Re: [squid-users] upload data report

On 15/12/2012 10:41 p.m., Muhammad Yousuf Khan wrote:
>> >
>> >
>> >Yes. This is because every transaction in HTTP has data flowing in both
>> >directions.
>> >
>> >%>st logs the size of transaction for request.
> now i am confused.
>
> as per squid document
> http://www.squid-cache.org/Versions/v2/2.7/cfgman/logformat.html
>
> default log formate of squid log is "logformat squid %ts.%03tu %6tr
> %>a %Ss/%03Hs %<st %rm %ru %un %Sh/%<A %mt"
>
> means in default format squid is using only %<st, as mantioned in the format.

Yes.

> actually i am confused bacause and i can not understand the purpose
> of %<st %>st because as per my finding %<st is giving me the actual
> value of download and upload and same entry goes in both both cases
> instead of some random numbers.

None of these are random numbers. They are all precise octet measures.

The most common thing to do in HTTP is to load pages and objects.

> for example i test an upload on my
> live.com email account and the size of that file was 2.2 MB
> here is the log
>
> this is default log of access.log as mantioned in the official
> document. probably based on only "%<st"

"probably"?

> 1355559811.654 485143 10.51.100.240 TCP_MISS/200 18155070 CONNECT
> snt121.mail.live.com:443 - DIRECT/65.55.68.103 -
>
>
> this is my created log formate containing both values %<st and %>st
> and the value that i get by %>st not giving me the upload size.
>
> 1355559811.654 485143 10.51.100.240 TCP_MISS/200 18155070 181 CONNECT
> snt121.mail.live.com:443 - DIRECT/65.55.68.103 -
>
>
> so the confusing part is second log entry.
>
> i found nothing but a figure of 181 (as %>st) which is no near to 2 MB
> in any case. however the value of %<st is 18155070 which is the
> actuall size of the file that i uploaded. which i can also see in
> default access.log
>
> so the question is if i am getting the upload and download value by
> %<st then what is purpose of tracking %>st?

The '<' means data sent to client. The '>' means data received from
client. The format omitting these characters is the total sum of both.

> can i just "cat" access.log file and "grep" only "CONNECT" value. will
> this not help me in my case. ? for example
> "cat access.log | grep CONNECT"

CONNECT is a tunnel. A lot of data often goes both ways in tunnels. The
data you get out of CONNECT is the sum of a whole series of requests and
replies headers, bodies and all. If that 18 MB (nowhere near 2.2 MB!) is
logged by the default squid log format then it is the sum total size of
all pages, images, CSS, scripts fetched down that tunnel, possibly
including a HTML formatted display version of the file uploaded.

Amos
Received on Sat Dec 15 2012 - 11:43:47 MST