[squid-users] headers say HIT, logs say MISS, payload is truncated...

Hi. I'm seeing periodic odd behavior from one of our squid2.6 stable18
(and stable22) boxes during the peak hours when the squid is busiest,
but not off-peak, and no other signs of a capacity limit except the
occasional queue congestion warning. About 15% of the requests
for one url we're externally monitoring (presumedly others) come
back with the following headers:

Content-Length: 140493
Content-Type: text/html; charset=utf-8
Age: 1
X-Cache: HIT from oak-tp-squid008

but it only receives 33075 bytes of the payload,
which really is 140493, then the client times out.
In the squid access log:

2008/10/24-14:37:06-0700(PDT) 45626 10.17.2.26 TCP_MISS/200 33075 GET ....
(logformat foo %{%Y/%m/%d-%H:%M:%S%z(%Z)}tl %6tr %>a %Ss/%03Hs %<st %rm)

I am certain that log msg corresponds to that request,
because of unique ids in a custom header.

We are using collapsed_forwarding here. I haven't tried disabling it yet.

Unfortunately, since the problem appears to be load-related, I've been
unable to reproduce for a tcpdump or running squid in debug thus far.

Any ideas how this could be happening?

-neil
Received on Fri Oct 24 2008 - 22:44:15 MDT