2006-06-25 20:48:02 -04:00
|
|
|
/*
|
|
|
|
|
include/types/log.h
|
|
|
|
|
This file contains definitions of log-related structures and macros.
|
|
|
|
|
|
|
|
|
|
Copyright (C) 2000-2006 Willy Tarreau - w@1wt.eu
|
|
|
|
|
|
|
|
|
|
This library is free software; you can redistribute it and/or
|
|
|
|
|
modify it under the terms of the GNU Lesser General Public
|
|
|
|
|
License as published by the Free Software Foundation, version 2.1
|
|
|
|
|
exclusively.
|
|
|
|
|
|
|
|
|
|
This library is distributed in the hope that it will be useful,
|
|
|
|
|
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
|
|
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
|
|
|
|
Lesser General Public License for more details.
|
|
|
|
|
|
|
|
|
|
You should have received a copy of the GNU Lesser General Public
|
|
|
|
|
License along with this library; if not, write to the Free Software
|
|
|
|
|
Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
|
|
|
|
|
*/
|
|
|
|
|
|
|
|
|
|
#ifndef _TYPES_LOG_H
|
|
|
|
|
#define _TYPES_LOG_H
|
|
|
|
|
|
2007-12-05 05:11:55 -05:00
|
|
|
#include <sys/socket.h>
|
2007-12-05 04:47:29 -05:00
|
|
|
#include <sys/un.h>
|
|
|
|
|
#include <netinet/in.h>
|
2006-06-29 12:54:54 -04:00
|
|
|
#include <common/config.h>
|
2012-08-24 13:22:53 -04:00
|
|
|
#include <common/mini-clist.h>
|
2006-06-25 20:48:02 -04:00
|
|
|
|
|
|
|
|
#define NB_LOG_FACILITIES 24
|
|
|
|
|
#define NB_LOG_LEVELS 8
|
2015-10-01 07:18:13 -04:00
|
|
|
#define NB_MSG_IOVEC_ELEMENTS 8
|
2006-06-25 20:48:02 -04:00
|
|
|
#define SYSLOG_PORT 514
|
2012-03-12 07:48:57 -04:00
|
|
|
#define UNIQUEID_LEN 128
|
|
|
|
|
|
2015-01-23 08:07:08 -05:00
|
|
|
/* The array containing the names of the log levels. */
|
|
|
|
|
extern const char *log_levels[];
|
2006-06-25 20:48:02 -04:00
|
|
|
|
2015-09-22 10:05:32 -04:00
|
|
|
/* enum for log format */
|
|
|
|
|
enum {
|
|
|
|
|
LOG_FORMAT_RFC3164 = 0,
|
|
|
|
|
LOG_FORMAT_RFC5424,
|
|
|
|
|
LOG_FORMATS, /* number of supported log formats, must always be last */
|
|
|
|
|
};
|
|
|
|
|
|
2012-02-08 10:37:49 -05:00
|
|
|
/* lists of fields that can be logged */
|
|
|
|
|
enum {
|
|
|
|
|
|
2012-03-12 07:46:41 -04:00
|
|
|
LOG_FMT_TEXT = 0, /* raw text */
|
2012-12-20 18:09:23 -05:00
|
|
|
LOG_FMT_EXPR, /* sample expression */
|
2012-03-12 07:46:41 -04:00
|
|
|
LOG_FMT_SEPARATOR, /* separator replaced by one space */
|
2012-02-08 10:37:49 -05:00
|
|
|
|
|
|
|
|
/* information fields */
|
2012-03-12 07:46:41 -04:00
|
|
|
LOG_FMT_GLOBAL,
|
|
|
|
|
LOG_FMT_CLIENTIP,
|
|
|
|
|
LOG_FMT_CLIENTPORT,
|
|
|
|
|
LOG_FMT_BACKENDIP,
|
|
|
|
|
LOG_FMT_BACKENDPORT,
|
2012-04-05 12:02:55 -04:00
|
|
|
LOG_FMT_FRONTENDIP,
|
|
|
|
|
LOG_FMT_FRONTENDPORT,
|
|
|
|
|
LOG_FMT_SERVERPORT,
|
|
|
|
|
LOG_FMT_SERVERIP,
|
|
|
|
|
LOG_FMT_COUNTER,
|
2014-08-28 09:03:15 -04:00
|
|
|
LOG_FMT_LOGCNT,
|
2012-04-05 12:02:55 -04:00
|
|
|
LOG_FMT_PID,
