On 28.03.2012 13:28, Linda Walsh wrote:
repost -- mailer bounded it -- for some reason it thinks that having
multiple formats of a message to choose from is a security problem?
Gee...
good think squid doesn't reject things with type-info, or it wouldn't
work at all.
Guess things that reject all types are becoming the dinosaurs of the
net.
It's just an executable code filter to prevent people spamming virus
and executable code at us. These list emails are archived and displayed
as HTML pages.
Also, it's hard to read your question amongst the code ...
--------------090103050306030004050800
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 8bit
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=UTF-8" http-equiv="Content-Type">
<style>
/* Linda's Style playground (c) 2011 L. A Walsh (permission given to
do w/this anything other than claim my original as your own!
<Okay I'll feel free to snip 3.3K of useless code then and get down to
the 1K of text in the middle>
<body>
Got a surprise in a new version of squid 3.2.0.16 -- in monitoring my
log, my monitor prog burped and died. It didn't like trying to
calculate the average rate over negative time period (for some reason
it doesn't realize that time<br>
can run backwards and data is actually sucked back out...;-))<br>
<br>
Is this normal now? One of the things I changed recently was going
from <br>
syslog, which tends to be pretty good about not having times go
backwards, <br>
to 'diskd'....<br>
<br>
Dunno if it is a bug or a feature, but it is a bit odd looking in a
time-progression based log. I can at least prevent my script from
gagging<br>
at such, but is it supposed to be doing that??<br>
The question is why is your log processor diff'ing the request
completion timestamps? Squid handles requests in parallel. There is a
separate duration column to say how long each of those requests took to
process.
<br>
Thanks -- sample times included below from log -- ALL of these
were<br>
while I was connected to 'google', so ALL of them were 'CONNECT'
log<br>
messages, which might enter into the equation somewhere...<br>
Are you SSL-bumping? This would seem to be a side-effect of delayed
logging of a CONNECT which "finished" some time ago but only gets logged
after the tunnel data was finished and logged.
You can expect time to do these tricks on a smaller scale when SMP
workers share logs as well.
-linda <br>
(** indicates time going backwards)<br>
<font face="Times New Roman, Times, serif"><br>
<snip>
1332885668.461<br>
1332885670.637<br>
1332885671.136<br>
1332885672.015<br>
1332885671.807**<br>
1332885672.527<br>
1332885672.325**<br>
---------------------<br>
<br>
</font><tt>p.s. -- OTOH, it could be a marketing feature... squid's
so
fast, it fetches content in negative time!<br>
Amos
