Quick abort & logging

Currently we have quick abort disabled (as is the default for Squid 2.0p2
which we have).

Recently we had a lot more traffic in than out to a Web cache (by a factor of
3) for hours. Other logging indicated it was an external Web server - a sex
site with video streams perhaps - judging by URL.

I believe the result of this were that Squid kept fetching large amounts of
data even if the users disconnected - our fault I guess for not having quick
abort enabled.

However Squid does not log this - the access log only apparently logged the
data transfered to the user (only 0.5 megabytes or so). Also no user aborts
are logged - as was the case with Squid 1.1.X - in cache.log

I did find some large objects from scanning the store log - which I presume
got binned as soon as they were collected as we have a maximum object size of
32Mb.

I guess what I would like is (or to know):

a) nice to have logged what Squid got in addition to what the users got.

b) could the "lets keep going facility" (ie not Quick abort) know that there
is no user and the object is bigger than the maximum allowed and therefore it
is futile to keep going.

c) How do the quick abort parameters behave when the lenght is unknown?

d) What do others recommend - always quick abort, never or something in
between?

-- 
-----------------------------------------------------------------------------
| Peter Polkinghorne, Computer Centre, Brunel University, Uxbridge, UB8 3PH,|
| Peter.Polkinghorne@brunel.ac.uk   +44 1895 274000 x2561       UK          |
-----------------------------------------------------------------------------