|
2012-03-12 07:46:41 -04:00
|
|
|
LOG_FMT_DATE,
|
|
|
|
|
LOG_FMT_DATEGMT,
|
2012-10-18 22:36:09 -04:00
|
|
|
LOG_FMT_DATELOCAL,
|
2012-04-05 12:02:55 -04:00
|
|
|
LOG_FMT_TS,
|
2012-03-12 07:46:41 -04:00
|
|
|
LOG_FMT_MS,
|
|
|
|
|
LOG_FMT_FRONTEND,
|
2012-10-12 08:56:11 -04:00
|
|
|
LOG_FMT_FRONTEND_XPRT,
|
2012-03-12 07:46:41 -04:00
|
|
|
LOG_FMT_BACKEND,
|
|
|
|
|
LOG_FMT_SERVER,
|
|
|
|
|
LOG_FMT_BYTES,
|
2012-12-20 09:38:04 -05:00
|
|
|
LOG_FMT_BYTES_UP,
|
MEDIUM: log: Decompose %Tq in %Th %Ti %TR
Tq is the time between the instant the connection is accepted and a
complete valid request is received. This time includes the handshake
(SSL / Proxy-Protocol), the idle when the browser does preconnect and
the request reception.
This patch decomposes %Tq in 3 measurements names %Th, %Ti, and %TR
which returns respectively the handshake time, the idle time and the
duration of valid request reception. It also adds %Ta which reports
the request's active time, which is the total time without %Th nor %Ti.
It replaces %Tt as the total time, reporting accurate measurements for
HTTP persistent connections.
%Th is avalaible for TCP and HTTP sessions, %Ti, %TR and %Ta are only
avalaible for HTTP connections.
In addition to this, we have new timestamps %tr, %trg and %trl, which
log the date of start of receipt of the request, respectively in the
default format, in GMT time and in local time (by analogy with %t, %T
and %Tl). All of them are obviously only available for HTTP. These values
are more relevant as they more accurately represent the request date
without being skewed by a browser's preconnect nor a keep-alive idle
time.
The HTTP log format and the CLF log format have been modified to
use %tr, %TR, and %Ta respectively instead of %t, %Tq and %Tt. This
way the default log formats now produce the expected output for users
who don't want to manually fiddle with the log-format directive.
Example with the following log-format :
log-format "%ci:%cp [%tr] %ft %b/%s h=%Th/i=%Ti/R=%TR/w=%Tw/c=%Tc/r=%Tr/a=%Ta/t=%Tt %ST %B %CC %CS %tsc %ac/%fc/%bc/%sc/%rc %sq/%bq %hr %hs %{+Q}r"
The request was sent by hand using "openssl s_client -connect" :
Aug 23 14:43:20 haproxy[25446]: 127.0.0.1:45636 [23/Aug/2016:14:43:20.221] test~ test/test h=6/i=2375/R=261/w=0/c=1/r=0/a=262/t=2643 200 145 - - ---- 1/1/0/0/0 0/0 "GET / HTTP/1.1"
=> 6 ms of SSL handshake, 2375 waiting before sending the first char (in
fact the time to type the first line), 261 ms before the end of the request,
no time spent in queue, 1 ms spend connecting to the server, immediate
response, total active time for this request = 262ms. Total time from accept
to close : 2643 ms.
The timing now decomposes like this :
first request 2nd request
|<-------------------------------->|<-------------- ...
t tr t tr ...
---|----|----|----|----|----|----|----|----|--
: Th Ti TR Tw Tc Tr Td : Ti ...
