Re: [squid-users] Force ASCII encoding for access.log fields?

>> [serverIP],[clientIP],
>> 4012,692,498,GET,200,º^_x°*,username,20/Jun/2014:00:06:36
>
> The log format you used does not match this log line. The format produces:
>
> [squid-listening-IP],[clientIP],
> 4012,692,498,GET,200,º^_x°*,username,20/Jun/2014:00:06:36

Thanks for the correction. To expand on that point, on some of our
proxies, we have more than one IP being serviced by a single daemon.
Recording which IP received the traffic is essential to proper accounting
(e.g. FreeRADIUS).

> URL-encoding is the %xx character encoding, it can be (and is) applied
> to anything which can legitimately contain non-ASCII characters or ASCII
> special characters. Content-Type header is not one of those places.
>
> You can use the '#' format modifier to URL-encode that %mt field
> explicitly. Like so: %#mt

Amos, thank you so much for sharing this. I plan to try it as soon as ...

> If you will share the exact Squid version you are using I would also
> like to check the code to see if the mt code is being correctly setup,
> that log entry looks a bit like random memory being displayed as if it
> were text.

... as soon as I finish upgrading from squid-3.1.10-16.el6 to
3.1.10-20.el6, both of which are packaged and delivered via the CentOS
repo :). Totally ashamed I didn't even notice there was an update
available before posting. I plan to schedule an outage to patch and I'll
report back with my findings. If you suspect random memory chunks are
being written to the file as a consequence of this outdated version of
Squid, and even the more recent version I plan to move to does not address
this condition, feel free to share.

This particular proxy is pretty active. We're averaging between 800,000 -
1.2M lines in the access log per day. The proxy is non-caching, running
with 512MB RAM and 1GB swap (don't ask).

More soon,
MD
Received on Sat Jun 28 2014 - 05:46:53 MDT