We used three tools to monitor Squid: Cache Manager, an SNMP NMS and logfile post-processors. We've already discussed Cache Manager (see Managing Squid and Tuning Cache Efficiency). We've also shown how to disable and rotate the access.log. Squid's access.log uses the native log format adopted by most commercial products. An emulate_httpd_log option is available to select the CERN format instead. Squid's native log format is described by the Squid FAQ, including explanation of the HTTP and ICP status codes that accompany each log entry.

Many logfile post-processors are available which understand Squid's native log format. Some basic Perl scripts are provided by NLANR. For example, run access_extract on a log file to generate a raw summary, then cat the result to access_summary to produce the report shown in part here. Another popular tool which produces text or html reports from Squid logs is Calamaris. For more info on these and other post-processors, visit the Squid home page and follow links to software.

We used CastleRock's SNMPc MIB Browser to query Squid's SNMP agent. Squid source includes an enterprise MIB. To use SNMP, compile Squid with SNMP enabled, add etc/mib.txt to your NMS MIB database (we had to fix one syntax error), then add snmp_community and snmp_access statements to squid.conf. By default, the Squid agent listens to port 3401 but denies all requests. With appropriate read community string and access ACLs, the agent will accept read (but not write) requests.

The Squid MIB allows an NMS to query software version, memory and disk allocations, as well as a healthy set of protocol, network, ICP peer and client counters. In fact, this MIB provides the platform necessary to monitor traffic using MRTG. The Squid agent is independent of any other SNMP agent you might run on your Squid server (for example, providing access to MIB-II objects).

Squid doesn't support e-mail or pager event notification, administrative features found in commercial products. In fact, Squid doesn't generate SNMP traps. If you want to monitor Squid events, you can do so by writing a monitoring process that runs on the Squid server, or by listening to standard coldStart and interface traps generated by the server's SNMP agent.

Next: Maintenance and Support/Final Words »