:<---- Tq ---->: :
:<-------------- Tt -------------->:
:<--------- Ta --------->:
2016-07-28 11:19:45 -04:00
|
|
|
LOG_FMT_Ta,
|
|
|
|
|
LOG_FMT_Th,
|
|
|
|
|
LOG_FMT_Ti,
|
2012-03-12 07:46:41 -04:00
|
|
|
LOG_FMT_TQ,
|
|
|
|
|
LOG_FMT_TW,
|
|
|
|
|
LOG_FMT_TC,
|
MEDIUM: log: Decompose %Tq in %Th %Ti %TR
Tq is the time between the instant the connection is accepted and a
complete valid request is received. This time includes the handshake
(SSL / Proxy-Protocol), the idle when the browser does preconnect and
the request reception.
This patch decomposes %Tq in 3 measurements names %Th, %Ti, and %TR
which returns respectively the handshake time, the idle time and the
duration of valid request reception. It also adds %Ta which reports
the request's active time, which is the total time without %Th nor %Ti.
It replaces %Tt as the total time, reporting accurate measurements for
HTTP persistent connections.
%Th is avalaible for TCP and HTTP sessions, %Ti, %TR and %Ta are only
avalaible for HTTP connections.
In addition to this, we have new timestamps %tr, %trg and %trl, which
log the date of start of receipt of the request, respectively in the
default format, in GMT time and in local time (by analogy with %t, %T
and %Tl). All of them are obviously only available for HTTP. These values
are more relevant as they more accurately represent the request date
without being skewed by a browser's preconnect nor a keep-alive idle
time.
The HTTP log format and the CLF log format have been modified to
use %tr, %TR, and %Ta respectively instead of %t, %Tq and %Tt. This
way the default log formats now produce the expected output for users
who don't want to manually fiddle with the log-format directive.
Example with the following log-format :
log-format "%ci:%cp [%tr] %ft %b/%s h=%Th/i=%Ti/R=%TR/w=%Tw/c=%Tc/r=%Tr/a=%Ta/t=%Tt %ST %B %CC %CS %tsc %ac/%fc/%bc/%sc/%rc %sq/%bq %hr %hs %{+Q}r"
The request was sent by hand using "openssl s_client -connect" :
Aug 23 14:43:20 haproxy[25446]: 127.0.0.1:45636 [23/Aug/2016:14:43:20.221] test~ test/test h=6/i=2375/R=261/w=0/c=1/r=0/a=262/t=2643 200 145 - - ---- 1/1/0/0/0 0/0 "GET / HTTP/1.1"
=> 6 ms of SSL handshake, 2375 waiting before sending the first char (in
fact the time to type the first line), 261 ms before the end of the request,
no time spent in queue, 1 ms spend connecting to the server, immediate
response, total active time for this request = 262ms. Total time from accept
to close : 2643 ms.
The timing now decomposes like this :
first request 2nd request
|<-------------------------------->|<-------------- ...
t tr t tr ...
---|----|----|----|----|----|----|----|----|--
: Th Ti TR Tw Tc Tr Td : Ti ...
