[squid-users] Seeking insight into zeros, negative values in log: 2.6.STABLE18

[Amos Jeffries]

On 4/08/2016 2:36 a.m., Henry S. Thompson wrote:
> I'm trying to do some summary statistics based on log files from our
> 2.6.STABLE18 setup.

Please upgrade. The current 3.5.20 release can do everything that
Squid-2.6 could do, and a lot more useful stuff besides.

> 
> A range of issues with interpreting 0 and negative values have arisen:
> 
>  1) Roughly 6 in every 1000 log lines show an HTTP status code of 000,
>     about 90% with TCP_MISS, the rest mostly TCP_HIT, e.g.
> 
>     1402700792.606 54 ... TCP_MISS/000 0 GET http://... DIRECT/... -
>     1402700780.177 1 ... TCP_HIT/000 0 GET http://... NONE/- -
> 
>     Web search suggests the most likely interpretation of this is client
>     disconnect, can anyone confirm/elaborate?  Note this seems
>     consistent with the fact that as in the examples above almost all
>     show a 0 for the size, but doesn't explain the lack of media type...
> 

Yes, for both the client disconnected before any response was sent by
Squid. The first Squid was still in the process of talking to a server
to get a response.


>  2) Leaving aside those cases, I see a modest handful (1 in 7000) of 0
>     values in the size field, e.g.
> 
>     1402741879.726 114 ... TCP_MISS/200 0 GET http://... DIRECT/... image/gif
>     1402771557.693 176 ... TCP_HIT/200 0 GET http://... NONE/- image/gif
> 
>     How should these be understood?

A response with no body payload. It happens. Usually with "web bug" type
images used for tracking.
Or maybe the image was something like a captcha and the script producing
it crashed with no data sent.

> 
>  3) I'm seeing very small numbers (1 in 100000) of negative durations, e.g.
> 
>     1402744620.389 -70 ... TCP_MISS/200 1882 GET http://... DIRECT/... text/xml
>     
>     How should these be understood?

The system clock on your machine went backwards between the request
arriving and the response being completely sent. Check for issues in
your NTP setup.

Amos