Bad values in log collation messages?

[Jack Bates <6n...@nottheoilrig.com>]

I'm seeing just a few weird values in the messages from Traffic Server
log collation clients. Here is an example message, a test script to
inspect it, and the output from the script:

  * http://nottheoilrig.com/trafficserver/201212280/data
  * http://nottheoilrig.com/trafficserver/201212280/test
  * http://nottheoilrig.com/trafficserver/201212280/stdout

The message has mostly normal values, but the log entry from bytes
2924:3348 has some gibberish values (the client_host_ip is normal, but
the client_req_http_method, client_req_url_canon, and server_host_name
are each gibberish)

Here is the substring from bytes 2924:3348:
http://nottheoilrig.com/trafficserver/201212280/2924:3348

The test script finds normal log entries after these gibberish values,
so the log entry or log buffer aren't completely corrupt.

I tried running traffic_logcat on the message to see what it made of it,
but it complained "Bad LogBuffer!" I'm not sure if this is because of
the gibberish values or because log collation messages are not the same
format as logs stored on the disk?

> $ trafficserver-3.2.0/proxy/traffic_logcat data
> Bad LogBuffer!
> $

The log collation client is Traffic Server version 3.2.0

I'll keep investigating, but does anyone have any tips on what to try,
or insight into what might be happening here?

I made some progress on a script to visualize Traffic Server statistics
[1]. It now shows bar charts for the top clients and the top servers,
and it shows the proportion of cache hits. I'm working on a scatter plot
to show the relationship between clients and servers. Here's what it
looks like at the moment:
http://nottheoilrig.com/visulate/

  [1] https://github.com/jablko/visulate