vinylncsa(1)

📦

version 9.1.0 · 4 versions

🎀 NAME 🎀

okay so bestie, meet vinylncsa — the little icon whose whole job is displaying Vinyl Cache logs in Apache / NCSA combined log format. yes, that log format, the one every web server on earth speaks. she's giving translator-girlie and honestly she ate 💅

✨ SYNOPSIS ✨

vinylncsa [-0] [-a] [-b] [-c] [-C] [-d] [-D] [-E] [-F <format>] [-f
<formatfile>] [-g <request|vxid>] [-h] [-j] [-k <num>] [-L <limit>] [-n
<workdir>] [-P <file>] [-Q <file>] [-q <query>] [-r <filename>] [-R
<limit[/duration]>] [-t <seconds|off>] [-V] [-w <filename>]

💖 DESCRIPTION 💖

So here's the tea 🍓: vinylncsa reads the vinyld(1) shared memory logs and serves them up in the Apache / NCSA "combined" log format. literally iconic behaviour.

Every single log line she produces is based on one single Request-type transaction that she gathered from the shared memory log. Then that Request transaction gets scanned for the relevant parts so she can output one log line. obsessed with the pipeline ngl.

To filter which log lines actually make it out, you use the query language to pick the applicable transactions. Non-request transactions? ignored, blocked, not invited to the party 🙈

The following options are available:

-0 — Return immediately (i.e. process 0 transactions) if the configuration is valid. This means the process won't try to write a PID file, daemonize, connect to a VSM, or open a log file — but it will run all the other pre-flight operations, including validating the VSL queries. she's just doing a vibe check ✨
-a — When writing output to a file, append to it rather than overwrite it. This option has no effect without the -w option. (sorry bestie, rules are rules.)
-b — Log backend requests. If -c is not specified, then only backend requests will trigger log lines.
-c — Log client requests. This is the default, so she's already on it 💅 If -b is specified, then -c is needed to also log client requests.
-C — Do all regular expression and string matching caseless. case sensitivity walked so she could run 🌈
-d — Process log records at the head of the log and exit.
-D — Daemonize. go off, girl, live your detached life 👑
-E — Show ESI requests, implies client mode.
-F <format> — Set the output log format string.
-f <formatfile> — Read output format from a file. She will read a single line from the specified file, and use that line as the format.
-g <request|vxid> — The grouping of the log records. The default is to group by vxid.
-h — Print program usage and exit.
-j — Make format-specifier replacements JSON-compatible. When escaping characters, use JSON-style \uXXXX escape sequences instead of C-style \xXX sequences. Empty strings will be replaced with "" instead of "-", and empty integers will be replaced with null. Use -F or -f in combination with -j to write JSON logs. json girlies rise 🧚
-k <num> — Process this number of matching log transactions before exiting.
-L <limit> — Sets the upper limit of incomplete transactions kept before the oldest transaction is force completed. A warning record is synthesized when this happens. This setting keeps an upper bound on the memory usage of running queries. Defaults to 1000 transactions.
-n <workdir> — Specify the Vinyl working directory of the instance to attach to. See vinyld(1) -n option documentation for additional information and defaults.
-P <file> — Write the process' PID to the specified file.
-Q <file> — Specifies the file containing the VSL query to use. When multiple -Q or -q options are specified, all queries are considered as if the 'or' operator was used to combine them.
-q <query> — Specifies the VSL query to use. When multiple -q or -Q options are specified, all queries are considered as if the 'or' operator was used to combine them.
-r <filename> — Read log in binary file format from this file. The file can be created with vinyllog -w filename. If the filename is -, logs are read from the standard input, and she cannot work as a daemon.
-R <limit[/duration]> — Restrict the output to the specified limit. Transactions exceeding the limit will be suppressed. The limit is specified as the maximum number of transactions (with respect to the chosen grouping method) and an optional time period. If no duration is specified, a default of s is used. The duration field can be formatted as in VCL (e.g. -R 10/2m) or as a simple time period without the prefix (e.g. -R 5/m). When in -g raw grouping mode, this setting can not be used alongside -i, -I, -x or -X, and we advise using -q instead. ⚠️
-t <seconds|off> — Timeout before returning error on initial VSM connection. If set, the VSM connection is retried every 0.5 seconds for this many seconds. If zero, the connection is attempted only once and will fail immediately if unsuccessful. If set to "off", the connection will not fail, allowing the utility to start and wait indefinitely for the vinyld instance to appear. Defaults to 5 seconds.
-V — Print version information and exit.
-w <filename> — Redirect output to file. The file will be overwritten unless the -a option was specified. If the application receives a SIGHUP in daemon mode the file will be reopened, allowing the old one to be rotated away. This option is required when running in daemon mode. If the filename is -, vinylncsa writes to the standard output and cannot work as a daemon.
--optstring — Print the optstring parameter to getopt(3) to help writing wrapper scripts. for the script kiddies, ily 🫶

ngl bestie, watch out for the -R + -g raw situation — that combo with -i, -I, -x or -X is a no-go, and the manpage itself says use -q instead. she's not being dramatic, she's being accurate 💀

