I have sucessfully setup a Squid cluster using piranha and RedHat. I have two virtual servers sitting on the public network and 3 load balanced servers on the private side. The proxying is working fine. My problem is in the log files on the back side servers. When the machines on the public side forward the packets to the back end machines the only IP address that shows up in the logs is the front because it is actually making all of the proxy requests on behalf of whatever end user is out there on the public network. I have temporarily fixed it by putting squid on the front end machine and having it log all requests and pass them on to the back end machines. Unfortunatly that bypasses the load balancing and monitoring that Piranha (LVS, Pulse, etc.) is doing. I would like to know if there is a way to log the requests that are made on the front end machine without having Squid running on the front end and the log that is created needs to be able to be read by a log analysis program (SurfStats, Webalizer, etc.) Either that or the front router needs to be able to pass on the IP of the machine that it originated from so that the log on the back end is useful once it is analyzed.

Thanks for any help,
Ryan Bunce
Network Guy at Michigan Catholic Conference

Hi..

What we can try is put a central Syslog-ng with logging in a database like mysql and write a script to match the log of front end server with back end server log by using timestamp..
The idea may be silly. But u can try.

Regards

Sididqu.T