Antony, I got this idea too, but here we "lose" (i mean it's not overwritten) the info in the access.log and there is no effect of realtime if you see what I mean... An alternative could to catch the TCP_DENIED with a helper but I did not find the way yet, i think it cannot be done this way. The easy way would be to have a special "%<sd" (Size Denied) or a "%<sr" (Size Real) in the logformat... Fred -- View this message in context: http://squid-web-proxy-cache.1019090.n4.nabble.com/How-to-get-the-correct-size-of-a-denied-object-tp4672332p4672334.html Sent from the Squid - Users mailing list archive at Nabble.com. _______________________________________________ squid-users mailing list squid-users@xxxxxxxxxxxxxxxxxxxxx http://lists.squid-cache.org/listinfo/squid-users