From 922d7cce40923abb9eba6bb0038817f0e6073486 Mon Sep 17 00:00:00 2001
From: Chris Pepper This module provides for forensic logging of client
requests. Logging is done before and after processing a request, so the
forensic log contains two log lines for each request.
- The forensic logger works very strict, which means:
In order to evaluate the log output there's a script
- check_forensic
, which can be found in the support directory
- of the distribution.
The check_forensic
script, which can be found in the
+ distribution's support directory, may be helpful in evaluating the
+ forensic log output.
In order to identify each request, a unique request ID is assigned.
- This forensic id can be cross logged in the normal transfer log using the
+ This forensic ID can be cross logged in the normal transfer log using the
%{forensic-id}n
format string. If you're using
-
The first line logs the forensic ID, the request line and all received
headers, separated by pipe characters (|
). A sample line
@@ -72,13 +72,13 @@
The plus character at the beginning indicates that this is first log line of this request. The second line just contains a minus character and - the id again:
+ the ID again:The check_forensic
script gets as its argument the name
+
The check_forensic
script takes as its argument the name
of the logfile. It looks for those +
/-
ID pairs
and complains if a request was not completed.
The forensic-id
which can be added to the transfer log by
+ directive. forensic-id
, which can be added to the transfer log
using the %{forensic-id}n
format string.
The argument, which specifies the location to which -- 2.50.1