Re: [squid-users] logging changes 2.6 -> 2.7

That was fixed in STABLE4;
   http://www.squid-cache.org/Versions/v2/2.7/squid-2.7.STABLE6-RELEASENOTES.html#s7

See also:
   http://www.squid-cache.org/bugs/show_bug.cgi?id=2406

Cheers,

On 22/04/2009, at 5:46 AM, Ross J. Reedstrom wrote:

> Hi all -
> Recently upgraded a proxy-accelerator setup to using 2.7 (Debian
> 2.7.STABLE3-4.1, specifically) from 2.6 (2.6.20-1~bpo40+1). In this
> setup, I'm using an external rewriter script to add virtual rooting
> bits
> to the requested URL. (It's a zope system, using ther
> VirtualHostMonster
> rewriter, like so:
> Incoming request:
> GET http://example.com/someimage.gif
>
> Rewritten to:
>
> GET http://example.com/VirtualHostBase/http/example.com:80/somepath/VirtualHostRoot/someimage.gif
>
> These are then farmed out to multiple cache_peer origin servers.
>
> The change I'm seeing is that the access.log using a custom format
> line:
>
> logformat custom %ts.%03tu %6tr %>a %ui %un [%tl] "%rm %ru HTTP/%rv"
> %Hs %<st "%{Referer}>h" "%{User-Agent}>h" %Ss:%Sh/%<A %%{X-Forwarded-
> For}>h
>
> The change is that in 2.6 %ru logged the requested URL as seen on the
> wire. In 2.7, we get the rewritten URL.
>
> Is this intentional? Is there a way around it? Since referer (sic) url
> is not similarly rewritten, it gives log analysis software (that
> attempts to determine click-traces and page views) fits. I can
> post-process my logs, but I'd rather fix them at generation time. I
> can
> understand the need to have the rewritten version available: just
> not at
> the cost of missing what was actually on the wire that Squid read.
>
> Ross
> --
> Ross Reedstrom, Ph.D.
> reedstrm_at_rice.edu
> Systems Engineer & Admin, Research Scientist phone:
> 713-348-6166
> The Connexions Project http://cnx.org fax:
> 713-348-3665
> Rice University MS-375, Houston, TX 77005
> GPG Key fingerprint = F023 82C8 9B0E 2CC6 0D8E F888 D3AE 810E 88F0
> BEDE

--
Mark Nottingham       mnot_at_yahoo-inc.com