squid occasionally logs trimmed request method in log ('ET' instead of 'GET', etc).

Solution Unverified - Updated -

Issue

We are running latest RHEL7 squid (was also seen on older version, update did not help) and see intermittently that request method (%rm) is trimmed of the first character (i.e. GET->ET, POST->OST). It often comes in wave of several but fixes itself only to repeat some time later:

Log format in squid.conf:

logformat squid %tl %>a %Ss/%03>Hs %<st %rm %ru %[un %Sh/%<a %mt

Example:

: 09May/2020:10:1:35 +0100 10.0.0.1 TCP_MISS/200 238 ET http://url1.org/asf.png? - FIRSTUP_PARENT/10.0.0.2 image/png
: 09/May/2020:10:11:40 +0100 10.0.0.1 TCP_MISS/502 415 ET http://url2.org/xyz.png? - FIRSTUP_PARENT/10.0.0.2 image/png

Involved pieces in the logging: squid, systemd-journal, rsyslog.

Environment

  • Red Hat Enterprise Linux (RHEL) 7
  • squid

Subscriber exclusive content

A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.

Current Customers and Partners

Log in for full access

Log In

New to Red Hat?

Learn more about Red Hat subscriptions

Using a Red Hat product through a public cloud?

How to access this content