Default page

Edit File: varnishncsa.html

<!DOCTYPE html>

<title>varnishncsa — Varnish version 7.5.0 documentation</title>
    <link rel="stylesheet" type="text/css" href="../_static/pygments.css?v=fa44fd50" />
    <link rel="stylesheet" type="text/css" href="../_static/classic.css?v=e2714048" />
    
    <script src="../_static/documentation_options.js?v=8214db13"></script>
    <script src="../_static/doctools.js?v=888ff710"></script>
    <script src="../_static/sphinx_highlight.js?v=dc90522c"></script>
    
    <link rel="index" title="Index" href="../genindex.html" />
    <link rel="search" title="Search" href="../search.html" />
    <link rel="next" title="varnishhist" href="varnishhist.html" />
    <link rel="prev" title="varnishlog" href="varnishlog.html" /> 
  </head><body>
    <div class="related" role="navigation" aria-label="related navigation">
      <h3>Navigation</h3>
      <ul>
        <li class="right" style="margin-right: 10px">
          <a href="../genindex.html" title="General Index"
             accesskey="I">index</a></li>
        <li class="right" >
          <a href="varnishhist.html" title="varnishhist"
             accesskey="N">next</a> |</li>
        <li class="right" >
          <a href="varnishlog.html" title="varnishlog"
             accesskey="P">previous</a> |</li>
        <li class="nav-item nav-item-0"><a href="../index.html">Varnish version 7.5.0 documentation</a> »</li>
          <li class="nav-item nav-item-1"><a href="index.html" accesskey="U">The Varnish Reference Manual</a> »</li>
        <li class="nav-item nav-item-this"><a href="">varnishncsa</a></li> 
      </ul>
    </div>

<div class="document">
      <div class="documentwrapper">
        <div class="bodywrapper">
          <div class="body" role="main">
            
  <section id="varnishncsa">
<span id="varnishncsa-1"></span><h1>varnishncsa<a class="headerlink" href="#varnishncsa" title="Link to this heading">¶</a></h1>
<section id="display-varnish-logs-in-apache-ncsa-combined-log-format">
<h2>Display Varnish logs in Apache / NCSA combined log format<a class="headerlink" href="#display-varnish-logs-in-apache-ncsa-combined-log-format" title="Link to this heading">¶</a></h2>
<dl class="field-list simple">
<dt class="field-odd">Manual section<span class="colon">:</span></dt>
<dd class="field-odd"><p>1</p>
</dd>
</dl>
<section id="synopsis">
<h3>SYNOPSIS<a class="headerlink" href="#synopsis" title="Link to this heading">¶</a></h3>
<p>varnishncsa [-a] [-b] [-c] [-C] [-d] [-D] [-E] [-F <format>] [-f <formatfile>] [-g <request|vxid>] [-h] [-j] [-k <num>] [-L <limit>] [-n <dir>] [-P <file>] [-Q <file>] [-q <query>] [-r <filename>] [-R <limit[/duration]>] [-t <seconds|off>] [-V] [-w <filename>]</p>
</section>
<section id="description">
<h3>DESCRIPTION<a class="headerlink" href="#description" title="Link to this heading">¶</a></h3>
<p>The varnishncsa utility reads varnishd(1) shared memory logs and
presents them in the Apache / NCSA “combined” log format.</p>
<p>Each log line produced is based on a single Request type transaction
gathered from the shared memory log. The Request transaction is then
scanned for the relevant parts in order to output one log line. To
filter the log lines produced, use the query language to select the
applicable transactions. Non-request transactions are ignored.</p>
<p>The following options are available:</p>
<dl class="option-list">
<dt><kbd><span class="option">-a</span></kbd></dt>
<dd><p>When writing output to a file, append to it rather than overwrite it. This option has no effect without the -w option.</p>
</dd>
<dt><kbd><span class="option">-b</span></kbd></dt>
<dd><p>Log backend requests. If -c is not specified, then only backend requests will trigger log lines.</p>
</dd>
<dt><kbd><span class="option">-c</span></kbd></dt>
<dd><p>Log client requests. This is the default. If -b is specified, then -c is needed to also log client requests</p>
</dd>
<dt><kbd><span class="option">-C</span></kbd></dt>
<dd><p>Do all regular expression and string matching caseless.</p>
</dd>
<dt><kbd><span class="option">-d</span></kbd></dt>
