Whist investigating an orthogonal logging issue I encountered a couple of differences between squid/varnish which I didn't know about:
* Varnish does not give subsecond request time information * Varnish does give subsecond request processing time info * Varnish calls it 'hit/200' or 'miss/302' instead of 'TCP_MEM_HIT/200' or 'TCP_MISS/302' * Varnish does not URL encode the user agent field
Example log lines: amssq41.esams.wikimedia.org 1013692039 2013-07-31T23:00:02.331 0 XXX TCP_MEM_HIT/200 614 GET http://meta.wikimedia.org/XXX NONE/- image/png http://en.wikipedia.org/XXX - Mozilla/5.0%20(Wind... en-US en;q=0.8 - cp1006.eqiad.wmnet 1442176851 2013-07-31T23:00:02.452 0 XXX TCP_MISS/302 406 GET http://meta.wikimedia.org/XXX NONE/- - http://en.m.wikipedia.org/XXX - Mozilla/5.0%20(i.... en-us - cp3012.esams.wikimedia.org 823553992 2013-07-31T23:00:02 0.000119448 XXX hit/200 20 GET http://meta.m.wikimedia.org/XXX - image/png http://de.m.wikipedia.org/XXX XXX Mozilla/5.0 (iPho... de-de -
~Matt Walker Wikimedia Foundation Fundraising Technology Team