Hi,
We are running Squid version 2.5.Stable13, using NTLM authentication which
all works fine. Our problem has to do with the logged hierarchical
information. Our setup looks something like this:
Cache1 --- Cache 2
| |
-------------
|
Controller
Our controller receives all the requests and does no disk based caching on
its own drive, it relies on the two caches to fetch all the information
and all the controller does is authentication and logging for the caches.
The caches themselves dont log what they fetch. Here are the cache peer
lines from squid.conf on the controller:
cache_peer 1.1.1.2 parent 3128 3130 proxy-only login=*:pass
cache_peer 1.1.1.3 parent 3128 3130 proxy-only login=*:pass
On the controller we have always direct turned off, and all requests go
through the parent caches.
Here is a sample of the caches squid.conf:
cache_peer 1.1.1.3 sibling 3128 3130 proxy-only login=PASS
cache_peer 10.10.0.200 parent 3128 0 default no-query login=PASS
The parent is an IWSS server that does content and virus scanning.
Right, onto the problem. On the controller, a typical log entry looks like
this:
1161598696.549 1014 10.4.21.15 TCP_MISS/200 597 POST
http://shttp.msg.yahoo.com/notify/ EXAK011 FIRST_PARENT_MISS/1.1.1.3
text/plain 803
You can see that on the controller its a TCP_MISS. The user has
authenticated (EXAK011), and the result code from the cache parent is
FIRST_PARENT_MISS. Thats fine and works perfectly. Now majority of the
logs look something like this:
1161598704.296 69 10.112.86.99 TCP_MISS/200 1159 GET
http://www.news24.com/Images/News24v2/Images/bgnd_new.jpg abnt135
TIMEOUT_NONE/- image/jpeg 480
In this you can see that even though the cache result code is TCP_MISS,
the hierarchical code is TIMEOUT_NONE, even though the request was valid
and the image was valid to. The image even downloaded correctly.
Now when reporting on this we stumble upon a problem where 50-60% of our
hierarchical results come back as NONE or TIMEOUT_NONE which doesnt help
when trying to work out the savings we are getting.
Here is the logformat line from the controller:
logformat squid %ts.%03tu %6tr %>a %Ss/%03Hs %<st %rm %ru %un %Sh/%<A %mt
%>st
and the squid_access_log:
cache_access_log /var/log/squid/access.log squid
Does anyone have any idea how we can know what actually happened in that
NONE, or if we can interpret it any other way?
Thanks in advance,
Regards
Ian