<dd><p>Process log records at the head of the log and exit.</p>
</dd>
<dt><kbd><span class="option">-D</span></kbd></dt>
<dd><p>Daemonize.</p>
</dd>
<dt><kbd><span class="option">-E</span></kbd></dt>
<dd><p>Show ESI requests, implies client mode.</p>
</dd>
<dt><kbd><span class="option">-F <var><format></var></span></kbd></dt>
<dd><p>Set the output log format string.</p>
</dd>
<dt><kbd><span class="option">-f <var><formatfile></var></span></kbd></dt>
<dd><p>Read output format from a file. Will read a single line from the specified file, and use that line as the format.</p>
</dd>
<dt><kbd><span class="option">-g <var><request|vxid></var></span></kbd></dt>
<dd><p>The grouping of the log records. The default is to group by vxid.</p>
</dd>
<dt><kbd><span class="option">-h</span></kbd></dt>
<dd><p>Print program usage and exit</p>
</dd>
<dt><kbd><span class="option">-j</span></kbd></dt>
<dd><p>Make format-specifier replacements JSON-compatible. When escaping characters, use JSON-style \uXXXX escape sequences instead of C-style \xXX sequences. Empty strings will be replaced with “” instead of “-”, and empty integers will be replaced with null. Use -F or -f in combination with -j to write JSON logs.</p>
</dd>
<dt><kbd><span class="option">-k <var><num></var></span></kbd></dt>
<dd><p>Process this number of matching log transactions before exiting.</p>
</dd>
<dt><kbd><span class="option">-L <var><limit></var></span></kbd></dt>
<dd><p>Sets the upper limit of incomplete transactions kept before the oldest transaction is force completed. A warning record is synthesized when this happens. This setting keeps an upper bound on the memory usage of running queries. Defaults to 1000 transactions.</p>
</dd>
<dt><kbd><span class="option">-n <var><dir></var></span></kbd></dt>
<dd><p>Specify the varnishd working directory (also known as instance name) to get logs from. If -n is not specified, the host name is used.</p>
</dd>
<dt><kbd><span class="option">-P <var><file></var></span></kbd></dt>
<dd><p>Write the process’ PID to the specified file.</p>
</dd>
<dt><kbd><span class="option">-Q <var><file></var></span></kbd></dt>
<dd><p>Specifies the file containing the VSL query to use. When multiple -Q or -q options are specified, all queries are considered as if the ‘or’ operator was used to combine them.</p>
</dd>
<dt><kbd><span class="option">-q <var><query></var></span></kbd></dt>
<dd><p>Specifies the VSL query to use. When multiple -q or -Q options are specified, all queries are considered as if the ‘or’ operator was used to combine them.</p>
</dd>
<dt><kbd><span class="option">-r <var><filename></var></span></kbd></dt>
<dd><p>Read log in binary file format from this file. The file can be created with <code class="docutils literal notranslate"><span class="pre">varnishlog</span> <span class="pre">-w</span> <span class="pre">filename</span></code>. If the filename is -, logs are read from the standard input. and cannot work as a daemon.</p>
</dd>
<dt><kbd><span class="option">-R <var><limit[/duration]></var></span></kbd></dt>
<dd><p>Restrict the output to the specified limit. Transactions exceeding the limit will be suppressed. The limit is specified as the maximum number of transactions (with respect to the chosen grouping method) and an optional time period. If no duration is specified, a default of <code class="docutils literal notranslate"><span class="pre">s</span></code> is used. The duration field can be formatted as in VCL (e.g. <code class="docutils literal notranslate"><span class="pre">-R</span> <span class="pre">10/2m</span></code>) or as a simple time period without the prefix (e.g. <code class="docutils literal notranslate"><span class="pre">-R</span> <span class="pre">5/m</span></code>). When in <code class="docutils literal notranslate"><span class="pre">-g</span> <span class="pre">raw</span></code> grouping mode, this setting can not be used alongside <code class="docutils literal notranslate"><span class="pre">-i</span></code>, <code class="docutils literal notranslate"><span class="pre">-I</span></code>, <code class="docutils literal notranslate"><span class="pre">-x</span></code> or <code class="docutils literal notranslate"><span class="pre">-X</span></code>, and we advise using <code class="docutils literal notranslate"><span class="pre">-q</span></code> instead.</p>
