ISPPlanet Primer: Analyzing Cache Logs —continued

Our primer offers an overview of Common and Squid log formats and the tools you may use to work with them.

HTTP Status Codes
A key field in both log formats is the HTTP status code returned by the server. Some of the more common HTTP status codes are listed here:

200	OK	Successful	Information returned with response
204	No Content	Successful	Request fulfilled but server does not need to return body
301	Moved Permanently	Redirected	Requested object has new URL (see Location)
304	Not Modified	Redirected	Conditional GET successful but object is unchanged
401	Unauthorized	Client Error	Request requires user authentication
403	Forbidden	Client Error	Request has been refused
404	Not Found	Client Error	Server cannot find requested object
503	Service Unavailable	Server Error	Server temporarily unable to handle request

As our example log records illustrate, the first successful request for an object returns status 200. Subsequent "if modified since" requests on the same fresh object return status 304. If the object were not found in either the cache or on the origin server, status 404 would be returned. If access to the object was denied by a cache content filter, status 403 would be returned. For a complete list of HTTP status codes and their definitions, see RFC 2616.

Squid logs include additional status codes such as 000 (unavailable) and 600 (squid header parsing error).

Introduction/Common Log Format

Squid Log Format

HTTP Status Codes

>Log Analysis Tools