[squid-users] Seeking insight into zeros, negative values in log: 2.6.STABLE18

[Henry S. Thompson]

I'm trying to do some summary statistics based on log files from our
2.6.STABLE18 setup.

A range of issues with interpreting 0 and negative values have arisen:

 1) Roughly 6 in every 1000 log lines show an HTTP status code of 000,
    about 90% with TCP_MISS, the rest mostly TCP_HIT, e.g.

    1402700792.606 54 ... TCP_MISS/000 0 GET http://... DIRECT/... -
    1402700780.177 1 ... TCP_HIT/000 0 GET http://... NONE/- -

    Web search suggests the most likely interpretation of this is client
    disconnect, can anyone confirm/elaborate?  Note this seems
    consistent with the fact that as in the examples above almost all
    show a 0 for the size, but doesn't explain the lack of media type...

 2) Leaving aside those cases, I see a modest handful (1 in 7000) of 0
    values in the size field, e.g.

    1402741879.726 114 ... TCP_MISS/200 0 GET http://... DIRECT/... image/gif
    1402771557.693 176 ... TCP_HIT/200 0 GET http://... NONE/- image/gif

    How should these be understood?

 3) I'm seeing very small numbers (1 in 100000) of negative durations, e.g.

    1402744620.389 -70 ... TCP_MISS/200 1882 GET http://... DIRECT/... text/xml
    
    How should these be understood?

Sorry for these queries of mostly historical interest for most people,
but I've looked fairly hard for earlier discussion of these oddities w/o
success.

Thanks,

ht
-- 
       Henry S. Thompson, School of Informatics, University of Edinburgh
      10 Crichton Street, Edinburgh EH8 9AB, SCOTLAND -- (44) 131 650-4440
                Fax: (44) 131 650-4587, e-mail: ht at inf.ed.ac.uk
                       URL: http://www.ltg.ed.ac.uk/~ht/
 [mail from me _always_ has a .sig like this -- mail without it is forged spam]