Re: [squid-users] Incorrect logging of any ICQ connection
On Wed, 2 Feb 2005, sasha wrote: Hi, dear squid-cache developers! In my LAN some of users use icq and of course through squid. I don't leave them chance to go other way. I need to get statistics per user for ALL traffic transferred through the cache. That works fine, but squid does NOT log these connections as it logs other connections, made by the CONNECT method. It does log CONNECT connections, but only when the connection is closed. In addition access.log only ever shows the amount of data received, never the amount of data sent. This applies to all uses of the proxy, not only CONNECT. Say I want to go to httpS://www.nic.ru/whois/ and want to get an info for sasha.ru domain. EVERY connection to this service is logged. When I ask squid to CONNECT to a https server by a browser and get a reply, is the CONNECT session concerned closed? It depends. Many https servers closes the connection quickly, but not all. I mean does squid close the connection to the https server or keeps that one alive waiting for next client's (browser's) request? Squid has no say about this. It is all up to the browser and https server how long they keep the connection open. To Squid there is just "random" unstructured data flying in both directions between the browser and the server. The end of connection (when I closed app., that is icq) is expressed by this entry: 1107254299.091 915654 10.7.0.18 TCP_MISS/000 18353 CONNECT 205.188.7.220:443 sasha FIRST_UP_PARENT/10.0.0.78 - Where 18353(BYTES!!!) say to me that I (sasha) transferred both sides such amount of data. It says that sasha received 18353 on this connection. Is says nothing about how much data sasha sent to the requested server. Regards Henrik
[squid-users] Incorrect logging of any ICQ connection
Hi, dear squid-cache developers! In my LAN some of users use icq and of course through squid. I don't leave them chance to go other way. I need to get statistics per user for ALL traffic transferred through the cache. That works fine, but squid does NOT log these connections as it logs other connections, made by the CONNECT method. Say I want to go to httpS://www.nic.ru/whois/ and want to get an info for sasha.ru domain. EVERY connection to this service is logged. When I ask squid to CONNECT to a https server by a browser and get a reply, is the CONNECT session concerned closed? I mean does squid close the connection to the https server or keeps that one alive waiting for next client's (browser's) request? I hope it does close. 'Cause when exploring logs I found out for every https(CONNECT) request there is an entry saying who what and how many data transferred(of course it is not cached by the reason it is not understood). But when using icq - only two entry is in the access.log. Of course I understand that with such app. as icq the connection after having been established is being kept and only after closing icq (shutting down the app.), squid logs an info. At the beginning: 1106896841.651636 10.7.0.68 TCP_MISS/000 347 CONNECT login.icq.com:443 sasha FIRST_UP_PARENT/10.0.0.78 - The end of connection (when I closed app., that is icq) is expressed by this entry: 1107254299.091 915654 10.7.0.18 TCP_MISS/000 18353 CONNECT 205.188.7.220:443 sasha FIRST_UP_PARENT/10.0.0.78 - Where 18353(BYTES!!!) say to me that I (sasha) transferred both sides such amount of data. But is it so? Of course no, 'cause I have transferred more than 1.3 MB of data. Two files - one 1,1 MB and one 200KB and a discussion. So the question stays WHY? Why does squid logs incorrect data? I hoped it would log in the second (that is last) line all volume of data thansferred during the session (more than 1.3 MB). But it logs something strange number. Please anybody help. Respectfully. Sasha.
