Squid log format

Revision as of 12:59, 9 November 2010

The Wikimedia squid log format is a custom format which uses the logformat directive available in Squid 2.6. The %sn format code is our extension. [1] For more information about our squid log setup, see Squid logging.

$hostname %sn %{%Y-%m-%dT%H:%M:%S}tg.%03tu %tr %>a %Ss/%03Hs %<st %rm %ru %Sh/%<A %mt %{Referer}>h %{X-Forwarded-For}>h %{User-Agent}>h

Field indexes when space-separated:

1. Hostname of the squid
2. Sequence number
3. The current time in ISO 8601 format (plus milliseconds), according to the squid server's clock.
4. Request service time in ms
5. Client IP
6. Squid request status, HTTP status code
7. Reply size including HTTP headers
8. Request method (GET/POST etc)
9. URL
10. Squid hierarchy status, peer IP
11. MIME content type
12. Referer header
13. X-Forwarded-For header
14. User-Agent header

Sample line, with the client IP address replaced with 1.2.3.4 to protect the innocent:

sq18.wikimedia.org 1715898 1169499304.066 0 1.2.3.4 TCP_MEM_HIT/200 13208 GET http://en.wikipedia.org/wiki/Main_Page NONE/- text/html - - Mozilla/4.0%20(compatible;%20MSIE%206.0;%20Windows%20NT%205.1;%20.NET%20CLR%201.1.4322)

Note: Make sure the packet ends in an endline \n