Squid Log Format
Unlike the common log format, Squid's native log format was designed with cache statistics in mind. This format can be generated not only by squid, but also by commercial caches like CacheFlow, InfoLibria, and NetCache. Each log entry represents one HTTP request using space-delimited fields with single dash placeholders:

timestamp	Time of request as UTC seconds with milliseconds resolution
duration	Elapsed time for cache to process request in milliseconds
host	Fully-qualified domain name or IP address of the requesting client
code	The squid result code (how the cache satisfied the request or why it failed)
status	The HTTP status code returned by the server (if any)
bytes	The number of bytes returned to client, including HTTP header
method	The HTTP request method (defined by RFCs 2616 and 2518) or ICP_QUERY
URL	The URL requested by the client
ident	The RFC 931 identity of the client (if returned by identd)
peerstatus	The squid hierarchy code (explains how the request was handled)
peerhost	Fully-qualified domain name or IP address of host providing requested object
type	The content type of the returned object (from the HTTP reply header)

Record Format

timestamp duration host code/status bytes method URL ident peerstatus/peerhost type

Examples

955682882.018 19 192.168.1.142 TCP_MISS/200 1722 GET http://www.corecom.com/ - DIRECT/www.corecom.com text/html

955682888.893 6 192.168.1.142 TCP_IMS_HIT/304 176 GET http://www.corecom.com/ - NONE/- text/html

Comparing the two formats, some fields differ in representation but provide similar content. For example, squid log UTC time is easily converted to common log date and time. The squid log splits the client request into separate method and URL fields, but drops the HTTP version.

Other squid log fields provide cache-specific information not found in the common log format. Squid result codes explain how the request was satisfied by the cache. For example, was the object vended from cache (TCP_HIT), fetched from elsewhere (TCP_MISS), blocked by access controls (TCP_DENIED), or found in cache but expired (TCP_EXPIRED)?

Our example records show the first request is a cache miss with a response time of 19 ms, while the second "if modified since" request is a cache hit taking just 6 ms. On the miss, the text/html object was obtained directly from the origin server. Squid log result codes and duration fields allow stats like median response time and hit ratio to be calculated over any logged time period.

Squid hierarchy codes permit analysis of ICP, CARP, or cache digest behavior. For example, was the object was fetched from the origin server (DIRECT), found in an ICP sibling or parent cache (SIBLING_ or PARENT_HIT), or requested through an ICP parent (ROUNDROBIN_PARENT, CLOSEST_PARENT, DEFAULT_PARENT)? When present, the hierarchy code is accompanied by a peerhost field that identifies the origin server, peer, or parent who supplied the object. These basic codes are self-explanatory, but there are many others. For a complete description of squid result and hierarchy codes, consult the FAQ.

Introduction/Common Log Format

Squid Log Format

>HTTP Status Codes

Log Analysis Tools