In Reporter, version 9.x, what do the statistics "Cache Bytes" and "Total Bytes" mean?

Products

• Reporter

Issue/Introduction

When you run a Full Log Detail Report, or  any User Behavior  report, you can enable columns called "Cache Bytes" and "Total bytes". 

How are these this statistics calculated?

Which access log fields are used to calculate these statistics in Bluecoat Reporter Reports?

• Total bytes
• Cache Bytes
• Bytes downloaded
• Bytes uploaded.

Resolution

All of these statistics employ the access log fields called cs-bytes and sc-bytes. 

The access log field- cs-bytes- declares the bytes transmitted from the Client to the Secure Gateway (SG), which is the statistic Bytes uploaded.  The access log field- sc-bytes- declares the bytes transmitted from the  SG to the Client, which is the statistic Bytes downloaded. Total Bytes is simply the two fields added together for any one user/client IP pair.

The Cache Bytes statistic employs one more field in the access log to determine if the bytes received was cached or not; the s-action field.  If this field contains the text "hit" anywhere, such as TCP_HIT, the bytes downloaded for any user/client IP pair will be added up, as each row in the access log is processed, and declared as "Cache Bytes".  The Cache bytes statistic  can be used to compare the relative gains made, because of Cached data, on each user/client ip pair.

 NOTE1: For complete list of what fields are expected in the SG access log , see 000021974