[Icecast] Understanding two different dual IP address log formats

[Luke]

Hello

On Icecast 2.4.4 (though these logs may be from the previous version), I have two unusual log entry formats showing up.

I'm building a log parser, and am unsure how to categorize these, other than them giving my regular expressions a conniption:

Entry 1:

127.0.0.1 Z.Z.Z.Z - - [02/Oct/2022:12:50:44 +0000] "GET /streamName HTTP/1.1" 200 20765 "-" "Python-urllib/3.8" 1

This one doesn't use the standard proxy format, and additionally involves my loopback somehow?
Yet the very next entry is Z.Z.Z.Z accessing a different stream, without the loopback address involved.

In fact, later that day, Z.Z.Z.Z accesses /streamName again, also without the loopback being prefixed.

So what's going on here?

I note, that in about four years of logs, that was the ONLY entry in this format.

I would delete the line and count it a one-off, except that apparently Icecast can produce such entries for some reason, and without knowing what it was, I can't guarantee it won't happen again.

Entry 2:

X.X.X.X - - Y.Y.Y.Y - - [21/Sep/2022:10:31:21 +0000] "GET /status.xsl HTTP/1.1" 200 4272 "-" "ORB HiSBot..."

Now, I know this is a proxied connection record. But is the proxy and which is the real host?


Are these log deviations documented anywhere? I couldn't find them in the logging section of the manual.

  Thanks for any enlightenment offered!

Luke