></span>_<span class="t">from</span></span>_<span class="t">server</span></span>=<span class="t">503</span></span><span style="color: rgb(60, 68, 77); font-family: "Splunk Platform Mono", Inconsolata, Consolas, "Droid Sans Mono", Monaco, "Courier New", Courier, monospace; font-size: 14px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(255, 255, 255); text-decoration-thickness: initial;" class="">
</span><span style="color: rgb(60, 68, 77); font-family: "Splunk Platform Mono", Inconsolata, Consolas, "Droid Sans Mono", Monaco, "Courier New", Courier, monospace; font-size: 14px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(255, 255, 255); text-decoration-thickness: initial;" class=""></span><span style="color: rgb(60, 68, 77); font-family: "Splunk Platform Mono", Inconsolata, Consolas, "Droid Sans Mono", Monaco, "Courier New", Courier, monospace; font-size: 14px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(255, 255, 255); text-decoration-thickness: initial;" class=""></span><span class="t" style="color: rgb(60, 68, 77); font-family: "Splunk Platform Mono", Inconsolata, Consolas, "Droid Sans Mono", Monaco, "Courier New", Courier, monospace; font-size: 14px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(255, 255, 255); text-decoration-thickness: initial;"><span class="t"><span class="t"><span class="t">total</span>_<span class="t">response</span></span>_<span class="t">time</span></span>=<span class="t">59480</span></span><span style="color: rgb(60, 68, 77); font-family: "Splunk Platform Mono", Inconsolata, Consolas, "Droid Sans Mono", Monaco, "Courier New", Courier, monospace; font-size: 14px; font-variant-ligatures: normal; orphans: 2; white-space: pre-wrap; widows: 2; background-color: rgb(255, 255, 255); text-decoration-thickness: initial;" class="">
...</span><br class="">
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
</div>
</div>
</body>
</html>