You are looking at the Access Logs from the Edge SWG (ProxySG) or Advanced Secure Gateway (ASG) and you want to understand what the cache codes mean.

Cache hit codes are usually composed of two or three sections.

The first part of the code states the protocol used to request the object. It is usually TCP, and sometimes UDP. 

The last part usually indicates whether it is a hit or a miss. A cache 'hit' means that the Edge SWG appliance had the object in cache and did not download the object from the origin content server (OCS). A 'miss' means that the object was not in cache so the Edge SWG appliance had to download it

In some cases, "NC" appears between these sections, which means the object was non-cacheable. When the appliance has the object in cache but determines that it is stale (and thus needs to be downloaded again) after checking with the source, the result is a "TCP_REFRESH_MISS" code.

Additionally, sometimes "RST" appears at the end of the status code. This indicates that the client connection was reset. Common causes are a client timeout, web server-based reset (which is propagated to the client), or a virus found during virus scanning which resulted in a "Virus Found" alert sent to the client.

Some examples of common cache results:

• TCP_MISS - Object not found in cache, downloaded from the OCS.
• TCP_HIT - Object found in cache.
• TCP_NC_MISS - The request was made for an object that can't be cached.
• TCP_REFRESH_MISS - Appliance had the object in cache, but a check with the OCS (GET with the If-modified-since) indicated that the object was stale. Object was downloaded from the OCS and the new object was placed in cache.

For a complete list of "action" field values please check the ProxySG Log Fields and Substitutions