Access and Transaction Log Details

This appendix describes the format and information found in the Traffic Router and Media Streamer cache server transaction logs. It also describes the cache response codes that may be in the Squid and Netscape log files.

This appendix includes the following sections:

Traffic Router Log Information

The "Traffic Router Transaction Log Fields" table describes the fields that may be included in the Traffic Router /opt/traffic_router/var/log/access.log file.

Table 1. Traffic Router Transaction Log Fields
Name

Description

Data

Present
(#) Epoch timestamp The epoch time stamp of the request being logged Always
qtype Whether the request was for DNS or HTTP Always DNS or HTTP Always
chi The IP address of the requester Depends on whether this was a DNS or HTTP request Always
ttms The amount of time, in milliseconds, that it took the Traffic Router to process the request A number greater than or equal to zero Always

rtype

Routing result type

This field will be one of the following:

  • ANON_BLOCK: The request is being redirected (302) to the Anonymous Geo blocking URL. This blocking is based on the VPN/Hosting/Tor type IP addresses from a MaxMind database lookup, enabled on the Delivery service and defined by the anonymousip.polling.url setting for the Traffic Router profile.

  • CZ: The result was derived from Coverage Zone data, based on the address in the chi field.

  • DEEP_CZ: The result was derived from Deep Coverage Zone data, based on the address in the chi field.

  • DS_MISS _*HTTP Only*_: No HTTP Delivery Service supports either the URL path or the headers of the request.

  • DS_REDIRECT: The result is using the Bypass Destination (Bypass FQDN) configured for the matched Delivery Service when that Delivery Service is unavailable or does not have the requested resource.

  • ERROR: An internal error occurred within the Traffic Router. More details may be found in the rerr field.

  • FED _*DNS Only*_: The result was derived from federated coverage zone data outside of any Delivery Service.

  • GEO: The result was derived from the geolocation service, based on the address in the chi field.

  • GEO_REDIRECT: The request was redirected (302) based on the National Geo blocking (Geo Limit Redirect URL) configured on the Delivery Service.

  • MISS: The Traffic Router was unable to resolve a DNS request or find a cache for the requested resource.

  • RGALT: The request was redirected (302) to the Regional Geo blocking URL. Regional Geo blocking is enabled on the Delivery Service and is configured through the regional_geoblock.polling.url setting for the Traffic Router profile.

  • RGDENY: The request was regionally blocked because there was no rule for the request made.

  • STATIC_ROUTE _*DNS Only*_: No DNS Delivery Service supports the hostname portion of the requested URL.

  • -: The request was not redirected. This is usually a result of a DNS request to the Traffic Router or an explicit denial for that request.

Always
rloc Geolocation of result Latitude and longitude in decimal degrees. (This will be “-” for DNS.) Always

rdtl

Result details associated with unusual conditions

This field will be one of the following:

  • DS_NOT_FOUND: Always goes with the rtypes of STATIC_ROUTE and DS_MISS.

  • DS_BYPASS: The Bypass Destination (Bypass FQDN) configured for the matched Delivery Service was used to redirect the request.

  • DS_CLIENT_GEO_UNSUPPORTED: The Traffic Router did not find a resource supported by the Coverage Zone data and was unable to determine the geolocation of the requesting client.

  • DS_CZ_ONLY: The selected Delivery Service only supports resource lookup based on Coverage Zone data.

  • DS_NO_BYPASS: No valid Bypass Destination (Bypass FQDN) is configured for the matched Delivery Service and the Delivery Service does not have the requested resource.

  • GEO_NO_CACHE_FOUND: The Traffic Router could not find a resource using the geolocation data based on the geolocation of the requesting client.

  • NO_DETAILS: There is no unusual request being made. This entry is for a standard request.

  • REGIONAL_GEO_ALTERNATE_WITHOUT_CACHE: This goes with the rtype RGDENY. The URL is being regionally Geo blocked.

  • REGIONAL_GEO_NO_RULE: The request was blocked because there was no rule in the Delivery Service for the request.

  • -: The request was not redirected. This is usually a result of a DNS request to the Traffic Router or an explicit denial for that request.

Always
rerr Message about an internal Traffic Router error String (if error exists) Always
url Requested URL with query string String HTTP
cqhm HTTP method in request HTTP method in request, such as GET or POST HTTP
cqhv HTTP version in request For example: HTTP/1.1 HTTP
rh Key value pair. One or more key value pairs may exist in a logged event and are controlled by the configuration of the matched Delivery Service. Key value pair of the format “name: value” HTTP
rurl The resulting URL of the resource requested by the client A URL string HTTP
rgb Postal code and RGB lookup information If a URL has been defined for Regional Geo Blocking, the details provided in this field will reflect the postal code and additional information. HTTP

pssc

Traffic router response code

How the traffic router responded to the HTTP request, for example 302, 503, etc.

