On Tuesday 12 November 2002 05.44, richard.fuser@ernstyoung.com.au 
wrote:
> My cache.log shows the following:
>
> 1037074988.945  69598 10.2.3.1 TCP_MISS/000 0 GET
> http://staging.sub.domain.com/ userid TIMEOUT_DIRECT/111.22.33.44
Which does not unfortunately tell very much. What this tells is
a) request was aborted before Squid could parse the HTTP reply headers
b) and you are using ICP to peers on requests for this server and none 
of your peers is responding to ICP in a timely manner.
Quite likely you want a "always_direct" for this or any other intranet 
sites.
To really figure out what is going on here ngrep is your best friend. 
ngrep can be found from http://ngrep.sourceforge.net/ if you do not 
have it installed.
For those familiar with tcpdump ngrep is basically a super version of 
tcpdump allowing you to look into and select packets based on their 
payload, not only packet header.
Run
  ngrep host 11.22.33.44
on the Squid server while trying to make the request.
This will give you a human readable dump of the traffic taking place 
between Squid and your intranet server.
Regards
Henrik
Received on Tue Nov 12 2002 - 00:30:06 MST
This archive was generated by hypermail pre-2.1.9 : Tue Dec 09 2003 - 17:11:17 MST