[squid-users] Data usage reported in log files

[Yosi Greenfield]

Thanks!

Netflow is much larger.

I really want to know exactly what site is costing my users data. Many of
our users are on metered connections and are paying for overage, but I can't
tell where that overage is being used. Are they using youtube, webmail,
wetransfer? I see only a fraction of their actual proxy usage in my squid
logs.

Data compression would give the opposite result, so that's not what I'm
seeing.

Any other ideas?


-----Original Message-----
From: squid-users [mailto:squid-users-bounces at lists.squid-cache.org] On
Behalf Of Antony Stone
Sent: Friday, March 10, 2017 2:21 PM
To: squid-users at lists.squid-cache.org
Subject: Re: [squid-users] Data usage reported in log files

On Friday 10 March 2017 at 20:14:36, Yosi Greenfield wrote:

> Hello all,
> 
> I'm analyzing my squid logs with sarg, and I see that the number of 
> bytes reported as used by any particular user are often nowhere near 
> the bytes reported by netflow and tcpdump.

Which is larger?

> I'm trying to trace my users' data usage by site, but I'm unable to do 
> so from the log files because of this.

Well, what is it you really want to know?

netflow / tcpdump will give you accurate numbers for the quantity of data on
your Internet link - I assume this is what you're most interested in?

Squid will show you what quantity of data goes to/from the clients, but is
that really important?

> Can someone please explain to me what I might be missing? Why does 
> squid log report one thing and netflow and tcpdump show something 
> else?

Data compression?

HTTP responses are often gzipped, so if tcpdump is showing you smaller
numbers of bytes than Squid reports, that's what I'd look at first.


Antony.

-- 
This sentence contains exacly three erors.

                                                   Please reply to the list;
                                                         please *don't* CC
me.
_______________________________________________
squid-users mailing list
squid-users at lists.squid-cache.org
http://lists.squid-cache.org/listinfo/squid-users