Kode dalam access.log squid, Proxy

, , a Comment

Bagi anda yang bekerja sebagai seorang administrator jaringan baik di kantor, warnet maupun personal, pasti tidak asing lagi dengan proxy, squid, dan ubuntu dalam mengelola jaringan anda.

access.log squid
Dibawah ini saya cuplikkan dari Wiki Squid  beberapa kode yang biasa muncul ketika kita mengakses squid.log dari proxy yang kita bangun.


TCP Permintaan akses yang melalui port HTTP (biasanya port 3128)
UDP Requests on the ICP port (usually 3130) or HTCP port (usually 4128). If ICP logging was disabled using the log_icp_queries option, no ICP replies will be logged.
NONE
Squid delivered an unusual response or no response at all. Seen with cachemgr requests and errors, usually when the transaction fails before being classified into one of the above outcomes. Also seen with responses to CONNECT requests. 

CLIENT The client request placed limits affecting the response. Usually seen with client issued a "no-cache", or analogous cache control command along with the request. Thus, the cache has to validate the object.
IMS The client sent a revalidation (conditional) request.
ASYNC The request was generated internally by Squid. Usually this is background fetches for cache information exchanges, background revalidation from stale-while-revalidate cache controls, or ESI sub-objects being loaded.
SWAPFAIL The object was believed to be in the cache, but could not be accessed. A new copy was requested from the server.
REFRESH A revalidation (conditional) request was sent to the server.
NEGATIVE Only seen on HIT responses. Indicating the response was a cached error response. e.g. "404 not found"
STALE The object was cached and served stale. This is usually caused by stale-while-revalidate or stale-if-error cache controls.
OFFLINE The requested object was retrieved from the cache during offline_mode. The offline mode never validates any object.
INVALID An invalid request was received. An error response was delivered indicating what the problem was.
FAIL Only seen on REFRESH to indicate the revalidation request failed. The response object may be the server provided      network error or the stale object which was being revalidated depending on stale-if-error cache control.
MODIFIED Only seen on REFRESH responses to indicate revalidation produced a new modified object.
UNMODIFIED Only seen on REFRESH responses to indicate revalidation produced a 304 (Not Modified) status. Which was relayed to the client.
REDIRECT Squid generated an HTTP redirect response to this request. Only on Squid-3.2+ or Squid built with -DLOG_TCP_REDIRECTS compiler flag.
HIT The response object delivered was the local cache object.
MEM Additional tag indicating the response object came from memory cache, avoiding disk accesses. Only seen on HIT responses.
MISS The response object delivered was the network response object.
DENIED The request was denied by access controls.
NOFETCH A ICP specific type. Indicating service is alive, but not to be used for this request. Sent during "-Y" startup, or during frequent failures, a cache in hit only mode will return either UDP_HIT or UDP_MISS_NOFETCH. Neighbours will thus only fetch hits.
ABORTED The response was not completed due to the connection being aborted (usually by the client).
TIMEOUT The response was not completed due to a connection timeout.

Status
Description
RFC(s)
000
Used mostly with UDP traffic.
N/A
 
Informational
 
100
Continue
101
Switching Protocols
102
Processing
 
Successful Transaction
 
200
OK
201
Created
202
Accepted
203
Non-Authoritative Information
204
No Content
205
Reset Content
206
Partial Content
207
Multi Status
 
Redirection
 
300
Multiple Choices
301
Moved Permanently
302
Moved Temporarily
303
See Other
304
Not Modified
305
Use Proxy
307
Temporary Redirect
 
Client Error
 
400
Bad Request
401
Unauthorized
402
Payment Required
403
Forbidden
404
Not Found
405
Method Not Allowed
406
Not Acceptable
407
Proxy Authentication Required
408
Request Timeout
409
Conflict
410
Gone
411
Length Required
412
Precondition Failed
413
Request Entity Too Large
414
Request URI Too Large
415
Unsupported Media Type
416
Request Range Not Satisfiable
417
Expectation Failed
422
Unprocessable Entity
424
Locked
(broken WebDAV implementations??)
424
Failed Dependency
433
Unprocessable Entity
 
 
Server Errors
 
500
Internal Server Error
501
Not Implemented
502
Bad Gateway
503
Service Unavailable
504
Gateway Timeout
505
HTTP Version Not Supported
507
Insufficient Storage
     
 
Broken Server Software
 
600
Squid: header parsing error
 
601
Squid: header size overflow detected while parsing
 
601
roundcube: software configuration error
 
603
roundcube: invalid authorization
 

Kode Hirarki :
 
NONE           = For TCP HIT, TCP failures, cachemgr requests and all UDP requests,  there is no hierarchy information.
DIRECT         = The object was fetched from the origin server.
SIBLING_HIT = The object was fetched from a sibling cache which replied with UDP_HIT.
PARENT_HIT = The object was requested from a parent cache which replied with UDP_HIT.
DEFAULT_PARENT = No ICP queries were sent. This parent was chosen because it was marked "default" in the config file.
SINGLE_PARENT = The object was requested from the only parent appropriate for the given URL.
FIRST_UP_PARENT = The object was fetched from the first parent in the list of parents.
NO_PARENT_DIRECT = The object was fetched from the origin server, because no parents existed for the given URL.
FIRST_PARENT_MISS = The object was fetched from the parent with the fastest (possibly weighted) round trip time.
CLOSEST_PARENT_MISS = This parent was chosen, because it included the the lowest RTT measurement to the origin server. See also the closest-only peer configuration option.
CLOSEST_PARENT = The parent selection was based on our own RTT measurements.
CLOSEST_DIRECT = Our own RTT measurements returned a shorter time than any parent.
NO_DIRECT_FAIL = The object could not be requested because of a firewall configuration, see also never_direct and related material, and no parents were available.
SOURCE_FASTEST = The origin site was chosen, because the source ping arrived fastest.
ROUNDROBIN_PARENT = No ICP replies were received from any parent. The parent was chosen, because it was marked for round robin in the config file and had the lowest usage count.
CACHE_DIGEST_HIT = The peer was chosen, because the cache digest predicted a hit. This option was later replaced in order to distinguish between parents and siblings.
CD_PARENT_HIT = The parent was chosen, because the cache digest predicted a hit.
CD_SIBLING_HIT = The sibling was chosen, because the cache digest predicted a hit.
NO_CACHE_DIGEST_DIRECT = This output seems to be unused?
CARP = The peer was selected by CARP.
PINNED = The server connection was pinned by NTLM or Negotiate authentication requirements.
ORIGINAL_DST = The server connection was limited to the client provided destination IP. This only occurs on interception proxies when Host security is enabled.
ANY_PARENT = part of src/peer_select.c:hier_strings[].
INVALID CODE = part of src/peer_select.c:hier_strings[].
             Sumber : Wiki Squid
Mohon Maaf, untuk copy paste silahkan sertakan link aslinya atau silahkan modifikasi dengan tulisan anda sendiri. Saya harap anda bisa menghargai ide sesama blogger. Terima Kasih.
Tinta F1
0 Comment :
Kode dalam access.log squid, Proxy