Chapter 13. Log Files
Log files are the primary sources of persistent information about Squid's operation. In other words, they provide a record of what Squid has been doing. This includes URIs requested by users, objects that have been saved to disk, and various warnings and errors. When Squid appears to be malfunctioning, you'll want to check the log files first. By the end of this chapter, you'll know how to interpret and manage all of Squid's various log files.
Depending on your configuration, Squid maintains, at most, seven log files. The three primary files are: cache.log, access.log, and store.log. Two optional log files, useragent.log and referer.log, are similar to access.log but contain additional information. I'll also talk about the swap.state and netdb_state files. These are databases, used by Squid when it restarts.
Note that the filenames, such as access.log, are the default values. You can change most of the log file names with various squid.conf directives.
The following list contains a brief description of each log file:
- cache.log
-
This log file contains human-oriented, informational messages about Squid's operation. The filename is defined by the cache_log directive. Under normal conditions, the file grows by about 10-100 KB per day.
- access.log
-
This log file contains an entry for every HTTP and (optionally) ICP transaction made by Squid's clients. The filename is defined by the cache_access_log directive. It grows at a rate of 100-200 bytes per transaction.
- store.log
-
This log file contains low-level information about objects that enter and leave the cache. The filename is defined by the cache_store_log directive. It grows at a rate of about 150 bytes per transaction.
- referer.log
-
This optional log file contains HTTP Referer[1] headers for each client request. You must enable referer logging with the enable-referer-log option when running ./configure. The filename is defined by the referer_log directive. It grows at a rate of about 80 bytes per transaction.
[1] No, this isn't a typo. "Referer" has been historically misspelled by HTTP developers.
- useragent.log
-
This optional log file contains HTTP User-Agent headers for each client request. You must enable user-agent logging with the enable-useragent-log option when running ./configure. The filename is defined by the useragent_log directive. It grows at a rate of about 75 bytes per transaction.
- swap.state
-
These files contain internal metadata about the objects stored on disk. Squid uses them to reconstruct the cache upon startup. By default, they are located in the cache_dir directories. However, you can change the location with the cache_swap_log directive. They grow at a rate of 100 bytes per cache miss.
- netdb_state
-
This file holds the contents of the Network Measurement Database (see Section 10.5). It is always located in the first cache_dir directory. Its size is determined by the netdb_high value.
If Squid receives an error while writing a log file, it doesn't silently continue. Instead, it exits with a fatal error message to get your attention. Make sure that you periodically rotate the log files, as described in Section 13.7, to reduce the possibility of filling your disks. For the same reason, I also recommend placing your log files on a partition separate from any of your cache directories.
