Cisco Ironport Squid Log Format Broken Down

One of the most interesting things about proxy log files that the syntax is a cryptic.   Some companies have internally purchased off-the-self packages so they can be used to generate quick and meaningful data.   However, I always found it useful to know these log files mean.  So without much do here is a reference that may be helpful to you.  I have color coded so it's easier to follow:


1215535247.487 123 172.20.11.222 TCP_MISS/200 14148 GET HTTP://www.cisco.com/
DIRECT/www.cisco.com text/html

1215535247.487 = %t Time stamp in Unix time (You can convert this by going to the following link (http://tinyurl.com/72sbp3o)


123 = %e elapsed time

172.20.11.222 = %a Client IP address
 

TCP_MISS = %w Transactional result code

• NONE – Neither a hit nor a miss, indicates an error in the transaction
• TCP_MEM_HIT – Object was cached in memory
• TCP_DENIED – Access Denied
• TCP_HIT - A valid copy of the requested object was in the cache.
• TCP_MISS - The requested object was not in the cache.
• TCP_REFRESH_HIT - An expired copy of the requested object was in the cache.
• Squid made an If-Modified-Since request and the response was "Not Modified."
• TCP_REFRESH_FAIL_HIT An expired copy of the requested object was in the
• cache. Squid attempted to make an If-Modified-Since request, but it failed.
• The old (stale) object was delivered to the client.
• TCP_REFRESH_MISS - An expired copy of the requested object was in the cache.
• Squid made an If-Modified-Since request and received a new, different
• object. TCP_CLIENT_REFRESH The client issued a request with the "no-cache"
• pragma. ("reload" - handled as MISS)
• TCP_IMS_HIT - An If-Modified-Since GET request was received from the client.
• A valid copy of the object was in the cache (fresh).
• TCP_IMS_MISS - An If-Modified-Since GET request was received from the
• client. The requested object was not in the cache (stale).
• TCP_SWAPFAIL - The object was believed to be in the cache, but could not be
• accessed. TCP_DENIED Access was denied for this request.

200 = %h HTTP Response Code

• 200 - OK
• 204 - No Content
• 206 - Partial content
• 301 - Moved Permanenatly
• 302 - Found (over there)
• 304 - Not modified
• 305 - Use Proxy
• 307 - Temporary Redirect
• 401 - Unauthorized
• 403 - Forbidden
• 404 - Not Found
• 405 - Method not allowed
• 407 - Proxy Authorization Required
• 503 - Service Unavailable
• 504 - Gateway timeout

14148 = %s Total bytes transferred

GET HTTP://www.cisco.com/ = %r Request method URI
 

DIRECT/www.cisco.com = %H – Cache hierchy retrieval

• NONE – No request made
• DIRECT – request went directly to server
• DEFAULT_PARENT – Single upstream proxy or failover
• LEASTBUSY_PARENT – Fewest Connections
• HASHBASED_PARENT – Hash based load balancing
• LEASTRECENT_PARENT – Least recently used
• ROUNDROBIN_PARENT – Round robin load balancing

text/html = %c – MIME content type/subtype

• text/plain – simple text