🦋 MODES 🦋

okay so the default mode of vinylncsa is "client mode". In this mode, the log will be similar to what a web server would produce in the absence of Vinyl Cache. Client mode can be explicitly selected by using -c. main character energy, honestly 🌸

If the -b switch is specified, vinylncsa will operate in "backend mode". In this mode, requests generated by Vinyl Cache to the backends will be logged. Unless -c is also specified, client requests received by vinyld will be ignored. bye felicia 👋

When running vinylncsa in both backend and client mode, it is strongly advised to include the format specifier %{Vinyl:side}x to distinguish between backend and client requests. like, please, she's begging you 🙏

Client requests that result in a pipe (ie. return(pipe) in vcl) will not generate logging in backend mode. This is because Vinyl Cache is not generating requests, but blindly passes on bytes in both directions. However, a vinylncsa instance running in normal mode can see this case by using the formatter %{Vinyl:handling}x, which will be 'pipe'. iykyk 🔥

In backend mode, some of the fields in the format string get different meanings. Most notably, the byte counting formatters (%b, %I, %O) consider vinyld to be the client. plot twist 😭

It is possible to keep two vinylncsa instances running — one in backend mode, and one in client mode — logging to different files. twin icons, matching fits, separate diaries 💖✨

🎀 FORMAT 🎀

So like, this is where you tell it what your log lines should actually look like. If you don't specify a format, bestie, you just get the default one:

%h %l %u %t "%r" %s %b "%{Referer}i" "%{User-agent}i"

Escape sequences \n and \t are supported — yes queen, you can put newlines and tabs in there.

Here's the whole lineup of supported formatters, no gatekeeping:

%b — in client mode, size of response in bytes, excluding HTTP headers. In backend mode, the number of bytes received from the backend, excluding HTTP headers. In CLF format, i.e. a '-' rather than a 0 when no bytes are sent.
%D — in client mode, time taken to serve the request, in microseconds. In backend mode, time from the request was sent to the entire body had been received. This is equivalent to %{us}T.
%H — the request protocol. Defaults to HTTP/1.0 if not known.
%h — remote host. Defaults to '-' if not known. In backend mode this is the IP of the backend server.
%I — in client mode, total bytes received from client. In backend mode, total bytes sent to the backend.
%{X[:first|last]}i — the contents of request header X before any VCL processing for client side, and before vcl_backend_response for backend side. If the header appears multiple times in a single transaction, the last occurrence is used in backend mode and the first one in client mode.

If an optional :first or :last is used, VCL processing will be taken into account and the matching rule will be first match or last match respectively. When using :last, unset headers will still be captured. 💅

%l — remote logname. Always '-'. Iconic honestly, does nothing, shows up anyway.
%m — request method. Defaults to '-' if not known.
%{X[:first|last]}o — the contents of response header X, as it was delivered for client mode, and before VCL processing for backend mode. If the header appears multiple times in a single transaction, the last occurrence is used in client mode and the first one in backend mode.

%O — in client mode, total bytes sent to client. In backend mode, total bytes received from the backend.
%q — the query string. Defaults to an empty string if not present.
%r — the first line of the request. Synthesized from other fields, so it may not be the request verbatim. See the NOTES section (I got you, it's below 👇).
%s — status sent to the client. In backend mode, status received from the backend.
%t — in client mode, time when the request was received, in HTTP date/time format. In backend mode, time when the request was sent.
%{X}t — in client mode, time when the request was received, in the format specified by X. In backend mode, time when the request was sent. The time specification format is the same as for strftime(3) with these extensions:
- %{sec}: number of seconds since the Epoch
- %{msec}: number of milliseconds since the Epoch
- %{usec}: number of microseconds since the Epoch
- %{msec_frac}: millisecond fraction
- %{usec_frac}: microseconds fraction

These extensions cannot be combined with each other or with strftime(3) in the same specification. Use multiple %{X}t specifications instead. (one at a time, babe, don't be greedy 🫶)

