Sample Log File - Squid Net Cache Log File Format


This article applies to:

  • Firewall Suite 4.X

Question:

What is an example of a Log File in Squid Net Cache Log File Format?

Information:

Sample Log File Format:

902351618.864 440 120.65.1.1 TCP_MISS/304 110 GET http://www.webtrends.com:8005/Images/search.gif - DIRECT/www.webtrends.com -
902351639.632 120.65.1.1 TCP_REFRESH_MISS/200 2014 GET http://www.webtrends.com/news/news.txt - DIRECT/newsroom.compuserve.com text/plain
902351659.571 274 207.65.46.33 TCP_CLIENT_REFRESH/200 1467 GET http://www.webtrends.com/news/headlines.txt - - DIRECT/www.webtrends.com text/plain
902351691.541 120.65.1.1 TCP_REFRESH_MISS/200 2014 GET http://www.webtrends.com/support/support.txt - DIRECT/www.webtrends.com text/plain
902351708.872 286 207.65.46.33 TCP_MISS/200 1384 GET http://www.webtrends.com/news/headlines.txt - - DIRECT/www.webtrends.com text/plain


Log File Field Structure Definitions:

  • Timestamp
    The time when the client socket is closed. The format is "Unix time" (seconds since Jan 1, 1970) with millisecond resolution. This can be modified to visible format by "cat access.log | perl -nwe s/^(\d+)/localtime($1)/e; print".

  • Elapsed Time
    The elapsed time of the request, in milliseconds. This is time between the accept() and close() of the client socket.

  • Client Address
    The IP address of the connecting client, or the FQDN if the 'log_fqdn' option is enabled in the config file.

  • Log Tag / HTTP Code
    The Log Tag describes how the request was treated locally (hit, miss, etc). All the tags are described in the link provided in the "Related Topics" section below. The HTTP code is the reply code taken from the first line of the HTTP reply header. Non-HTTP requests may have zeroreply codes.

  • Size
    The number of bytes written to the client.

  • Request Method
    The HTTP request method, or ICP_QUERY for ICP requests.

  • URL
    The requested URL.

  • Ident
    If 'ident_lookup' is enabled, this field may contain the user name associated with the client connection as derived from the ident service.

  • Hierarchy Data / Hostname
    A description of how and where the requested object was fetched.

  • Content Type
    The Content-type field from the HTTP reply.


 

This article was previously published as:
NETIQKB2418

Last Modified 4/12/2006.
https://support.trustwave.com/kb/KnowledgebaseArticle10715.aspx