线上日志格式定义如下

% % % [%] %<{X-Forwarded-For}cqh> "%" % "%" %:% %<{Referer}cqh> "%<{User-Agent}cqh>" %"/>

实例如下：

1432194201.810 8945 200 200  [15:43:21] 211.143.88.220 "GET http://111.13.140.12:80/youku/697814A886D39744A94514B27/03000208005506A3413AA803BAF2B1552E0345-4545-BEED-FC67-17B76E3C0F6D.flv HTTP/1.1" 12979938 "*Not IP address [0]*" TCP_MEM_HIT:NONE http://v.youku.com/v_show/id_XOTEzMjM1Njgw.html?from=y1.3-idx-grid-1519-9909.86808-86807.3-1 "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Trident/4.0;)" video/x-flv

1432118160.693 348 200 200 [18:36:00] 10.10.110.142 "GET http://123.126.104.80:80/sohu/s26h23eab6/v1/TmwATmw7qKINgmNVqF16q6bV0esvD6sRPVcXNhWL5m47fFoGRMNiNw.mp4?k=zjXjSK&p=XZhuOp3AjfK&r=TmI20LscWOoCNLfcWOyXwmXAyBj&q=OpCBhW7IWJodRDbsfhASotE7ZDvOfhXOfJ1HfhAHfhysvmbcWJWXfGdtZhNSqD24WYoUZDJ&cip=221.220.19.171 HTTP/1.1" 1010003 "123.126.104.80" TCP_MISS:DIRECT http://tv.sohu.com/20140502/n399076828.shtml "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.101 Safari/537.36" video/mp4

分解指示如下：

各域名字段说明如下：

{HTTP header field name} cqh  Logs the information in the requested field of the client request HTTP header

cqtq  

The client request timestamp, with millisecond resolution，unix timestamp，单位是毫秒

ttms  

The time Traffic Server spends processing the client request(处理该请求的总耗时，单位是毫秒，这个时间包括了ATS回源时间stms); the number of milliseconds between the time the client establishes the connection with Traffic Server and the time Traffic Server sends the last byte of the response back to the client.

pssc  

The HTTP response status code from Traffic Server to the client

sssc  

The HTTP response status code from origin server to Traffic Server

cqtt  

The client request timestamp. The time of the client request in the format hh:mm:ss, where hh is the two-digit hour in 24-hour format, mm is the two-digit minutes value,and ss is the 2-digit seconds value (for example, 16:01:19).

{X-Forwarded-For}cqh

X-Forwarded-For header

cqtx 

The full HTTP client request text, minus headers; for example,GET http://www.company.com HTTP/1.0; In reverse proxy mode, Traffic Server logs the rewritten/mappedURL (according to the rules in remap.config), _not_ the pristine/unmapped URL.

psql 

The proxy response transfer length in Squid format (includes header and content length).

pqsi 

The proxy request server IP address (0 on cache hits and parent-ip for requests to parent proxies).

crc  

The cache result code; specifies how the cache responded to the request (HIT, MISS, and so on).

phr  

The proxy hierarchy route; the route Traffic Server used to retrieve the object.

{Referer}cqh  

Referer header

{User-Agent}cqh   

User-Agent header

psct 

The content type of the document from server response header: (for example, img/gif ).

更详细的字段分析参见下面的参考文献[1].

参考文献

[1].http://trafficserver.readthedocs.org/en/latest/admin/event-logging-formats.en.html