Reff ::
http://wiki.squid-cache.org/SquidFaq/SquidLogsstore.log
The store.log file covers the objects currently kept on disk or removed ones. As a kind of transaction log it is usually used for debugging purposes. A definitive statement, whether an object resides on your disks is only possible after analyzing the complete log file. The release (deletion) of an object may be logged at a later time than the swap out (save to disk).
The store.log file may be of interest to log file analysis which looks into the objects on your disks and the time they spend there, or how many times a hot object was accessed. The latter may be covered by another log file, too. With knowledge of the cache_dir configuration option, this log file allows for a URL to filename mapping without recursing your cache disks. However, the Squid developers recommend to treat store.log primarily as a debug file, and so should you, unless you know what you are doing.
The print format for a store log entry (one line) consists of thirteen space-separated columns, compare with the storeLog() function in file src/store_log.c:
9ld.%03d %-7s %02d %08X %s %4d %9ld %9ld %9ld %s %ld/%ld %s %stime The timestamp when the line was logged in UTC with a millisecond fraction.
action The action the object was sumitted to, compare with src/store_log.c:
CREATE Seems to be unused.
RELEASE The object was removed from the cache (see also file number below).
SWAPOUT The object was saved to disk.
SWAPIN The object existed on disk and was read into memory.
dir number The cache_dir number this object was stored into, starting at 0 for your first cache_dir line.
file number The file number for the object storage file. Please note that the path to this file is calculated according to your cache_dir configuration. A file number of FFFFFFFF indicates "memory only" objects. Any action code for such a file number refers to an object which existed only in memory, not on disk. For instance, if a RELEASE code was logged with file number FFFFFFFF, the object existed only in memory, and was released from memory.
hash The hash value used to index the object in the cache. Squid currently uses MD5 for the hash value.
status The HTTP reply status code.
datehdr The value of the HTTP Date reply header.
lastmod The value of the HTTP Last-Modified reply header.
expires The value of the HTTP "Expires: " reply header.
type The HTTP Content-Type major value, or "unknown" if it cannot be determined.
sizes This column consists of two slash separated fields:
The advertised content length from the HTTP Content-Length reply header.
The size actually read.
If the advertised (or expected) length is missing, it will be set to zero. If the advertised length is not zero, but not equal to the real length, the object will be realeased from the cache.
method The request method for the object, e.g. GET.
key The key to the object, usually the URL.
The datehdr, lastmod, and expires values are all expressed in UTC seconds. The actual values are parsed from the HTTP reply headers. An unparsable header is represented by a value of -1, and a missing header is represented by a value of -2.