</dd>
<dt><kbd><span class="option">-t <var><seconds|off></var></span></kbd></dt>
<dd><p>Timeout before returning error on initial VSM connection. If set the VSM connection is retried every 0.5 seconds for this many seconds. If zero the connection is attempted only once and will fail immediately if unsuccessful. If set to “off”, the connection will not fail, allowing the utility to start and wait indefinetely for the Varnish instance to appear.  Defaults to 5 seconds.</p>
</dd>
<dt><kbd><span class="option">-V</span></kbd></dt>
<dd><p>Print version information and exit.</p>
</dd>
<dt><kbd><span class="option">-w <var><filename></var></span></kbd></dt>
<dd><p>Redirect output to file. The file will be overwritten unless the -a option was specified. If the application receives a SIGHUP in daemon mode the file will be reopened allowing the old one to be rotated away. This option is required when running in daemon mode. If the filename is -, varnishncsa writes to the standard output and cannot work as a daemon.</p>
</dd>
<dt><kbd><span class="option">--optstring</span></kbd></dt>
<dd><p>Print the optstring parameter to <code class="docutils literal notranslate"><span class="pre">getopt(3)</span></code> to help writing wrapper scripts.</p>
</dd>
</dl>
</section>
<section id="modes">
<h3>MODES<a class="headerlink" href="#modes" title="Link to this heading">¶</a></h3>
<p>The default mode of varnishncsa is “client mode”.  In this mode, the
log will be similar to what a web server would produce in the absence
of varnish.  Client mode can be explicitly selected by using -c.</p>
<p>If the -b switch is specified, varnishncsa will operate in “backend
mode”.  In this mode, requests generated by varnish to the backends
will be logged.  Unless -c is also specified, client requests received
by varnish will be ignored.</p>
<p>When running varnishncsa in both backend and client mode, it is
strongly advised to include the format specifier %{Varnish:side}x to
distinguish between backend and client requests.</p>
<p>Client requests that results in a pipe (ie. return(pipe) in vcl), will
not generate logging in backend mode. This is because varnish is not
generating requests, but blindly passes on bytes in both directions.
However, a varnishncsa instance running in normal mode can see this
case by using the formatter %{Varnish:handling}x, which will be ‘pipe’.</p>
<p>In backend mode, some of the fields in the format string get different
meanings.  Most notably, the byte counting formatters (%b, %I, %O)
considers varnish to be the client.</p>
<p>It is possible to keep two varnishncsa instances running, one in
backend mode, and one in client mode, logging to different files.</p>
</section>
<section id="format">
<span id="ncsa-format"></span><h3>FORMAT<a class="headerlink" href="#format" title="Link to this heading">¶</a></h3>
<p>Specify the log format to use. If no format is specified the default log
format is used:</p>
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="o">%</span><span class="n">h</span> <span class="o">%</span><span class="n">l</span> <span class="o">%</span><span class="n">u</span> <span class="o">%</span><span class="n">t</span> <span class="s2">"</span><span class="si">%r</span><span class="s2">"</span> <span class="o">%</span><span class="n">s</span> <span class="o">%</span><span class="n">b</span> <span class="s2">"%</span><span class="si">{Referer}</span><span class="s2">i"</span> <span class="s2">"%{User-agent}i"</span>
</pre></div>
</div>
<p>Escape sequences \n and \t are supported.</p>
<p>Supported formatters are:</p>
<dl>
<dt>%b</dt><dd><p>In client mode, size of response in bytes, excluding HTTP headers.
In backend mode, the number of bytes received from the backend,
excluding HTTP headers.  In CLF format, i.e. a ‘-’ rather than a 0
when no bytes are sent.</p>
</dd>
<dt>%D</dt><dd><p>In client mode, time taken to serve the request, in microseconds.
