squid log files

[Brian Cluff]

> I just got Squid running this week and am trying to
> figure out what the log files mean.  If anyone has a
> good URL(besides the squid-page) I would be greatfull.

If you set emulate_httpd_log to on, it will generate a log that looks almost
identical to the apache log file.  That will probably make more sense.  It
definatly improves the date stamp to be alot more human readable.

> I have a couple of simple questions:
>
>  1. in the access.log file every request is TCP_MISS
>  even I go back to the same web page(ie yahoo.com or
>  yale.edu)  What is a web page that I should get a
>  TCP_HIT on?

Most big websites these days run some sort of dynamic content, and therefore
they tell caches not to cache their page, so that the pages new content will
pop up correctly.

>  2. in the store.log file, all the entries are either
>  SWAPOUT or RELEASE, is this normal?  Shouldn't I be
>  getting some SWAPIN entries?

I believe that the swapout process is basicly a "store this and if it
already exists, replace the old one"

>  When I set my browser up to use it as a proxy cache,
>  it seems to speed up the downloads from URL's across
>  the pond, but I can't prove it looking at the log
>  files.

Well, any kind of a hit is obviously a speed up.  I find that after you
leave squid running for a few weeks that you will get around a 40% hit rate.
Of course I am running well over 1000 users though mine, so I would guess
that your hit rate wont be so high, but every little bit counts.
You will probably get a higher hit rate on images within a page than on the
page itself.  Images usually dont change so its alot more rare that the
server will send a no-cache to your machine on an image.

Check out the cache-mgr.cgi script, it will tell you way more than you want
to know about the stats on your squid.

Brian Cluff