Squid_ The Definitive Guide - Duane Wessels [135]
IPcache Entries: 10034
IPcache Requests: 1066445
IPcache Hits: 817880
IPcache Negative Hits: 6846
IPcache Misses: 200497
In this example, you can see that the IP cache contains slightly more than 10,000 entries (hostnames). Since Squid was started, there have been 1,066,445 name-to-address requests, 817,880 of which were cache hits. This is a cache hit ratio of 77%. An IP cache negative hit occurs when Squid receives a subsequent request for a hostname that it recently failed to resolve. Rather than retry the DNS lookup immediately, Squid assumes it will fail again and returns an error message to the user.
Following these brief statistics, you'll see a long list of the IP cache contents. For each hostname in the cache, Squid prints six fields:
The hostname itself
Flags: N for negatively cached entries and H if the addresses came from the local hosts file, rather than the DNS
The number of seconds since the hostname was last requested or used
The number of seconds until the cached entry expires
The number of IP addresses known for the host, and, in parentheses, the number of BAD addresses
A list of IP addresses and whether each is OK or BAD
Here is a short sample (formatted to fit the page):
Hostname Flg lstref TTL N
ads.x10.com 9 110 1( 0) 63.211.210.20-OK
us.rd.yahoo.com 640 -340 4( 0) 216.136.232.150-OK
216.136.232.147-OK
216.136.232.149-OK
216.136.232.148-OK
www.movielodge.com 7143 -2161 1( 0) 66.250.223.36-OK
shell.windows.com 10865 -7447 2( 1) 207.46.226.48-BAD
207.46.248.237-OK
www.surf3.net 126810 -40415 1( 0) 212.74.112.95-OK
The list is sorted by the time since last reference. Recently referenced names are at the top of the list, and unused (about to be removed) names are at the bottom.
IP addresses are marked OK by default. An address is marked BAD when Squid receives an error or timeout during a TCP connection attempt. Subsequent IP cache requests don't return BAD addresses. If all the host's addresses become BAD, Squid resets them all back to OK.
fqdncache: FQDN Cache Stats and Contents
The FQDN cache is similar to the IP cache, except that it stores address-to-hostname lookups. Another difference is that the FQDN cache doesn't mark hostnames as OK or BAD.
Your FQDN cache may be empty, unless you enable the log_fqdn directive, use domain-based ACLs (such as srcdomain, dstdomain, srcdom_regex, and dstdom_regex), or use a redirector.
idns: Internal DNS Statistics
Squid contains an internal DNS client implementation, which is enabled by default. Disabling internal DNS with the —disable-internal-dns option also disables this page. Here is some sample output:
Internal DNS Statistics:
The Queue:
DELAY SINCE
ID SIZE SENDS FIRST SEND LAST SEND
------ ---- ----- ---------- ---------
001876 44 1 0.010 0.010
001875 44 1 0.010 0.010
Nameservers:
IP ADDRESS # QUERIES # REPLIES
--------------- --------- ---------
192.168.19.124 4889 4844
192.168.19.190 91 51
192.168.10.2 73 39
Rcode Matrix:
RCODE ATTEMPT1 ATTEMPT2 ATTEMPT3
0 6149 4 2
1 0 0 0
2 38 34 32
3 0 0 0
4 0 0 0
5 0 0 0
The Internal DNS page contains three tables. First, you'll see the queue of unanswered queries. Unfortunately, you can't see the contents of the query (the hostname or IP address). Instead, Squid prints the ID, size, number of transmissions, and elapsed times for each query. You should see relatively few queries in the queue. If you see a lot relative to your total traffic rate, make sure your DNS servers are functioning properly.
The second table (Nameservers) shows how many queries have been sent to, and replies received from, each DNS server. Squid always queries the first server in the list first. Second (and third, etc.) servers are queried only when the previous server times out for a given query. If you see zero replies from the first address, make sure a server is actually running at that address.
Finally, you'll see a table of DNS response codes versus number of attempts. The cell for response code 0 and ATTEMPT1 should have the highest count.