It seems to me Sarg is counting TCP_TUNNEL/200 lines as cache hits. Haven't been able to figure out where that logic(cache hit vs cache miss) is yet.
The problem is in line 328 of report.c (292 in the release).
The line reads:

            if(strstr(crc2,"MISS") != 0)
                oucache+=accbytes;
            else
                incache+=accbytes;

I made a simple change that I have tested from the 2.3.10 release

            if(strstr(crc2,"MISS") != 0|| strstr(crc2,"TCP_TUNNEL") != 0)
                oucache+=accbytes;
            else
                incache+=accbytes;

Hope it helps.

 

Last edit: Francisco Venancio 2016-07-31