[squid-users] Difference between cache manager http request count and access.log entries

[admin at tiehm.me]

Hi!

 

I’ve recently stumbled across all the information that is returned from the squid cache manager. Now after analysing the request count data a bit on the cache manager information responses I noticed that they do not match up with the amount of logs in access.log. There might be 300 requests/s (as shown by the cache manager by comparing the values and calculating the average per second) and only 100 access.log entries in the somewhat similar time (given a few seconds to make sure it was written). 

I am wondering: what causes that or rather how do I have to interpret those different numbers? Which of those can I trust?

I am aware that a CONNECT only shows up once and requests routed through the tunnel do not show up in access.log, however I thought that you can not see single requests on squids side as it is encrypted and thus not count it. That would be my only guess on what it could be.

 

Using squid 5 on Debian 11 and 99.9% of the traffic is HTTPS.

 

I would appreciate any help.

Thanks!  

 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.squid-cache.org/pipermail/squid-users/attachments/20220322/c2983712/attachment.htm>