How to know if Squid Proxy is doing the Cache correctly

I wanted to test if the Clients attached to a Squid Server are actually using the Cache data instead of going directly to the internet and retrieving the data. I have configured all clients browsers to read the Server:Port from the Squid Server (Which is 10.42.0.1:3128). So how do I know if they are retrieving the information from the Cache or the Internet.

I asked since a quick "test" gave me the same speed when loading several pages that had many images on them. Same images and not ads that change on every visit.

What ways can I use to check if they are using the Cache?

I ran the following: sudo tail -f /var/log/squid3/access.log and got several lines that kept on scrolling:

1374553166.136    929 185.168.101.131 TCP_MISS/200 28198 GET http://www.amazon.de/gp/offer-listing/B000NOIW62/ref=sr_1_1_olp? - DIRECT/178.236.7.219 text/html

They had a TCP_MISS/200 and at the end had a DIRECT as the example above. This happened while I had all computers in the LAN turned off. When I tried to used one I got the following doing a sudo tail -f /var/log/squid3/access.log | grep HIT

1374553387.488      0 10.42.0.14 TCP_IMS_HIT/304 278 GET http://g-ecx.images-amazon.com/images/G/01/da/creatives/sn130.png - NONE/- image/png

So it shows as TCP_IMS_HIT/304 and at the end it shows a NONE

So what does the TCP_MISS, DIRECT, TCP_IMS_HIT and NONE mean?

Is the cache working?

in a terminal, on the server running squid, run the command

tail -f /var/log/squid3/access.log

then watch it as a user visits web pages. If lots of lines scroll up the screen whenever they click on something then they are using the proxy server. If the squid log file is not located there have a look in /etc/squid for the location of the log file.

To quit out of the above command press ctrl+c

To see if it is actually caching stuff and being useful there should be some lines that say it is a HIT. To see a full description of the log file contents see the squid wiki. Note that cache HITs will not be as frequent as you'd like due to an individual user's web browser already caching stuff locally. You will get the most hits when multiple users request the same pages before that info is dropped from the cache.

Such as when an allstaff email goes out saying "check this site out..."

• TCP_MISS/200 means that the requested document was not in the cache but it could fetch it OK from the web server. The direct at the end says that the file was fetched from the webserver.
• TCP_IMS_HIT/304 means that the client asked if the file has changed, and squid checked its date/time on the webserver and found it had not changed, so it gave a copy of the file to the client out of its local cache.

So yes your squid is being used and is working as a cache.