Squid_ The Definitive Guide - Duane Wessels [116]
Log files are the primary sources of persistent information about Squid's operation. In other words, they provide a record of what Squid has been doing. This includes URIs requested by users, objects that have been saved to disk, and various warnings and errors. When Squid appears to be malfunctioning, you'll want to check the log files first. By the end of this chapter, you'll know how to interpret and manage all of Squid's various log files.
Depending on your configuration, Squid maintains, at most, seven log files. The three primary files are: cache.log, access.log, and store.log. Two optional log files, useragent.log and referer.log, are similar to access.log but contain additional information. I'll also talk about the swap.state and netdb_state files. These are databases, used by Squid when it restarts.
Note that the filenames, such as access.log, are the default values. You can change most of the log file names with various squid.conf directives.
The following list contains a brief description of each log file:
cache.log
This log file contains human-oriented, informational messages about Squid's operation. The filename is defined by the cache_log directive. Under normal conditions, the file grows by about 10-100 KB per day.
access.log
This log file contains an entry for every HTTP and (optionally) ICP transaction made by Squid's clients. The filename is defined by the cache_access_log directive. It grows at a rate of 100-200 bytes per transaction.
store.log
This log file contains low-level information about objects that enter and leave the cache. The filename is defined by the cache_store_log directive. It grows at a rate of about 150 bytes per transaction.
referer.log
This optional log file contains HTTP Referer [1] headers for each client request. You must enable referer logging with the —enable-referer-log option when running ./configure. The filename is defined by the referer_log directive. It grows at a rate of about 80 bytes per transaction.
useragent.log
This optional log file contains HTTP User-Agent headers for each client request. You must enable user-agent logging with the —enable-useragent-log option when running ./configure. The filename is defined by the useragent_log directive. It grows at a rate of about 75 bytes per transaction.
swap.state
These files contain internal metadata about the objects stored on disk. Squid uses them to reconstruct the cache upon startup. By default, they are located in the cache_dir directories. However, you can change the location with the cache_swap_log directive. They grow at a rate of 100 bytes per cache miss.
netdb_state
This file holds the contents of the Network Measurement Database (see Section 10.5). It is always located in the first cache_dir directory. Its size is determined by the netdb_high value.
If Squid receives an error while writing a log file, it doesn't silently continue. Instead, it exits with a fatal error message to get your attention. Make sure that you periodically rotate the log files, as described in Section 13.7, to reduce the possibility of filling your disks. For the same reason, I also recommend placing your log files on a partition separate from any of your cache directories.
cache.log
cache.log contains various messages such as information about Squid's configuration, warnings about possible performance problems, and serious errors. Here is some sample cache.log output:
2003/09/29 12:09:45| Starting Squid Cache version 2.5.STABLE4 for i386-
unknown-freebsd4.8...
2003/09/29 12:09:45| Process ID 18990
2003/09/29 12:09:45| With 1064 file descriptors available
2003/09/29 12:09:45| Performing DNS Tests...
2003/09/29 12:09:45| Successful DNS name lookup tests...
2003/09/29 12:09:45| DNS Socket created at 0.0.0.0, port 1154, FD 5
2003/09/29 12:09:45| Adding nameserver 24.221.192.5 from /etc/resolv.conf
2003/09/29 12:09:45| Adding nameserver 24.221.208.5 from /etc/resolv.conf
2003/09/29 12:09:45| helperOpenServers: Starting 5 'redirector.pl' processes
2003/09/29 12:09:45| Unlinkd pipe opened