Mailing-List: contact users-help@trafficserver.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@trafficserver.apache.org
To: users@trafficserver.apache.org
From: tomr <tom@equalit.ie>
Subject: garbled log entries - scheme UNKNOWN
Message-ID: <f1d2d9eb-960b-887c-f7c2-37a6ef42a83e@equalit.ie>
Date: Tue, 10 Oct 2017 10:50:01 +1100
User-Agent: Mozilla/5.0 (X11; OpenBSD amd64; rv:52.0) Gecko/20100101
 Thunderbird/52.2.1
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Language: en-GB
Content-Transfer-Encoding: 8bit
archived-at: Mon, 09 Oct 2017 23:50:27 -0000

Hi,

I'm seeing a ton of log entries with scheme "UNKNOWN", a garbled HTTP
response code (circa 20 chars long), and not a huge amount of the detail
I'd normally expect - apart from client ip, which appears sensible.

A lot of the requests come from our own monitoring infrastructure, so
there's a decent chance I'll be able to reproduce (though I can't yet).

Does anyone have any suggestions about where I could start looking?

We're using ATS 7.0.0, and seeing this for about 0.5% of log lines on a
few million hits per day.

Log format is: %<chi> %<caun> [%<cqtn>] \"%<cqhm> /%<cqup> %<cqhv>\"
%<cqus> %<{Host}cqh> %<pssc> %<pscl> \"%<{User-Agent}cqh>\" %<crc>
%<psct> %<pqsn> %<ttms> %<cquc>

And an example bogus logline (with IP replaced) is:
0.0.0.0 - [09/Oct/2017:07:22:59 -0000] "- /- HTTP/1.0" UNKNOWN
8242834443987517485 0 "" ERROR_UNKNOWN(7811903955520716845) Z -
7587266184633188397 ��

tia,
Tom