In backend mode, time from the request was sent to the entire body
had been received. This is equivalent to %{us}T.</p>
</dd>
<dt>%H</dt><dd><p>The request protocol. Defaults to HTTP/1.0 if not known.</p>
</dd>
<dt>%h</dt><dd><p>Remote host. Defaults to ‘-’ if not known.  In backend mode this is
the IP of the backend server.</p>
</dd>
<dt>%I</dt><dd><p>In client mode, total bytes received from client.  In backend mode,
total bytes sent to the backend.</p>
</dd>
<dt>%{X}i</dt><dd><p>The contents of request header X. If the header appears multiple times
in a single transaction, the last occurrence is used.</p>
</dd>
<dt>%l</dt><dd><p>Remote logname. Always ‘-‘.</p>
</dd>
<dt>%m</dt><dd><p>Request method. Defaults to ‘-’ if not known.</p>
</dd>
<dt>%{X}o</dt><dd><p>The contents of response header X. If the header appears multiple
times in a single transaction, the last occurrence is used.</p>
</dd>
<dt>%O</dt><dd><p>In client mode, total bytes sent to client.  In backend mode, total
bytes received from the backend.</p>
</dd>
<dt>%q</dt><dd><p>The query string. Defaults to an empty string if not present.</p>
</dd>
<dt>%r</dt><dd><p>The first line of the request. Synthesized from other fields, so it
may not be the request verbatim. See the NOTES section.</p>
</dd>
<dt>%s</dt><dd><p>Status sent to the client.  In backend mode, status received from
the backend.</p>
</dd>
<dt>%t</dt><dd><p>In client mode, time when the request was received, in HTTP
date/time format.  In backend mode, time when the request was sent.</p>
</dd>
<dt>%{X}t</dt><dd><p>In client mode, time when the request was received, in the format
specified by X.  In backend mode, time when the request was sent.
The time specification format is the same as for strftime(3) with
these extensions:</p>
<ul class="simple">
<li><p><code class="docutils literal notranslate"><span class="pre">%{sec}</span></code>: number of seconds since the Epoch</p></li>
<li><p><code class="docutils literal notranslate"><span class="pre">%{msec}</span></code>: number of milliseconds since the Epoch</p></li>
<li><p><code class="docutils literal notranslate"><span class="pre">%{usec}</span></code>: number of milliseconds since the Epoch</p></li>
<li><p><code class="docutils literal notranslate"><span class="pre">%{msec_frac}</span></code>: millisecond fraction</p></li>
<li><p><code class="docutils literal notranslate"><span class="pre">%{usec_frac}</span></code>: microsecond fraction</p></li>
</ul>
<p>The extensions can not be combined with each other or strftime(3) in
the same specification. Use multiple <code class="docutils literal notranslate"><span class="pre">%{X}t</span></code> specifications instead.</p>
</dd>
<dt>%T</dt><dd><p>In client mode, time taken to serve the request, in seconds.  In
backend mode, time from the request was sent to the entire body had
been received. This is equivalent to %{s}T.</p>
</dd>
<dt>%{X}T</dt><dd><p>In client mode, time taken to serve the request, in the format
specified by X.  In backend mode, time from the request was sent to
the entire body had been received. The time specification format can
be one of the following: s (same as %T), ms or us (same as %D).</p>
</dd>
<dt>%U</dt><dd><p>The request URL without the query string. Defaults to ‘-’ if not
known.</p>
</dd>
<dt>%u</dt><dd><p>Remote user from auth.</p>
</dd>
<dt>%{X}x</dt><dd><p>Extended variables.  Supported variables are:</p>
<dl>
<dt>Varnish:default_format</dt><dd><p>The log format used when neither -f nor -F options are specified.
