trafficserver 8 - Logging Client request (domain)

[Sevan Gelici]

Hello,

I dont know if its a issue or if i do it wrong but logging in trafficserver
8.0 doesnt work well for me. When i add to
"/etc/trafficserver/logging.yaml" the value %<cqtx> its not giving me
output anymore.

In the default logging.yaml i modified this part
logs:
- filename: squid
format: welf
mode: ascii
this works but when i modify as example %<ttms> to %<cqtx> it doesnt work
anymore.

Could someone explain why it doesnt log anymore after giving these value?


-
https://ats-zh.readthedocs.io/en/latest/admin/event-logging-formats.en.html#custom-logging-fields
- http://trafficserver.apache.org/logbuilder/


Kind regards,

Sevan Gelici

[Susan Hinrichs]

Do you have any error messages in diags.log, error.log, or traffic.out?
Our organization doesn't use that field, but perhaps there is a bug in its
support. I'll try to sent that up on a test box today.

Post by Sevan Gelici
Hello,
I dont know if its a issue or if i do it wrong but logging in
trafficserver 8.0 doesnt work well for me. When i add to
"/etc/trafficserver/logging.yaml" the value %<cqtx> its not giving me
output anymore.
In the default logging.yaml i modified this part
- filename: squid
format: welf
mode: ascii
this works but when i modify as example %<ttms> to %<cqtx> it doesnt work
anymore.
Could someone explain why it doesnt log anymore after giving these value?
-
https://ats-zh.readthedocs.io/en/latest/admin/event-logging-formats.en.html#custom-logging-fields
- http://trafficserver.apache.org/logbuilder/
Kind regards,
Sevan Gelici

[Sevan Gelici]

Hi Susan,

/usr/local/var/log/trafficserver/diags.log i cannot find any info related
to that issue. only this
ALERT: exiting with write error from process manager: Broken pipe

The two other files i don't have I think i need to change value for debug
level. Can you let me know about your tests? i will look tomorrow again if
i can find more information.

Kind regards,

Sevan Gelici

Post by Susan Hinrichs
Do you have any error messages in diags.log, error.log, or traffic.out?
Our organization doesn't use that field, but perhaps there is a bug in its
support. I'll try to sent that up on a test box today.

Post by Sevan Gelici
Hello,
I dont know if its a issue or if i do it wrong but logging in
trafficserver 8.0 doesnt work well for me. When i add to
"/etc/trafficserver/logging.yaml" the value %<cqtx> its not giving me
output anymore.
In the default logging.yaml i modified this part
- filename: squid
format: welf
mode: ascii
this works but when i modify as example %<ttms> to %<cqtx> it doesnt work
anymore.
Could someone explain why it doesnt log anymore after giving these value?
-
https://ats-zh.readthedocs.io/en/latest/admin/event-logging-formats.en.html#custom-logging-fields
- http://trafficserver.apache.org/logbuilder/
Kind regards,
Sevan Gelici

[Miles Libbey]

Could you also post your formats definition?

eg
formats:
- format: "id=firewall time=\"%<cqtd> %<cqtt>\" fw=%<phn> pri=6
proto=%<cqus> duration=%<ttmsf> sent=%<psql> rcvd=%<cqhl> src=%<chi>
dst=%<shi> dstname=%<shn> user=%<caun> op=%<cqhm> arg=\"%<cqup>\"
result=%<pssc> ref=\"%<{Referer}cqh>\" agent=\"%<{user-agent}cqh>\"
cache=%<crc>"
name: welf

Post by Sevan Gelici
Hello,
I dont know if its a issue or if i do it wrong but logging in trafficserver 8.0 doesnt work well for me. When i add to "/etc/trafficserver/logging.yaml" the value %<cqtx> its not giving me output anymore.
In the default logging.yaml i modified this part
- filename: squid
format: welf
mode: ascii
this works but when i modify as example %<ttms> to %<cqtx> it doesnt work anymore.
Could someone explain why it doesnt log anymore after giving these value?
- https://ats-zh.readthedocs.io/en/latest/admin/event-logging-formats.en.html#custom-logging-fields
- http://trafficserver.apache.org/logbuilder/
Kind regards,
Sevan Gelici

[Sevan Gelici]

I just did a few tests example

- format: "id=firewall time=\"%<cqtx> %<cqtt>\" fw=%<phn> pri=6
proto=%<cqus> duration=%<ttmsf> sent=%<psql> rcvd=%<cqhl> src=%<chi>
dst=%<shi> dstname=%<shn> user=%<caun> op=%<cqhm> arg=\"%<cqup>\"
result=%<pssc> ref=\"%<{Referer}cqh>\" agent=\"%<{user-agent}cqh>\"
cache=%<crc>"

logs:
- filename: squid
format: welf
mode: ascii

After i put the value cqtx somewhere randomly my squid.log not working.
When i remove cqtx its working.

Post by Miles Libbey
Could you also post your formats definition?
eg
- format: "id=firewall time=\"%<cqtd> %<cqtt>\" fw=%<phn> pri=6
proto=%<cqus> duration=%<ttmsf> sent=%<psql> rcvd=%<cqhl> src=%<chi>
dst=%<shi> dstname=%<shn> user=%<caun> op=%<cqhm> arg=\"%<cqup>\"
result=%<pssc> ref=\"%<{Referer}cqh>\" agent=\"%<{user-agent}cqh>\"
cache=%<crc>"
name: welf

Post by Sevan Gelici
Hello,
I dont know if its a issue or if i do it wrong but logging in

trafficserver 8.0 doesnt work well for me. When i add to
"/etc/trafficserver/logging.yaml" the value %<cqtx> its not giving me
output anymore.

