Summary Logs¶

Due to the speed and efficiency of Traffic Server, a heavily-loaded node will generate many events and the event logs can quickly grow to very large sizes. Using SQL-like aggregate operators, you can configure Traffic Server to create summary log files that summarize a set of log entries over a specified period of time. This can significantly reduce the size of the log files generated.

To generate a summary log file, create a LogFormat object in the XML-based logging configuration logs_xml.config using the SQL-like aggregate operators below. You can apply each of these operators to specific fields, over a specified interval.

COUNT
SUM
AVERAGE
FIRST
LAST

To create a summary log file format:

Define the format of the log file in logs_xml.config as follows:
```
<LogFormat>
  <Name = "summary"/>
  <Format = "%<operator(field)> : %<operator(field)>"/>
  <Interval = "n"/>
</LogFormat>
```
Where operator is one of the five aggregate operators (COUNT, SUM, AVERAGE, FIRST, LAST); field is the logging field you want to aggregate; and n is the interval (in seconds) between summary log entries.

You can specify more than one operator in the format line. For more information, refer to logs_xml.config.
Run the command traffic_line -x to apply configuration changes .

The following example format generates one entry every 10 seconds. Each entry contains the timestamp of the last entry of the interval, a count of the number of entries seen within that 10-second interval, and the sum of all bytes sent to the client:

<LogFormat>
  <Name = "summary"/>
  <Format = "%<LAST(cqts)> : %<COUNT(*)> : %<SUM(psql)>"/>
  <Interval = "10"/>
</LogFormat>

重要

You cannot create a format specification that contains both aggregate operators and regular fields. For example, the following specification would be invalid:

<Format = "%<LAST(cqts)> : %<COUNT(*)> : %<SUM(psql)> : %<cqu>"/>