>> [serverIP],[clientIP], >> 4012,692,498,GET,200,º^_x°*,username,20/Jun/2014:00:06:36 > > The log format you used does not match this log line. The format produces: > > [squid-listening-IP],[clientIP], > 4012,692,498,GET,200,º^_x°*,username,20/Jun/2014:00:06:36 Thanks for the correction. To expand on that point, on some of our proxies, we have more than one IP being serviced by a single daemon. Recording which IP received the traffic is essential to proper accounting (e.g. FreeRADIUS). > URL-encoding is the %xx character encoding, it can be (and is) applied > to anything which can legitimately contain non-ASCII characters or ASCII > special characters. Content-Type header is not one of those places. > > You can use the '#' format modifier to URL-encode that %mt field > explicitly. Like so: %#mt Amos, thank you so much for sharing this. I plan to try it as soon as ... > If you will share the exact Squid version you are using I would also > like to check the code to see if the mt code is being correctly setup, > that log entry looks a bit like random memory being displayed as if it > were text. ... as soon as I finish upgrading from squid-3.1.10-16.el6 to 3.1.10-20.el6, both of which are packaged and delivered via the CentOS repo :). Totally ashamed I didn't even notice there was an update available before posting. I plan to schedule an outage to patch and I'll report back with my findings. If you suspect random memory chunks are being written to the file as a consequence of this outdated version of Squid, and even the more recent version I plan to move to does not address this condition, feel free to share. This particular proxy is pretty active. We're averaging between 800,000 - 1.2M lines in the access log per day. The proxy is non-caching, running with 512MB RAM and 1GB swap (don't ask). More soon, MD