Useful for appending/prepending with other formatters.</p>
</dd>
<dt>Varnish:time_firstbyte</dt><dd><p>Time from when the request processing starts until the first
byte is sent to the client, in seconds.  For backend mode: Time
from the request was sent to the backend to the entire header
had been received.</p>
</dd>
<dt>Varnish:hitmiss</dt><dd><p>In client mode, one of the ‘hit’ or ‘miss’ strings, depending on whether
the request was a cache hit or miss. Pipe, pass and synth are considered
misses. In backend mode, this field is blank.</p>
</dd>
<dt>Varnish:handling</dt><dd><p>In client mode, one of the ‘hit’, ‘miss’, ‘pass’, ‘pipe’ or ‘synth’ strings
indicating how the request was handled. In backend mode, this field is
blank.</p>
</dd>
<dt>Varnish:side</dt><dd><p>Backend or client side. One of two values, ‘b’ or ‘c’, depending
on where the request was made. In pure backend or client mode,
this field will be constant.</p>
</dd>
<dt>Varnish:vxid</dt><dd><p>The VXID of the varnish transaction.</p>
</dd>
<dt>VCL_Log:key</dt><dd><p>The value set by std.log(“key:value”) in VCL.</p>
</dd>
<dt>VSL:tag:record-prefix[field]</dt><dd><p>The value of the VSL entry for the given tag-record prefix-field
combination. Tag is mandatory, the other components are optional.</p>
<p>The record prefix will limit the matches to those records that
have this prefix as the first part of the record content followed
by a colon.</p>
<p>The field will, if present, treat the log record as a white
space separated list of fields, and only the nth part of the
record will be matched against. Fields start counting at 1 and
run up to 255.</p>
<p>Defaults to ‘-’ when the tag is not seen, the record prefix
does not match or the field is out of bounds. If a tag appears
multiple times in a single transaction, the first occurrence
is used.</p>
</dd>
</dl>
</dd>
</dl>
</section>
<section id="signals">
<h3>SIGNALS<a class="headerlink" href="#signals" title="Link to this heading">¶</a></h3>
<ul>
<li><p>SIGHUP</p>
<p>Rotate the log file (see -w option) in daemon mode,
abort the loop and die gracefully when running in the foreground.</p>
</li>
<li><p>SIGUSR1</p>
<p>Flush any outstanding transactions.</p>
</li>
</ul>
</section>
<section id="notes">
<h3>NOTES<a class="headerlink" href="#notes" title="Link to this heading">¶</a></h3>
<p>The %r formatter is equivalent to “%m <a class="reference external" href="http:/">http:/</a>/%{Host}i%U%q %H”. This
differs from apache’s %r behavior, equivalent to “%m %U%q %H”.
Furthermore, when using the %r formatter, if the Host header appears
multiple times in a single transaction, the first occurrence is used.</p>
</section>
<section id="example">
<h3>EXAMPLE<a class="headerlink" href="#example" title="Link to this heading">¶</a></h3>
<p>Log the second field of the Begin record, corresponding to the VXID
of the parent transaction:</p>
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="n">varnishncsa</span> <span class="o">-</span><span class="n">F</span> <span class="s2">"%{VSL:Begin[2]}x"</span>
</pre></div>
</div>
<p>Log the entire Timestamp record associated with the processing length:</p>
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="n">varnishncsa</span> <span class="o">-</span><span class="n">F</span> <span class="s2">"%{VSL:Timestamp:Process}x"</span>
</pre></div>
</div>
<p>Log in JSON, using the -j flag to ensure that the output is valid JSON
for all inputs:</p>
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="n">varnishncsa</span> <span class="o">-</span><span class="n">j</span> <span class="o">-</span><span class="n">F</span> <span class="s1">'{"size": %b, "time": "%t", "ua": "%{User-Agent}i"}'</span>
</pre></div>
</div>
</section>
<section id="see-also">
<h3>SEE ALSO<a class="headerlink" href="#see-also" title="Link to this heading">¶</a></h3>
<p><a class="reference internal" href="varnishd.html#varnishd-1"><span class="std std-ref">varnishd</span></a>
<a class="reference internal" href="varnishlog.html#varnishlog-1"><span class="std std-ref">varnishlog</span></a>
<a class="reference internal" href="varnishstat.html#varnishstat-1"><span class="std std-ref">varnishstat</span></a>
<a class="reference internal" href="vsl-query.html#vsl-query-7"><span class="std std-ref">vsl-query</span></a>
