[squid-users] Difference between cache manager http request count and access.log entries

[Amos Jeffries]

On 23/03/22 09:04, admin wrote:
> Hi!
> 
> I’ve recently stumbled across all the information that is returned from 
> the squid cache manager. Now after analysing the request count data a 
> bit on the cache manager information responses I noticed that they do 
> not match up with the amount of logs in access.log. There might be 300 
> requests/s (as shown by the cache manager by comparing the values and 
> calculating the average per second) and only 100 access.log entries in 
> the somewhat similar time (given a few seconds to make sure it was 
> written).
> 
> I am wondering: what causes that or rather how do I have to interpret 
> those different numbers? Which of those can I trust?

Which manager report are you looking at?

Some reports show average across the entire Squid lifetime across all 
workers.

> 
> I am aware that a CONNECT only shows up once and requests routed through 
> the tunnel do not show up in access.log, however I thought that you can 
> not see single requests on squids side as it is encrypted and thus not 
> count it.

That is normally correct, unless you are decrypting the traffic. In 
which case the decrypted requests and several transactions used to do 
the decryption are logged (and counted).


HTH
Amos