[squid-users] What do the bytes and duration fields in squid log count for https (CONNECT)?

[Amos Jeffries]

On 25/07/2016 10:34 p.m., Henry S. Thompson wrote:
> Standard squid config only logs one CONNECT line for any https
> transaction. What is being counted/timed by the reported bytes and
> duration fields in that line?
> 
> I'm guessing it's the total time taken and total bytes delivered to the
> client by any and all transactions in the course of the TLS connection
> established by that CONNECT, but I can't find anything in the log
> documentation which confirms that.

Yes. There is no HTTPS or TLS as far as Squid is concerned. (In modern
traffic you are also very likely to be wrong about it being HTTPS or TLS
on port 443. The (browser?) URL saying "https://" does not make it HTTPS
inside the tunnel).

An HTTP CONNECT message with opaque data is all Squid sees. Its duration
is how long it takes, and the opaque data is the size it is.

Amos