I'm seeing just a few weird values in the messages from Traffic Server log collation clients. Here is an example message, a test script to inspect it, and the output from the script:
* http://nottheoilrig.com/trafficserver/201212280/data * http://nottheoilrig.com/trafficserver/201212280/test * http://nottheoilrig.com/trafficserver/201212280/stdout The message has mostly normal values, but the log entry from bytes 2924:3348 has some gibberish values (the client_host_ip is normal, but the client_req_http_method, client_req_url_canon, and server_host_name are each gibberish) Here is the substring from bytes 2924:3348: http://nottheoilrig.com/trafficserver/201212280/2924:3348 The test script finds normal log entries after these gibberish values, so the log entry or log buffer aren't completely corrupt. I tried running traffic_logcat on the message to see what it made of it, but it complained "Bad LogBuffer!" I'm not sure if this is because of the gibberish values or because log collation messages are not the same format as logs stored on the disk? > $ trafficserver-3.2.0/proxy/traffic_logcat data > Bad LogBuffer! > $ The log collation client is Traffic Server version 3.2.0 I'll keep investigating, but does anyone have any tips on what to try, or insight into what might be happening here? I made some progress on a script to visualize Traffic Server statistics [1]. It now shows bar charts for the top clients and the top servers, and it shows the proportion of cache hits. I'm working on a scatter plot to show the relationship between clients and servers. Here's what it looks like at the moment: http://nottheoilrig.com/visulate/ [1] https://github.com/jablko/visulate
