[squid-users] Seeking insight into zeros, negative values in log: 2.6.STABLE18

[Amos Jeffries]

On 5/08/2016 12:37 a.m., Henry S. Thompson wrote:
> Thanks for your patience with this, but still not quite getting it.
> 
> I thought there were two cases:
> 
>   1) Client drops the connection before the interaction is complete ==
>      log shows HTTP result code 000, almost always size 0 as well;
> 
>   2) Interaction completed successfully == HTTP result code as from
>      cache or remote, size as sent to client.
> 
> See below how I can't make that fit with your reply


#1 is correct but incomplete. The 000 status means dropped any time
before the status to be delivered became known. So while "incomplete" is
true, there are very short times in the transaction where "incomplete"
is still true but are logged with non-000 status and size 0.

NP: There are also later times during payload delivery where drop can
happen so incomplete is still true and both status and size have values.
Those are impossible to detect in HTTP/1.0, so another reason to upgrade
to HTTP/1.1 software (Squid-3.2+).

The difference in timing between all these state changes should be a
very, very small number of milliseconds. Enough to see differently in
logs sometimes but should not be something to worry about.


The duration column is more important on these error entries as it shows
the user-visible latency. If that has big values (relative to your
usually expected network latency to the server) then its probably a sign
of network congestion slowing the TCP handshake or DNS lag. Not Squid
problems directly, but something to fix nevertheless.

Amos