Although requests from ssl terminators are visible in the udp2log
stream when consuming directly, and also in the edit tsvs [1], none
are visible in the sampled-1000 tsv [2] or the mobile-sampled-100
tsvs [3].

Due to the numbers exposed by the edit tsv we'd expect >1000 lines/day
from ssl terminators in the sampled-1000 tsvs, and >500 lines/day in
the mobile-sampled-100 tsvs due to the edit requests alone.

Are those two streams suffering the same problem as edit tsvs suffered
before 2014-01-14 (bug 60314)?

Let's get the ssl requests into the sampled-1000 and
mobile-sampled-100 tsvs!

(I've been told sampled-1000 is collected independently on two
different hosts. Is the one that does not get mirrored to stat1002
also affected? Not sure which those hosts are. The udp2log filters
live in
https://git.wikimedia.org/tree/operations%2Fpuppet/production/templates%2Fudp2log
)

[1]

qchris@stat1002 0 00:36:41
cwd: ~
zgrep -c '^ssl' /a/squid/archive/edits/edits.tsv.log-20140121.gz
1358968

[2]

qchris@stat1002 0 22:14:02
cwd: ~
zgrep -c '^ssl' /a/squid/archive/sampled/sampled-1000.tsv.log-201401*.gz
/a/squid/archive/sampled/sampled-1000.tsv.log-20140101.gz:0
/a/squid/archive/sampled/sampled-1000.tsv.log-20140102.gz:0
[...]
/a/squid/archive/sampled/sampled-1000.tsv.log-20140113.gz:0
/a/squid/archive/sampled/sampled-1000.tsv.log-20140114.gz:0
/a/squid/archive/sampled/sampled-1000.tsv.log-20140115.gz:0
/a/squid/archive/sampled/sampled-1000.tsv.log-20140116.gz:0
/a/squid/archive/sampled/sampled-1000.tsv.log-20140117.gz:0
/a/squid/archive/sampled/sampled-1000.tsv.log-20140118.gz:0
/a/squid/archive/sampled/sampled-1000.tsv.log-20140119.gz:0
/a/squid/archive/sampled/sampled-1000.tsv.log-20140120.gz:0
/a/squid/archive/sampled/sampled-1000.tsv.log-20140121.gz:0

[3]

qchris@stat1002 0 22:47:06
cwd: ~
zgrep -c '^ssl' /a/squid/archive/mobile/mobile-sampled-100.tsv.log-201401*.gz
/a/squid/archive/mobile/mobile-sampled-100.tsv.log-20140101.gz:0
/a/squid/archive/mobile/mobile-sampled-100.tsv.log-20140102.gz:0
/a/squid/archive/mobile/mobile-sampled-100.tsv.log-20140103.gz:0
/a/squid/archive/mobile/mobile-sampled-100.tsv.log-20140104.gz:0
/a/squid/archive/mobile/mobile-sampled-100.tsv.log-20140105.gz:0
/a/squid/archive/mobile/mobile-sampled-100.tsv.log-20140107.gz:0
/a/squid/archive/mobile/mobile-sampled-100.tsv.log-20140108.gz:0
/a/squid/archive/mobile/mobile-sampled-100.tsv.log-20140109.gz:0
/a/squid/archive/mobile/mobile-sampled-100.tsv.log-20140110.gz:1
/a/squid/archive/mobile/mobile-sampled-100.tsv.log-20140111.gz:0
/a/squid/archive/mobile/mobile-sampled-100.tsv.log-20140112.gz:0
/a/squid/archive/mobile/mobile-sampled-100.tsv.log-20140113.gz:0
/a/squid/archive/mobile/mobile-sampled-100.tsv.log-20140114.gz:0
/a/squid/archive/mobile/mobile-sampled-100.tsv.log-20140115.gz:0
/a/squid/archive/mobile/mobile-sampled-100.tsv.log-20140116.gz:0
/a/squid/archive/mobile/mobile-sampled-100.tsv.log-20140117.gz:0
/a/squid/archive/mobile/mobile-sampled-100.tsv.log-20140118.gz:0
/a/squid/archive/mobile/mobile-sampled-100.tsv.log-20140119.gz:1
/a/squid/archive/mobile/mobile-sampled-100.tsv.log-20140120.gz:2
/a/squid/archive/mobile/mobile-sampled-100.tsv.log-20140121.gz:0

The four matches from the 201401{10,19,20} files are artifacts from an
ssl terminator request line being too long and getting messed up with
a subsequent mobile request line.

Version: unspecified
Severity: normal