Apache Trafficserver

Thursday Jun 27, 2013

Squid binary log with unmapped URL

The Squid log format that we have by default in Traffic Server is a standard format that works well for proxies. It's also well supported by existing log analyzers etc. However, in some cases, where you map many domains to one origin server, the logs produced aren't particularly useful. Why? Because the default Squid log format logs the remapped URL, and not the original client URL. There is of course an easy way to fix this, using our custom log formats.

  1. Disable the original Squid log format, and enable the custom logs.
  2. Create the new Squid log format in logs_xml.config

Details below!

-- Leif

records.config

CONFIG proxy.config.log.logging_enabled INT 3
CONFIG proxy.config.log.custom_logs_enabled INT 1
CONFIG proxy.config.log.squid_log_enabled INT 0 

logs_xml.config

<LogFormat>
  <Name = "squid_unmapped"/>
  <Format = "%<cqtq> %<ttms> %<chi> %<crc>/%<pssc> %<psql> %<cqhm> %<cquuc> %<caun> %<phr>/%<pqsn> %<psct> %<xid>"/>
</LogFormat>

<LogObject>
  <Format = "squid_unmapped"/>
  <Filename = "squid"/>
  <Mode = "binary"/>
</LogObject>


Comments:

This reminded me of https://issues.apache.org/jira/browse/TS-1521 - perhaps it's time we look into adding a <Compression = "true" /> option?

Posted by Igor Galić on June 27, 2013 at 11:49 PM PDT #

Great post about this. I'm surprised to see someone so educated in the matter. Excellent post. I was checking continuously this blog and I'm impressed! Extremely useful information particularly the last part I care for such information a lot.

Posted by trading stocks on September 01, 2013 at 01:08 AM PDT #

Post a Comment:
  • HTML Syntax: NOT allowed

Calendar

Search

Hot Blogs (today's hits)

Tag Cloud

Categories

Feeds

Links

Navigation