Hi Gustaf,
Sorry for the confusion on the http log I posted. I was in a hurry and used a rather simple regex to remove the url from the log and in a few cases it truncated the time on the left of the decimal point on the time. So for example the following log entry obviously had it's time truncated because it is missing a digit to the left of the decimal point. (.695438)
httpclient.log.2023-01-04:[04/Jan/2023:13:22:52 -0700] -conn:east_intra:default:17:108483- 408 GET .695438 246 0 socktimeout
However, any times that have 2 or 3 digits to the left of the decimal point are accurate times. I guess, I figured this would be enough to show that we were going past the -expired time.
Also, the log entry times that Tony verified with his comparison between the http log and his debug statements in the error.log are accurate.
Looking back I really should have taken more time with that file. Sorry about that.
We can get you the full log with context times that returned "ok" and full length url. Also, I believe we still have some VM stats for that day at around the time of the event that we can get to you
Thanks for your expertise and patience.
Marty