For a complete list of possible codes refer to https://en.wikipedia.org/wiki/List_of_HTTP_status_codes

HTTP
xn The ID from the client DNS request header A number from 0 to 65535 DNS
fqdn The qname field from the client DNS request message, for example, the FQDN the client is requesting to be resolved A series of DNS labels or domains separated by ‘.’ characters and ending with a ‘.’ character DNS
type The qtype field from the client DNS request message, for example, the type of resolution that is requested such as IPv4, IPv6 Examples for this field are A (IPv4), AAAA (IPv6), NS (Name Service), SOA (Start of Authority), and CNAME DNS
class The qclass field from the client DNS request message, for example, the class of resource being requested This field can be either IN (Internet resource) or ANY (Traffic router rejects requests with any other value of class). DNS
ttl The Time to Live, in seconds, for the answer from the Traffic Router. This is how long clients can reliably use the reply without re-querying the Traffic Router. A number from 0 to 4294967295 DNS

rcode

The result code for the DNS answer that was provided by the Traffic Router

This field will be one of the following:

  • NOERROR: Success

  • NOTIMP: Request is not supported

  • REFUSED: Request is refused to be answered

  • NXDOMAIN: The domain/name requested does not exist

DNS
ans IP address in answer to the query performed IP address in answer to the query performed DNS

For additional information, refer to http://traffic-control-cdn.readthedocs.io/en/latest/admin/traffic_router.html#event-log-file-format.

Media Streamer Cache Server Transaction Log Information

The "Media Streamer Cache Server Transaction Log Fields" table describes the fields that may be included in the Media Streamer cache servers transaction log files. The transaction log file is named openmd_transaction.log and is located in the /opt/trafficserver/var/log/trafficserver/ directory on each cache server.

Table 2. Media Streamer Cache Server Transaction Log Fields

Name

Description

Data
chi The IP address of the client host machine IP address
phn The hostname of the Traffic Server that generated the log entry in collated log files Hostname
url URL being requested A URL string

cqhm

The HTTP method in the client request to the Traffic Server.

Note 

Not all HHTP request methods will be honored in the CDN.

For example: GET or HEAD
cqhv The HTTP version of the client request For example: HTTP/1.1

pssc

The HTTP response status code from the Traffic Server to the client

Any HTTP response that is applicable to the operation, for example, 200, 302, 404, etc.

For a complete list of possible codes refer to https://en.wikipedia.org/wiki/List_of_HTTP_status_codes
ttms The time the Traffic Server spends processing the client request. This is calculated as the number of milliseconds between the time the client establishes the connection with the Traffic Server and the time the Traffic Server sends the last byte of the response back to the client. The value in milliseconds
b Response length of the content The value in bytes
sssc The HTTP response status code from the origin server to the Traffic Server Any HTTP response that is applicable to the operation, for example 200, 302, 404, etc. If the content is cached and has not timed out this will be 0000.
sscl The response length (in bytes) from the origin server to the Traffic Server The value in bytes. If the content is cached and has not timed out this will be 0.

cfsc

The client finish status code

Will be one of the following:

  • FIN: The client request to the Traffic Server was successfully completed.

  • INTR: The client request to the Traffic Server was interrupted.

pfsc

The proxy finish status code

Will be one of the following:

  • FIN: The Traffic Server request to the origin server was successfully completed.

  • INTR: The Traffic Server request to the origin server was interrupted.

  • TIMEOUT: The Traffic Server request to the origin server timed out.

Mid cache servers are proxies on behalf of the Edge cache nodes.

crc

The cache result code

Specifies how the cache responded to the request, for example HIT, MISS, etc.

For a full list of possible responses, refer to https://docs.trafficserver.apache.org/en/6.2.x/admin-guide/monitoring/logging/log-formats.en.html#admin-monitoring-logging-cache-result-codes

phr

The proxy hierarchy route, which is the route the Traffic Server used to retrieve the object

  • PARENT_HIT

  • NONE: For cache hit

  • Direct: Response from local system (astats) or single origin (no MSO)

phi The primary IP address of the Traffic Server that generated the log entry in collated log files IP address

hii

The IP address the Traffic Server used to stream the content. This is the IP address to which the client connected.

IP address

pqsn

The IP address or FQDN of the proxy request server

  • 0 on cache hits

  • The parent-ip for requests to parent proxies.
uas User agent string Client, client OS, or platform specifics
psqn Origin server configured FQDN For edge caches this will be"-". For Mid caches, this will be the FQDN of the origin server that is configured for the delivery service from which the content was requested. If MSO is configured, this will be one of the configured MSO origin servers for the delivery service.
shn The hostname of the origin server for the delivery service. This is the FQDN for the origin server configured for the delivery service. Note, if MSO is configured and the access.log is from a MID cache node, the shn is the origin server defined as the lookup for the delivery service. The actual origin server from which the content is requested is the psqn.

For additional information refer to: