varnishlog record length

[Dridi Boukelmoune]

On Thu, Jul 13, 2023 at 9:46 AM Luca Gervasi <luca.gervasi at gmail.com> wrote:
>
> Hi,
> i'm helping to fix some issues with cookies (number, length...) thus I need to dump all the cookies in every request (tied with the host header). I tried with varnishlog but the actual value is limited (in our configuration) to ~ 700 bytes by the vsl_reclen parameter, I suppose. Reading the documentation, that value ranges between 16b and 4084b, which is lower than what I need to dump the full monster cookie (~ 24kb).

This limit is actually dynamic and better reflected in the reference
manual for vsl_buffer and vsl_reclen:

https://varnish-cache.org/docs/7.3/reference/varnishd.html#vsl-buffer
https://varnish-cache.org/docs/7.3/reference/varnishd.html#vsl-reclen

If you want to increase reclen to 24kB, it first needs to fit inside a
VSL buffer.

In your case I would recommend bumping vsl_buffer to at least 64kB,
and add 64kB to workspace_client and workspace_backend too (the VSL
buffer lives on these workspaces).

> At the moment I'm using tcpdump in the proxy port, but it is really impractical as I have to grep/awk and group the requests...and I'm not really proud about its manutenablity.
>
> Is there a way to dump, for every request that contains the cookie header, such header plus others? (in my case: host)?

https://varnish-cache.org/docs/7.3/reference/vsl-query.html

> I was thinking about tapping into varnish functions using eBPF. What do you think? Do you have something already working for my case that I could tamper with?

Try bumping vsl_buffer and vsl_reclen first, eBPF is probably way overkill.

Cheers,
Dridi