[squid-users] Squid4 '%<la' empty sometimes

[Peter Viskup]

On Wed, Apr 4, 2018 at 5:42 PM, Amos Jeffries <squid3 at treenet.co.nz> wrote:
> On 04/04/18 21:15, Peter Viskup wrote:
>> On Linux Virtual Server balanced cluster the %<la is empty when Squid
>> errors ERR_ACCESS_DENIED or TCP_MEM_HIT are logged.
>>
>> This is causing issue when processing logs on remote machine (e.g.
>> ELK). The "proxy node" cannot be differentiated.
>
> It sounds to me like you are misinterpreting what is happening and/or
> using the wrong logformat tags/codes.
>
> The denied or HIT transactions you mention *do not* involve any upstream
> server. Thus no upstream server connection. No logformat codes will log
> details from a non-existing thing.
>
> So can you clarify what you mean by "Linux Virtual Server balanced
> cluster" ?
>
> Is that a cluster of LB devices/VM in front (or behind) a Squid proxy?
>  or some Squid running on each node of the cluster?
>  or something else?

Two VMs with heartbeat+ldirectord+LVS. Every server running the Squid
proxy. The service IP with LVS configuration (managed by ldirectord)
is made highly available.