Weird log entries

[Alecs Henry]

So, after a while digging through other stuff I realized what the "(null)"
entries are.
They are cache misses.
For (apparently) every miss there's an entry on varnishncsa for that miss,
and it's logged as a bunch of nulls.
I haven't figured out what the other entries are though.
I still see some entries (not as many as the null ones) with the date field
set to "[00/Jan/1900:00:00:00 +0000]", with all the other information valid
(URL, Referer, BackendName, etc..) except for the object size, which is set
to "(null)" and ther server response code (also "(null)").
There are also entries that the only field set is the server response (200
or 404 -- these have the date field set correctly) and some entries with the
host (or where the backend name should go) set to 127.0.0.1 and the other
fields set correctly.

One thing though, in none of the entries (correct, broken or plain weird)
the object size is set, all I see are "-", except for one entry that had it
set (strangely enough, favicon.ico!) and even then, only once.

If anybody else has seen this stuff or know anything that might help
explain, I'd greatly appreciate some help.
I can also send you any information you might deem necessary in order to
figure this stuff out.

This is the varnish package for debian (2.0.3-2_amd64) all with HTTP/1.1
requests.

Thanks!

Alecs


On Mon, Feb 9, 2009 at 5:29 PM, Alecs Henry <alecshenry at gmail.com> wrote:

> Hi Nick,
>
> I forgot to say... It's varnish-trunk.
> But I saw it on both varnish 2.0.1 and 2.0.2.
>
> Alecs
>
>
> On Mon, Feb 9, 2009 at 6:20 PM, Nick Loman <nick at loman.net> wrote:
>
>> Alecs Henry wrote:
>>
>>  EDITED TO INCLUDE THE ORIGINAL MESSAGE...
>>> Hi guys,
>>>
>>> I was wondering if any of you has seen the following log entries when
>>> using varnishncsa:
>>> 127.0.0.1 - - [00/Jan/1900:00:00:00 +0000] "(null) (null) (null)" (null)
>>> - "-" "-"
>>>
>>> Those are coupled with:
>>> 127.0.0.1 - - [09/Feb/2009:19:39:46 +0000] "(null) (null) (null)" 200
>>> 39678 "-" "-"
>>> I can see an object in the page that has that size (image) -- through
>>> firebug, but the object didn't load into the browser until I hit reload.
>>>
>>> And there are also many entries like the following:
>>> 127.0.0.1 - - [09/Feb/2009:19:39:52 +0000] "GET
>>> http://www.example.com/img/mod.gif HTTP/1.1" 200 951 "
>>> http://www.example.com/style.css" "Mozilla/5.0 (X11; U; Linux x86_64;
>>> en; rv:1.9.0.5) Gecko/2008121623 Ubuntu/8.10 (intrepid) Firefox/3.0.5"
>>>
>>> These entries are from communication with the backend server
>>>
>>> I expected it to show the backend name instead of 127.0.0.1.
>>>
>>> Is there an explanation?
>>>
>>> Thanks!
>>>
>>> Alecs
>>>
>>
>>>
>> I've seen log entries like this for HTTP 1.0 requests (using Varnish 1.2),
>> as that version of Varnish did not have support for parsing HTTP 1.0
>> headers.
>>
>> Cheers,
>>
>> Nick.
>>
>>
>>
>>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://www.varnish-cache.org/lists/pipermail/varnish-misc/attachments/20090406/c20b9429/attachment-0001.html>