Re: [squid-users] logging changes 2.6 -> 2.7

Ah thanks for the pointer, Mark. I'll take a look at backporting the
debian squeeze (testing) version back to lenny.

Ross

-- 
Ross Reedstrom, Ph.D.                                 reedstrm_at_rice.edu
Systems Engineer & Admin, Research Scientist        phone: 713-348-6166
The Connexions Project      http://cnx.org            fax: 713-348-3665
Rice University MS-375, Houston, TX 77005
GPG Key fingerprint = F023 82C8 9B0E 2CC6 0D8E  F888 D3AE 810E 88F0 BEDE
On Wed, Apr 22, 2009 at 11:50:09AM +1000, Mark Nottingham wrote:
> That was fixed in STABLE4;
>   http://www.squid-cache.org/Versions/v2/2.7/squid-2.7.STABLE6-RELEASENOTES.html#s7
> 
> See also:
>   http://www.squid-cache.org/bugs/show_bug.cgi?id=2406
> 
> Cheers,
> 
> 
> On 22/04/2009, at 5:46 AM, Ross J. Reedstrom wrote:
> 
> >Hi all -
> >Recently upgraded a proxy-accelerator setup to using 2.7 (Debian
> >2.7.STABLE3-4.1, specifically) from 2.6 (2.6.20-1~bpo40+1). In this
> >setup, I'm using an external rewriter script to add virtual rooting  
> >bits
> >to the requested URL. (It's a zope system, using ther  
> >VirtualHostMonster
> >rewriter, like so:
> >Incoming request:
> >GET http://example.com/someimage.gif
> >
> >Rewritten to:
> >
> >GET 
> >http://example.com/VirtualHostBase/http/example.com:80/somepath/VirtualHostRoot/someimage.gif
> >
> >These are then farmed out to multiple cache_peer origin servers.
> >
> >The change I'm seeing is that the access.log using a custom format
> >line:
> >
> >logformat custom %ts.%03tu %6tr %>a %ui %un [%tl] "%rm %ru HTTP/%rv"  
> >%Hs %<st "%{Referer}>h" "%{User-Agent}>h" %Ss:%Sh/%<A %%{X-Forwarded- 
> >For}>h
> >
> >The change is that in 2.6 %ru logged the requested URL as seen on the
> >wire. In 2.7, we get the rewritten URL.
> >
> >Is this intentional? Is there a way around it? Since referer (sic) url
> >is not similarly rewritten, it gives log analysis software (that
> >attempts  to determine click-traces and page views) fits. I can
> >post-process my logs, but I'd rather fix them at generation time. I  
> >can
> >understand the need to have the rewritten version available: just  
> >not at
> >the cost of missing what was actually on the wire that Squid read.
> >
> >Ross
> >-- 
> >Ross Reedstrom, Ph.D.                                  
> >reedstrm_at_rice.edu
> >Systems Engineer & Admin, Research Scientist        phone:  
> >713-348-6166
> >The Connexions Project      http://cnx.org            fax:  
> >713-348-3665
> >Rice University MS-375, Houston, TX 77005
> >GPG Key fingerprint = F023 82C8 9B0E 2CC6 0D8E  F888 D3AE 810E 88F0  
> >BEDE
> 
> --
> Mark Nottingham       mnot_at_yahoo-inc.com
>