Squid Logfile Meldungen entschlüsseln

Von Zeit zu Zeit muss ich immer mal wieder in Squid-Logfiles stöbern und da kommt es schon mal vor dass ich mich nicht mehr zu 100% daran erinnern kann was welche Meldung bedeutet 🙂

Im Squid FAQ finden sich die passenden Antworten: http://wiki.squid-cache.org/SquidFaq/SquidLogs

Und damit ich die wichtigsten Sachen schnell wieder finde, auch wenn die obige Seite mal nicht erreichbar oder übersiedelt ist hier gleich eine Auflistung:

Squid result codes

The TCP_ codes refer to requests on the HTTP port (usually 3128). The UDP_ codes refer to requests on the ICP port (usually 3130). If ICP logging was disabled using the log_icp_queries option, no ICP replies will be logged.
The following result codes were taken from a Squid-2, compare with the log_type enum in src/enums.h:

TCP_HIT A valid copy of the requested object was in the cache.
TCP_MISS The requested object was not in the cache.
TCP_REFRESH_HIT The requested object was cached but STALE. The IMS query for the object resulted in „304 not modified“.
TCP_REFRESH_FAIL_HIT The requested object was cached but STALE. The IMS query failed and the stale object was delivered.
TCP_REFRESH_MISS The requested object was cached but STALE. The IMS query returned the new content.
TCP_CLIENT_REFRESH_MISS The client issued a „no-cache“ pragma, or some analogous cache control command along with the request. Thus, the cache has to refetch the object.
TCP_IMS_HIT The client issued an IMS request for an object which was in the cache and fresh.
TCP_SWAPFAIL_MISS The object was believed to be in the cache, but could not be accessed.
TCP_NEGATIVE_HIT Request for a negatively cached object, e.g. „404 not found“, for which the cache believes to know that it is inaccessible. Also refer to the explainations for negative_ttl in your squid.conf file.
TCP_MEM_HIT A valid copy of the requested object was in the cache and it was in memory, thus avoiding disk accesses.
TCP_DENIED Access was denied for this request.
TCP_OFFLINE_HIT The requested object was retrieved from the cache during offline mode. The offline mode never validates any object, see offline_mode in squid.conf file.
TCP_STALE_HIT The object was cached and served stale. This is usually caused by stale-while-revalidate or stale-if-error.
TCP_ASYNC_HIT A background request (e.g., one started by stale-while-revalidate) resulted in a refresh hit.
TCP_ASYNC_MISS A background request (e.g., one started by stale-while-revalidate) resulted in a miss; i.e., the cached object (if any) was updated).
UDP_HIT A valid copy of the requested object was in the cache.
UDP_MISS The requested object is not in this cache.
UDP_DENIED Access was denied for this request.
UDP_INVALID An invalid request was received.
UDP_MISS_NOFETCH During „-Y“ startup, or during frequent failures, a cache in hit only mode will return either UDP_HIT or this code. Neighbours will thus only fetch hits.
NONE Seen with errors and cachemgr requests.

HTTP status codes
These are taken from RFC 2616 and verified for Squid. Squid-2 uses almost all codes except 307 (Temporary Redirect), 416 (Request Range Not Satisfiable), and 417 (Expectation Failed). Extra codes include 0 for a result code being unavailable, and 600 to signal an invalid header, a proxy error. Also, some definitions were added as for RFC 2518 (WebDAV). Yes, there are really two entries for status code 424, compare with http_status in src/enums.h:

000 Used mostly with UDP traffic.
100 Continue
101 Switching Protocols
*102 Processing
200 OK
201 Created
202 Accepted
203 Non-Authoritative Information
204 No Content
205 Reset Content
206 Partial Content
*207 Multi Status
300 Multiple Choices
301 Moved Permanently
302 Moved Temporarily
303 See Other
304 Not Modified
305 Use Proxy
[307 Temporary Redirect]
400 Bad Request
401 Unauthorized
402 Payment Required
403 Forbidden
404 Not Found
405 Method Not Allowed
406 Not Acceptable
407 Proxy Authentication Required
408 Request Timeout
409 Conflict
410 Gone
411 Length Required
412 Precondition Failed
413 Request Entity Too Large
414 Request URI Too Large
415 Unsupported Media Type
[416 Request Range Not Satisfiable]
[417 Expectation Failed]
*424 Locked
*424 Failed Dependency
*433 Unprocessable Entity
500 Internal Server Error
501 Not Implemented
502 Bad Gateway
503 Service Unavailable
504 Gateway Timeout
505 HTTP Version Not Supported
*507 Insufficient Storage
600 Squid header parsing error