On 15/12/2012 10:41 p.m., Muhammad Yousuf Khan wrote:
>
>
>Yes. This is because every transaction in HTTP has data flowing in both
>directions.
>
>%>st logs the size of transaction for request.
now i am confused.
as per squid document
http://www.squid-cache.org/Versions/v2/2.7/cfgman/logformat.html
default log formate of squid log is "logformat squid %ts.%03tu %6tr
%>a %Ss/%03Hs %<st %rm %ru %un %Sh/%<A %mt"
means in default format squid is using only %<st, as mantioned in the format.
Yes.
actually i am confused bacause and i can not understand the purpose
of %<st %>st because as per my finding %<st is giving me the actual
value of download and upload and same entry goes in both both cases
instead of some random numbers.
None of these are random numbers. They are all precise octet measures.
The most common thing to do in HTTP is to load pages and objects.
for example i test an upload on my
live.com email account and the size of that file was 2.2 MB
here is the log
this is default log of access.log as mantioned in the official
document. probably based on only "%<st"
"probably"?
1355559811.654 485143 10.51.100.240 TCP_MISS/200 18155070 CONNECT
snt121.mail.live.com:443 - DIRECT/65.55.68.103 -
this is my created log formate containing both values %<st and %>st
and the value that i get by %>st not giving me the upload size.
1355559811.654 485143 10.51.100.240 TCP_MISS/200 18155070 181 CONNECT
snt121.mail.live.com:443 - DIRECT/65.55.68.103 -
so the confusing part is second log entry.
i found nothing but a figure of 181 (as %>st) which is no near to 2 MB
in any case. however the value of %<st is 18155070 which is the
actuall size of the file that i uploaded. which i can also see in
default access.log
so the question is if i am getting the upload and download value by
%<st then what is purpose of tracking %>st?
The '<' means data sent to client. The '>' means data received from
client. The format omitting these characters is the total sum of both.
can i just "cat" access.log file and "grep" only "CONNECT" value. will
this not help me in my case. ? for example
"cat access.log | grep CONNECT"
CONNECT is a tunnel. A lot of data often goes both ways in tunnels. The
data you get out of CONNECT is the sum of a whole series of requests and
replies headers, bodies and all. If that 18 MB (nowhere near 2.2 MB!) is
logged by the default squid log format then it is the sum total size of
all pages, images, CSS, scripts fetched down that tunnel, possibly
including a HTML formatted display version of the file uploaded.
Amos