Post by Sevan Gelici
In the default logging.yaml i modified this part
- filename: squid
format: welf
mode: ascii
this works but when i modify as example %<ttms> to %<cqtx> it doesnt

work anymore.

Post by Sevan Gelici
Could someone explain why it doesnt log anymore after giving these value?
-

https://ats-zh.readthedocs.io/en/latest/admin/event-logging-formats.en.html#custom-logging-fields

Post by Sevan Gelici
- http://trafficserver.apache.org/logbuilder/
Kind regards,
Sevan Gelici

[Miles Libbey]

Weird. I just copied these values and put it on one of our 8.0x
machines, and it worked fine -- the remapped url and method appeared
as the time keyword's value. But, we also have/had cqtx logged on the
same machine, so, I suppose it not surprising that it worked for me.

Do you have cqtx working on a 7.1.x node? (And I suppose silly
question, you do have remaps configured right?)

Post by Sevan Gelici
I just did a few tests example
- format: "id=firewall time=\"%<cqtx> %<cqtt>\" fw=%<phn> pri=6
proto=%<cqus> duration=%<ttmsf> sent=%<psql> rcvd=%<cqhl> src=%<chi>
dst=%<shi> dstname=%<shn> user=%<caun> op=%<cqhm> arg=\"%<cqup>\"
result=%<pssc> ref=\"%<{Referer}cqh>\" agent=\"%<{user-agent}cqh>\"
cache=%<crc>"
- filename: squid
format: welf
mode: ascii
After i put the value cqtx somewhere randomly my squid.log not working. When i remove cqtx its working.

Post by Miles Libbey
Could you also post your formats definition?
eg
- format: "id=firewall time=\"%<cqtd> %<cqtt>\" fw=%<phn> pri=6
proto=%<cqus> duration=%<ttmsf> sent=%<psql> rcvd=%<cqhl> src=%<chi>
dst=%<shi> dstname=%<shn> user=%<caun> op=%<cqhm> arg=\"%<cqup>\"
result=%<pssc> ref=\"%<{Referer}cqh>\" agent=\"%<{user-agent}cqh>\"
cache=%<crc>"
name: welf

Post by Sevan Gelici
Hello,
I dont know if its a issue or if i do it wrong but logging in trafficserver 8.0 doesnt work well for me. When i add to "/etc/trafficserver/logging.yaml" the value %<cqtx> its not giving me output anymore.
In the default logging.yaml i modified this part
- filename: squid
format: welf
mode: ascii
this works but when i modify as example %<ttms> to %<cqtx> it doesnt work anymore.
Could someone explain why it doesnt log anymore after giving these value?
- https://ats-zh.readthedocs.io/en/latest/admin/event-logging-formats.en.html#custom-logging-fields
- http://trafficserver.apache.org/logbuilder/
Kind regards,
Sevan Gelici

[Sevan Gelici]

Miles,

Yes remaps are configured. I will need to perform a few more tests and then
i will let u know. I think it will be tomorrow.

---------- Forwarded message ---------
From: Miles Libbey <***@apache.org>
Date: ma 19 nov. 2018 om 20:33
Subject: Re: trafficserver 8 - Logging Client request (domain)
To: <***@trafficserver.apache.org>


Weird. I just copied these values and put it on one of our 8.0x
machines, and it worked fine -- the remapped url and method appeared
as the time keyword's value. But, we also have/had cqtx logged on the
same machine, so, I suppose it not surprising that it worked for me.

Do you have cqtx working on a 7.1.x node? (And I suppose silly
question, you do have remaps configured right?)

Post by Sevan Gelici
I just did a few tests example
- format: "id=firewall time=\"%<cqtx> %<cqtt>\" fw=%<phn> pri=6
proto=%<cqus> duration=%<ttmsf> sent=%<psql> rcvd=%<cqhl> src=%<chi>
dst=%<shi> dstname=%<shn> user=%<caun> op=%<cqhm> arg=\"%<cqup>\"
result=%<pssc> ref=\"%<{Referer}cqh>\" agent=\"%<{user-agent}cqh>\"
cache=%<crc>"
- filename: squid
format: welf
mode: ascii
After i put the value cqtx somewhere randomly my squid.log not working.

When i remove cqtx its working.

Post by Sevan Gelici

Post by Miles Libbey
Could you also post your formats definition?
eg
- format: "id=firewall time=\"%<cqtd> %<cqtt>\" fw=%<phn> pri=6
proto=%<cqus> duration=%<ttmsf> sent=%<psql> rcvd=%<cqhl> src=%<chi>
dst=%<shi> dstname=%<shn> user=%<caun> op=%<cqhm> arg=\"%<cqup>\"
result=%<pssc> ref=\"%<{Referer}cqh>\" agent=\"%<{user-agent}cqh>\"
cache=%<crc>"
name: welf

Post by Sevan Gelici
Hello,
I dont know if its a issue or if i do it wrong but logging in

trafficserver 8.0 doesnt work well for me. When i add to
"/etc/trafficserver/logging.yaml" the value %<cqtx> its not giving me
output anymore.

Post by Sevan Gelici

Post by Miles Libbey

Post by Sevan Gelici
In the default logging.yaml i modified this part
- filename: squid
format: welf
mode: ascii
this works but when i modify as example %<ttms> to %<cqtx> it doesnt work anymore.
Could someone explain why it doesnt log anymore after giving these value?
-

https://ats-zh.readthedocs.io/en/latest/admin/event-logging-formats.en.html#custom-logging-fields

Post by Sevan Gelici

Post by Miles Libbey

Post by Sevan Gelici
- http://trafficserver.apache.org/logbuilder/
Kind regards,
Sevan Gelici