[squid-users] Absurd results from the "icap::>st" log code

[Amos Jeffries]

On 19/03/2016 12:23 a.m., Austin Platt wrote:
> Hello,
> 
> I'm using squid 3.2.11 with an icap server and I am currently logging icap
> requests with the following format:
>   logformat icap_squid {\
>     "type": "icap", \
>     "client_ip": "%>a", \
>     "timestamp": "%ts", \
>     "request_method": "%rm", \
>     "request_url": "%>ru", \
>     "icap_server_name": "%icap::<service_name", \
>     "icap_status_code": "%icap::Hs", \
>     "icap_method": "%icap::rm", \
>     "icap_response_time": %icap::tio, \
>     "icap_transaction_time": %icap::tio, \
>     "icap_outcome": "%icap::to", \
>     "icap_bytes_in": %icap::>st, \
>     "icap_bytes_out": %icap::<st, \
>   }
> 
> However, I'm getting some very odd results for the `%icap::>st` and
> `%icap::<st` values. They are ranging from `7503595363210395275` (i.e. ~
> 7500 petabytes) to large negative numbers `-2821117572905556133`. Some are
> smaller still but still unlikely (e.g. 52mb sent in to icap for a request
> to the bbc.co.uk homepage).
> 
> I don't think these values can be accurate - are there known circumstances
> where these values would be logged inaccurately?

Sounds like the log info object is not being initialized properly.

Amos