:<---- Tq ---->: :
:<-------------- Tt -------------->:
:<--------- Ta --------->:
2016-07-28 11:19:45 -04:00
|
|
|
LOG_FMT_Tr,
|
|
|
|
|
LOG_FMT_tr,
|
|
|
|
|
LOG_FMT_trg,
|
|
|
|
|
LOG_FMT_trl,
|
2012-03-12 07:46:41 -04:00
|
|
|
LOG_FMT_TR,
|
2016-05-17 11:55:27 -04:00
|
|
|
LOG_FMT_TD,
|
2012-03-12 07:46:41 -04:00
|
|
|
LOG_FMT_TT,
|
|
|
|
|
LOG_FMT_STATUS,
|
|
|
|
|
LOG_FMT_CCLIENT,
|
|
|
|
|
LOG_FMT_CSERVER,
|
|
|
|
|
LOG_FMT_TERMSTATE,
|
|
|
|
|
LOG_FMT_TERMSTATE_CK,
|
|
|
|
|
LOG_FMT_ACTCONN,
|
|
|
|
|
LOG_FMT_FECONN,
|
|
|
|
|
LOG_FMT_BECONN,
|
|
|
|
|
LOG_FMT_SRVCONN,
|
|
|
|
|
LOG_FMT_RETRIES,
|
|
|
|
|
LOG_FMT_SRVQUEUE,
|
|
|
|
|
LOG_FMT_BCKQUEUE,
|
|
|
|
|
LOG_FMT_HDRREQUEST,
|
|
|
|
|
LOG_FMT_HDRRESPONS,
|
|
|
|
|
LOG_FMT_HDRREQUESTLIST,
|
|
|
|
|
LOG_FMT_HDRRESPONSLIST,
|
|
|
|
|
LOG_FMT_REQ,
|
2015-04-27 17:37:03 -04:00
|
|
|
LOG_FMT_HTTP_METHOD,
|
|
|
|
|
LOG_FMT_HTTP_URI,
|
|
|
|
|
LOG_FMT_HTTP_PATH,
|
2015-07-31 12:14:16 -04:00
|
|
|
LOG_FMT_HTTP_QUERY,
|
2015-04-27 17:37:03 -04:00
|
|
|
LOG_FMT_HTTP_VERSION,
|
2012-04-05 12:02:55 -04:00
|
|
|
LOG_FMT_HOSTNAME,
|
2012-03-12 07:48:57 -04:00
|
|
|
LOG_FMT_UNIQUEID,
|
2012-10-12 14:17:54 -04:00
|
|
|
LOG_FMT_SSL_CIPHER,
|
|
|
|
|
LOG_FMT_SSL_VERSION,
|
2012-02-08 10:37:49 -05:00
|
|
|
};
|
|
|
|
|
|
2012-12-20 15:23:42 -05:00
|
|
|
/* enum for parse_logformat_string */
|
2012-02-08 10:37:49 -05:00
|
|
|
enum {
|
2012-12-20 15:23:42 -05:00
|
|
|
LF_INIT = 0, // before first character
|
|
|
|
|
LF_TEXT, // normal text
|
|
|
|
|
LF_SEPARATOR, // a single separator
|
|
|
|
|
LF_VAR, // variable name, after '%' or '%{..}'
|
|
|
|
|
LF_STARTVAR, // % in text
|
|
|
|
|
LF_STARG, // after '%{' and berore '}'
|
|
|
|
|
LF_EDARG, // '}' after '%{'
|
2012-12-20 18:09:23 -05:00
|
|
|
LF_STEXPR, // after '%[' or '%{..}[' and berore ']'
|
|
|
|
|
LF_EDEXPR, // ']' after '%['
|
2012-12-20 15:23:42 -05:00
|
|
|
LF_END, // \0 found
|
2012-02-08 10:37:49 -05:00
|
|
|
};
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
struct logformat_node {
|
|
|
|
|
struct list list;
|
2012-12-20 18:09:23 -05:00
|
|
|
int type; // LOG_FMT_*
|
|
|
|
|
int options; // LOG_OPT_*
|
|
|
|
|
char *arg; // text for LOG_FMT_TEXT, arg for others
|
|
|
|
|
void *expr; // for use with LOG_FMT_EXPR
|
2012-02-08 10:37:49 -05:00
|
|
|
};
|
|
|
|
|
|
2012-04-05 12:02:55 -04:00
|
|
|
#define LOG_OPT_HEXA 0x00000001
|
2012-02-08 10:37:49 -05:00
|
|
|
#define LOG_OPT_MANDATORY 0x00000002
|
|
|
|
|
#define LOG_OPT_QUOTE 0x00000004
|
2012-12-20 18:09:23 -05:00
|
|
|
#define LOG_OPT_REQ_CAP 0x00000008
|
|
|
|
|
#define LOG_OPT_RES_CAP 0x00000010
|
2014-03-13 11:46:18 -04:00
|
|
|
#define LOG_OPT_HTTP 0x00000020
|
2016-02-12 07:23:03 -05:00
|
|
|
#define LOG_OPT_ESC 0x00000040
|
2012-02-08 10:37:49 -05:00
|
|
|
|
2006-06-25 20:48:02 -04:00
|
|
|
|
BUG/MINOR: log: make log-format, unique-id-format and add-header more independant
It happens that all of them call parse_logformat_line() which sets
proxy->to_log with a number of flags affecting the line format for
all three users. For example, having a unique-id specified disables
the default log-format since fe->to_log is tested when the session
is established.
