[squid-users] Debugging slowness

I'm trying to debug some slowness issues with Squid 3.4.4. This is
currently under reasonably light use and every so often it becomes very
slow.

From what I can tell, the client sends a request with Negotiate auth
credentials in it. The proxy should respond with a 407 and the
negotiate challenge, but instead it sometimes just sits there for
ages... sometimes for a minute or so! (I'm not 100% convinced that this
is specific to Negotiate auth though). Squid does not appear to be
running out of file descriptors.

The problem is intermittent, which is making debugging a pain. I have a
tcpdump running and full logging turned on in squid so hopefully I can
catch some useful information the next time the problem occurs.

My question is: Once I've identified a specific request that has
experienced the problem, and want to track what Squid was doing with
that request, is there any sensible way of filtering the cache.log to
exclude the other requests that were happening concurrently?

Secondly, does anyone have any suggestions for what specific logging I
should turn on, rather than logging everything, since logging everything
slows the proxy down significantly?

Thanks.

-- 
 - Steve Hill
   Technical Director
   Opendium Limited     http://www.opendium.com
Direct contacts:
   Instant messager: xmpp:steve_at_opendium.com
   Email:            steve_at_opendium.com
   Phone:            sip:steve_at_opendium.com
Sales / enquiries contacts:
   Email:            sales_at_opendium.com
   Phone:            +44-844-9791439 / sip:sales_at_opendium.com
Support contacts:
   Email:            support_at_opendium.com
   Phone:            +44-844-4844916 / sip:support_at_opendium.com