[squid-users] Seeking insight into zeros, negative values in log: 2.6.STABLE18

[Henry S. Thompson]

Amos Jeffries writes:

> On 4/08/2016 2:36 a.m., Henry S. Thompson wrote:
>> I'm trying to do some summary statistics based on log files from our
>> 2.6.STABLE18 setup.
>
> Please upgrade. The current 3.5.20 release can do everything that
> Squid-2.6 could do, and a lot more useful stuff besides.

I'd love to, but it's out of my hands, much higher up :-(.

Thanks for your help below.

>>  2) Leaving aside those cases, I see a modest handful (1 in 7000) of 0
>>     values in the size field, e.g.
>> 
>>     1402741879.726 114 ... TCP_MISS/200 0 GET http://... DIRECT/... image/gif
>>     1402771557.693 176 ... TCP_HIT/200 0 GET http://... NONE/- image/gif
>> 
>>     How should these be understood?
>
> A response with no body payload. It happens. Usually with "web bug" type
> images used for tracking.
> Or maybe the image was something like a captcha and the script producing
> it crashed with no data sent.

But documentation claims size field includes headers, and clearly
(image/gif) at least a Content-type header was sent...

>>  3) I'm seeing very small numbers (1 in 100000) of negative durations, e.g.
>> 
>>     1402744620.389 -70 ... TCP_MISS/200 1882 GET http://... DIRECT/... text/xml
>>     
>>     How should these be understood?
>
> The system clock on your machine went backwards between the request
> arriving and the response being completely sent. Check for issues in
> your NTP setup.

1000s of times a day?  Seems . . . unlikely.  But I'll try to get the
sys admin people responsible to investigate.

Thanks again,

ht
-- 
       Henry S. Thompson, School of Informatics, University of Edinburgh
      10 Crichton Street, Edinburgh EH8 9AB, SCOTLAND -- (44) 131 650-4440
                Fax: (44) 131 650-4587, e-mail: ht at inf.ed.ac.uk
                       URL: http://www.ltg.ed.ac.uk/~ht/
 [mail from me _always_ has a .sig like this -- mail without it is forged spam]