Similarly, having "option logasap" will cause "+" to be inserted in
unique-id or headers referencing some of the fields depending on
LW_BYTES.
This patch first removes most of the dependency on fe->to_log whenever
possible. The first possible cleanup is to stop checking fe->to_log
for being null, considering that it always contains at least LW_INIT
when any such usage is made of the log-format!
Also, some checks are wrong. s->logs.logwait cannot be nulled by
"logwait &= ~LW_*" since LW_INIT is always there. This results in
getting the wrong log at the end of a request or session when a
unique-id or add-header is set, because logwait is still not null
but the log-format is not checked.
Further cleanups are required. Most LW_* flags should be removed or at
least replaced with what they really mean (eg: depend on client-side
connection, depend on server-side connection, etc...) and this should
only affect logging, not other mechanisms.
This patch fixes the default log-format and tries to limit interferences
between the log formats, but does not pretend to do more for the moment,
since it's the most visible breakage.
2012-12-28 03:40:16 -05:00
|
|
|
/* Fields that need to be extracted from the incoming connection or request for
|
|
|
|
|
* logging or for sending specific header information. They're set in px->to_log
|
|
|
|
|
* and appear as flags in session->logs.logwait, which are removed once the
|
|
|
|
|
* required information has been collected.
|
|
|
|
|
*/
|
|
|
|
|
#define LW_INIT 1 /* anything */
|
2006-06-25 20:48:02 -04:00
|
|
|
#define LW_CLIP 2 /* CLient IP */
|
|
|
|
|
#define LW_SVIP 4 /* SerVer IP */
|
|
|
|
|
#define LW_SVID 8 /* server ID */
|
|
|
|
|
#define LW_REQ 16 /* http REQuest */
|
|
|
|
|
#define LW_RESP 32 /* http RESPonse */
|
|
|
|
|
#define LW_BYTES 256 /* bytes read from server */
|
|
|
|
|
#define LW_COOKIE 512 /* captured cookie */
|
|
|
|
|
#define LW_REQHDR 1024 /* request header(s) */
|
|
|
|
|
#define LW_RSPHDR 2048 /* response header(s) */
|
2012-04-02 10:22:10 -04:00
|
|
|
#define LW_BCKIP 4096 /* backend IP */
|
|
|
|
|
#define LW_FRTIP 8192 /* frontend IP */
|
2012-10-12 12:01:49 -04:00
|
|
|
#define LW_XPRT 16384 /* transport layer information (eg: SSL) */
|
2006-06-25 20:48:02 -04:00
|
|
|
|
2007-12-05 04:47:29 -05:00
|
|
|
struct logsrv {
|
2011-10-12 11:50:54 -04:00
|
|
|
struct list list;
|
2011-03-24 07:23:00 -04:00
|
|
|
struct sockaddr_storage addr;
|
2015-09-22 10:05:32 -04:00
|
|
|
int format;
|
2011-10-12 11:50:54 -04:00
|
|
|
int facility;
|
|
|
|
|
int level;
|
|
|
|
|
int minlvl;
|
2014-06-27 12:10:07 -04:00
|
|
|
int maxlen;
|
2018-03-26 10:09:19 -04:00
|
|
|
struct logsrv *ref;
|
2007-12-05 04:47:29 -05:00
|
|
|
};
|
|
|
|
|
|
2006-06-25 20:48:02 -04:00
|
|
|
#endif /* _TYPES_LOG_H */
|
|
|
|
|
|
|
|
|
|
/*
|
|
|
|
|
* Local variables:
|
|
|
|
|
* c-indent-level: 8
|
|
|
|
|
* c-basic-offset: 8
|
|
|
|
|
* End:
|
|
|
|
|
*/
|