ISPPlanet Cache Review Series - Squid 2.3

Monitoring Squid
We used three tools to monitor Squid: Cache Manager, an SNMP NMS, and logfile post-processors. We've already discussed Cache Manager (see Managing Squid and Tuning Cache Efficiency). We've also shown how to disable and rotate the access.log. Squid's access.log uses the native log format adopted by most commercial products. An emulate_httpd_log option is available to select the CERN format instead. Squid's native log format is described by the Squid FAQ, including explanation of the HTTP and ICP status codes that accompany each log entry.

Many logfile post-processors are available that understand Squid's native log format. Some basic Perl scripts are provided by NLANR. For example, run access_extract on a log file to generate a raw summary, then cat the result to access_summary to produce the report shown in part here. Another popular tool that produces text or html reports from Squid logs is Calamaris (right). For more info on these and other post-processors, visit the Squid home page and follow links to software.

We used CastleRock's SNMPc MIB Browser (lest) to query Squid's SNMP agent. Squid source includes an enterprise MIB. To use SNMP, compile Squid with SNMP enabled, add etc/mib.txt to your NMS MIB database (we had to fix one syntax error), then add snmp_community and snmp_access statements to squid.conf. By default, the Squid agent listens to port 3401 but denies all requests.With appropriate read community string and access ACLs, the agent will accept read (but not write) requests.

Squid doesn't support email or pager event notification: administrative features found in commercial products. In fact, Squid doesn't generate SNMP traps. If you want to monitor Squid events, you can do so by writing a monitoring process that runs on the Squid server, or by listening to standard coldStart and interface traps generated by the server's SNMP agent.