%T — in client mode, time taken to serve the request, in seconds. In backend mode, time from the request was sent to the entire body had been received. This is equivalent to %{s}T.
%{X}T — in client mode, time taken to serve the request, in the format specified by X. In backend mode, time from the request was sent to the entire body had been received. The time specification format can be one of the following: s (same as %T), ms or us (same as %D).
%U — the request URL without the query string. Defaults to '-' if not known.
%u — remote user from auth.
%{X}x — extended variables. The supported variables are:
- Vinyl:default_format — the log format used when neither -f nor -F options are specified. Useful for appending/prepending with other formatters.
- Vinyl:time_firstbyte — time from when the request processing starts until the first byte is sent to the client, in seconds. For backend mode: time from the request was sent to the backend to the entire header had been received.
- Vinyl:hitmiss — in client mode, one of the 'hit' or 'miss' strings, depending on whether the request was a cache hit or miss. Pipe, pass and synth are considered misses. In backend mode, this field is blank.
- Vinyl:handling — in client mode, one of the 'hit', 'hitmiss', 'hitpass', 'miss', 'pass', 'pipe' or 'synth' strings indicating how the request was handled. In backend mode, this field is blank.
- Vinyl:side — backend or client side. One of two values, 'b' or 'c', depending on where the request was made. In pure backend or client mode, this field will be constant.
- Vinyl:vxid — the VXID of the vinyld transaction.
- VCL_Log:key — the value set by std.log("key:value") in VCL.
- VSL:tag:record-prefix[field] — the value of the VSL entry for the given tag-record prefix-field combination. Tag is mandatory, the other components are optional.

The record prefix will limit the matches to those records that have this prefix as the first part of the record content followed by a colon.

The field will, if present, treat the log record as a white space separated list of fields, and only the *n*th part of the record will be matched against. Fields start counting at 1 and run up to 255.

Defaults to '-' when the tag is not seen, the record prefix does not match or the field is out of bounds. If a tag appears multiple times in a single transaction, the first occurrence is used.

🦋 SIGNALS 🦋

SIGHUP — rotate the log file (see the -w option) in daemon mode, abort the loop and die gracefully when running in the foreground.
SIGUSR1 — flush any outstanding transactions.

⭐ NOTES ⭐

Okay so this part is lowkey important, don't skip it 👀

The %r formatter is equivalent to %m http://%{Host}i%U%q %H. This differs from the Apache HTTP Server %r behavior, which is equivalent to %m %U%q %H. Yes, that's on purpose. No, don't @ me.

Note that request fields are collected on a first match basis in client mode and last match basis in backend mode. Similarly, response fields are collected on a first match basis in backend mode and last match basis in client mode.

In other words, request headers are logged as they were received from the client and as they were sent to the backend, while response headers are logged as they were sent to the client and as they were received from the backend. It's giving "both sides of the story" energy fr fr.

Furthermore, these rules also apply to items that appear multiple times in a transaction. For example, if a header appears multiple times in a client request, the first occurrence is logged in client mode, while in backend mode the last occurrence is logged.

Prior to 7.7, formats %{X}i and %{X}o used to include header fields populated from VCL. Consider %{VCL_Log:key}x instead to capture data from VCL transactions. (glow-up behaviour change, bestie 💅)

🌈 EXAMPLE 🌈

Log the second field of the Begin record, corresponding to the VXID of the parent transaction:

vinylncsa -F "%{VSL:Begin[2]}x"

Log the entire Timestamp record associated with the processing length:

vinylncsa -F "%{VSL:Timestamp:Process}x"

vinylncsa -j -F '{"size": %b, "time": "%t", "ua": "%{User-Agent}i"}'

Log the first and last values of a request header that is modified multiple times in VCL:

vinylncsa -F "%{x-custom-header:first}i %{x-custom-header:last}i"

go read those next, bestie, they're literally the rest of the lore 🫶

🎀 HISTORY 🎀

The vinylncsa utility was developed by Poul-Henning Kamp in cooperation with Verdens Gang AS and Redpill-Linpro. This manual page was initially written by Dag-Erling Smørgrav <<des@des.no>>, and later updated by Martin Blix Grydeland and Pål Hermunn Johansen. absolute icons, all of them 👑

💜 COPYRIGHT 💜

This document is licensed under the same licence as Vinly Cache itself. See LICENCE for details.

and that's the whole page, babe ✨ you made it to the end — check the footer for the exact source, version and date stamp of vinylncsa(1) if you need the receipts, and slay your logging journey 💖🎀🦋

📦 where this page comes from

arch rolling: vinyl-cache 9.1.0-1 · BSD-2-Clause
📜 the page's license: BSD-2-Clause
💖 girlified by deepseek-ai/DeepSeek-V4.1-Flash-1017 on 2026-11-04: a language model's rewrite of the original, under its terms