Re: [squid-users] Incorrect logging of any ICQ connection

From: Henrik Nordstrom <hno@dont-contact.us>
Date: Sun, 20 Feb 2005 15:35:56 +0100 (CET)

On Wed, 2 Feb 2005, sasha wrote:

> Hi, dear squid-cache developers!
> In my LAN some of users use icq and of course through squid. I don't
> leave them chance to go other way.
> I need to get statistics per user for ALL traffic
> transferred through the cache. That works fine, but squid does NOT log
> these connections as it logs other connections, made by the CONNECT
> method.

It does log CONNECT connections, but only when the connection is closed.

In addition access.log only ever shows the amount of data received, never
the amount of data sent. This applies to all uses of the proxy, not only
CONNECT.

> Say I want to go to https://www.nic.ru/whois/ and want to get an info
> for sasha.ru domain. EVERY connection to this service is logged.
> When I ask squid to CONNECT to a https server by a browser and get a
> reply, is the CONNECT session concerned closed?

It depends. Many https servers closes the connection quickly, but not all.

> I mean does squid close
> the connection to the https server or keeps that one alive waiting for
> next client's (browser's) request?

Squid has no say about this. It is all up to the browser and https server
how long they keep the connection open. To Squid there is just "random"
unstructured data flying in both directions between the browser and the
server.

> The end of connection (when I closed app., that is icq) is expressed by
> this entry:
>
> 1107254299.091 915654 10.7.0.18 TCP_MISS/000 18353 CONNECT
> 205.188.7.220:443 sasha FIRST_UP_PARENT/10.0.0.78 -
>
> Where 18353(BYTES!!!) say to me that I (sasha) transferred both sides
> such amount of data.

It says that sasha received 18353 on this connection.

Is says nothing about how much data sasha sent to the requested server.

Regards
Henrik
Received on Sun Feb 20 2005 - 07:35:58 MST

This archive was generated by hypermail pre-2.1.9 : Tue Mar 01 2005 - 12:00:02 MST