{"action":"opened","issue":{"url":"https://api.github.com/repos/varnishcache/pkg-varnish-cache/issues/13","repository_url":"https://api.github.com/repos/varnishcache/pkg-varnish-cache","labels_url":"https://api.github.com/repos/varnishcache/pkg-varnish-cache/issues/13/labels{/name}","comments_url":"https://api.github.com/repos/varnishcache/pkg-varnish-cache/issues/13/comments","events_url":"https://api.github.com/repos/varnishcache/pkg-varnish-cache/issues/13/events","html_url":"https://github.com/varnishcache/pkg-varnish-cache/issues/13","id":134805749,"number":13,"title":"Packaged varnishlog setup is incomplete","user":{"login":"lkarsten","id":108894,"avatar_url":"https://avatars.githubusercontent.com/u/108894?v=3","gravatar_id":"","url":"https://api.github.com/users/lkarsten","html_url":"https://github.com/lkarsten","followers_url":"https://api.github.com/users/lkarsten/followers","following_url":"https://api.github.com/users/lkarsten/following{/other_user}","gists_url":"https://api.github.com/users/lkarsten/gists{/gist_id}","starred_url":"https://api.github.com/users/lkarsten/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lkarsten/subscriptions","organizations_url":"https://api.github.com/users/lkarsten/orgs","repos_url":"https://api.github.com/users/lkarsten/repos","events_url":"https://api.github.com/users/lkarsten/events{/privacy}","received_events_url":"https://api.github.com/users/lkarsten/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2016-02-19T08:37:49Z","updated_at":"2016-02-19T08:37:49Z","closed_at":null,"body":"We currently ship an init script/service file to start varnishlog. This is not enabled by default.\r\n\r\nIf someone enables it with default config, they will get a binary VSL dump in `/var/log/varnish/varnish.log` which most likely will fill their hard drive within a day. (on my debian jessie system)\r\n\r\nI'm assuming the original thought here was that server errors should be logged, so the sysadmin can handle them. I guess logging \"all\" traffic for a single URL could be another use case?\r\n\r\n1) First of all, it is sub-optimal that the near-default config will fill the disk and stop everything. We need to handle that somehow. Sampling or token-bucket based rate limiting have been suggested before. (I don't see increasing logrotate interval as very viable.)\r\n\r\n2) Are we really expecting that people use our tool to read the logs in /var/log/? Shouldn't they be in ASCII format by default, like every other log in there? (=> add -A to the default invocation)\r\n\r\n3) We should also provide examples of VSL queries that can be useful.  My quick hack is using `RespStatus ~ \"^(40[^4]|50.)\"` but that is probably too wide for most systems.\r\n(as in: `/usr/bin/varnishlog -a -A -w /var/log/varnish/varnish.log -D -P /run/varnishlog/varnishlog.pid -q RespStatus ~ \"^(40[^4]|50.)\"` )\r\n\r\nInput welcome.\r\n"}}