[squid-users] squid access.log

[Alex Rousskov]

On 4/20/20 2:04 PM, leomessi983 at yahoo.com wrote:
> hi
> I have one question.
> why for each https request that squid do peek or bump or splice ,squid
> logs 2 lines?
> one with connect method and one with head method?

... because there are two HTTP[S] requests in those cases, one with the
CONNECT method and one with the HEAD method. There are other cases where
one bumped CONNECT tunnel carries hundreds or even thousands of
GET/HEAD/PUT/POST/CONNECT/etc. requests. And there are also cases where
a bumped CONNECT tunnel carries no requests at all.

In summary, one bumped CONNECT tunnel will (by default) result in one or
more access.log records, starting with the CONNECT record.

Alex.