<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
span.E-MailFormatvorlage17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=en-DE link="#0563C1" vlink="#954F72" style='word-wrap:break-word'><div class=WordSection1><p class=MsoNormal><span lang=EN-GB>Hi!<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-GB><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-GB>I’ve recently stumbled across all the information that is returned from the squid cache manager. Now after analysing the request count data a bit on the cache manager information responses I noticed that they do not match up with the amount of logs in access.log. There might be 300 requests/s (as shown by the cache manager by comparing the values and calculating the average per second) and only 100 access.log entries in the somewhat similar time (given a few seconds to make sure it was written). <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-GB>I am wondering: what causes that or rather how do I have to interpret those different numbers? Which of those can I trust?<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-GB>I am aware that a CONNECT only shows up once and requests routed through the tunnel do not show up in access.log, however I thought that you can not see single requests on squids side as it is encrypted and thus not count it. That would be my only guess on what it could be.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-GB><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-GB>Using squid 5 on Debian 11 and 99.9% of the traffic is HTTPS.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-GB><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-GB>I would appreciate any help.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-GB>Thanks! <o:p></o:p></span></p><p class=MsoNormal><span lang=en-DE><o:p> </o:p></span></p></div></body></html>