<a class="reference internal" href="vsl.html#vsl-7"><span class="std std-ref">VSL</span></a></p>
</section>
<section id="history">
<h3>HISTORY<a class="headerlink" href="#history" title="Link to this heading">¶</a></h3>
<p>The varnishncsa utility was developed by Poul-Henning Kamp in
cooperation with Verdens Gang AS and Varnish Software AS. This manual page was
initially written by Dag-Erling Smørgrav <<a class="reference external" href="mailto:des%40des.no">des<span>@</span>des<span>.</span>no</a>>, and later updated
by Martin Blix Grydeland and Pål Hermunn Johansen.</p>
</section>
<section id="copyright">
<h3>COPYRIGHT<a class="headerlink" href="#copyright" title="Link to this heading">¶</a></h3>
<p>This document is licensed under the same licence as Varnish
itself. See LICENCE for details.</p>
<ul class="simple">
<li><p>Copyright (c) 2006 Verdens Gang AS</p></li>
<li><p>Copyright (c) 2006-2016 Varnish Software AS</p></li>
</ul>
</section>
</section>
</section>

<div class="clearer"></div>
          </div>
        </div>
      </div>
      <div class="sphinxsidebar" role="navigation" aria-label="main navigation">
        <div class="sphinxsidebarwrapper">
  <div>
    <h3><a href="../index.html">Table of Contents</a></h3>
    <ul>
<li><a class="reference internal" href="#">varnishncsa</a><ul>
<li><a class="reference internal" href="#display-varnish-logs-in-apache-ncsa-combined-log-format">Display Varnish logs in Apache / NCSA combined log format</a><ul>
<li><a class="reference internal" href="#synopsis">SYNOPSIS</a></li>
<li><a class="reference internal" href="#description">DESCRIPTION</a></li>
<li><a class="reference internal" href="#modes">MODES</a></li>
<li><a class="reference internal" href="#format">FORMAT</a></li>
<li><a class="reference internal" href="#signals">SIGNALS</a></li>
<li><a class="reference internal" href="#notes">NOTES</a></li>
<li><a class="reference internal" href="#example">EXAMPLE</a></li>
<li><a class="reference internal" href="#see-also">SEE ALSO</a></li>
<li><a class="reference internal" href="#history">HISTORY</a></li>
<li><a class="reference internal" href="#copyright">COPYRIGHT</a></li>
</ul>
</li>
</ul>
</li>
</ul>

</div>
  <div>
    <h4>Previous topic</h4>
    <p class="topless"><a href="varnishlog.html"
                          title="previous chapter">varnishlog</a></p>
  </div>
  <div>
    <h4>Next topic</h4>
    <p class="topless"><a href="varnishhist.html"
                          title="next chapter">varnishhist</a></p>
  </div>
  <div role="note" aria-label="source link">
    <h3>This Page</h3>
    <ul class="this-page-menu">
      <li><a href="../_sources/reference/varnishncsa.rst.txt"
            rel="nofollow">Show Source</a></li>
    </ul>
   </div>
<div id="searchbox" style="display: none" role="search">
  <h3 id="searchlabel">Quick search</h3>
    <div class="searchformwrapper">
    <form class="search" action="../search.html" method="get">
      <input type="text" name="q" aria-labelledby="searchlabel" autocomplete="off" autocorrect="off" autocapitalize="off" spellcheck="false"/>
      <input type="submit" value="Go" />
    </form>
    </div>
</div>
<script>document.getElementById('searchbox').style.display = "block"</script>
        </div>
      </div>
      <div class="clearer"></div>
    </div>
    <div class="related" role="navigation" aria-label="related navigation">
      <h3>Navigation</h3>
      <ul>
        <li class="right" style="margin-right: 10px">
          <a href="../genindex.html" title="General Index"
             >index</a></li>
        <li class="right" >
          <a href="varnishhist.html" title="varnishhist"
             >next</a> |</li>
        <li class="right" >
          <a href="varnishlog.html" title="varnishlog"
             >previous</a> |</li>
        <li class="nav-item nav-item-0"><a href="../index.html">Varnish version 7.5.0 documentation</a> »</li>
          <li class="nav-item nav-item-1"><a href="index.html" >The Varnish Reference Manual</a> »</li>
        <li class="nav-item nav-item-this"><a href="">varnishncsa</a></li> 
      </ul>
    </div>
    <div class="footer" role="contentinfo">
    © Copyright 2010-2014, Varnish Software AS.
      Created using <a href="https://www.sphinx-doc.org/">Sphinx</a> 7.2.6.
    </div>
  </body>
</html>