# P3 hub access log (/data/access-log, R-1140) aggregates, read in the running hub pod 2026-10-23T15:28:30Z. Lines carry path/status/remote/xff/cred/auth only.
files: access-2026-10-18.log
access-2026-10-19.log
access-2026-10-20.log
access-2026-10-21.log
access-2026-10-22.log
access-2026-10-23.log
first line: 2026-10-18T10:25:05Z
lines total: 12764
== remote= values (count)
  12481 remote=10.42.0.200
    210 remote=10.42.0.1
     54 remote=10.42.0.213
     19 remote=10.42.0.107
== xff= first hop, grouped by /24 (count) — positive control: ingress traffic must show a client here
  11728 192.168.0.x
    762 37.191.56.x
     38 176.77.140.x
      4 176.77.139.x
      3 10.42.0.x
== any remote or xff in the pod CIDR 10.42.x other than the ingress 10.42.0.200 (count, then lines)
283
2026-10-18T10:28:45Z GET /healthz 200 0ms remote=10.42.0.1 xff=- cred=- auth=-
2026-10-18T10:28:45Z GET /bind/[redacted] 200 0ms remote=10.42.0.1 xff=- cred=- auth=-
2026-10-18T10:28:45Z GET /configuration 302 0ms remote=10.42.0.1 xff=- cred=- auth=-
2026-10-18T10:28:45Z GET /api/v1/wait 401 0ms remote=10.42.0.1 xff=- cred=bearer+session-cookie auth=-
2026-10-18T10:28:45Z POST /login 401 187ms remote=10.42.0.1 xff=- cred=- auth=-
2026-10-18T10:29:00Z GET /configuration 200 1403ms remote=10.42.0.1 xff=- cred=token auth=token
2026-10-18T10:29:02Z GET /configuration/artifacts 403 0ms remote=10.42.0.1 xff=- cred=token auth=-
2026-10-18T10:29:10Z GET /configuration 200 7ms remote=10.42.0.1 xff=- cred=token auth=token
2026-10-18T10:39:55Z GET /api/v1/admin/hosts/demo-hp-bb76ea/recovery-credential 200 9ms remote=10.42.0.1 xff=- cred=bearer auth=global
2026-10-18T10:43:43Z GET /api/v1/admin/hosts/demo-hp-bb76ea/recovery-credential 200 0ms remote=10.42.0.1 xff=- cred=bearer auth=global
2026-10-18T10:55:13Z POST /api/v1/admin/hosts/demo-hp-bb76ea/jobs 201 26ms remote=10.42.0.1 xff=- cred=bearer auth=global
2026-10-18T10:55:13Z POST /api/v1/admin/hosts/demo-hp-bb76ea/jobs 201 4ms remote=10.42.0.1 xff=- cred=bearer auth=global
2026-10-18T11:09:23Z POST /customers/tester-1/floor 303 13ms remote=10.42.0.1 xff=- cred=token auth=token
2026-10-18T11:09:24Z POST /customers/demo-hp/floor 303 11ms remote=10.42.0.1 xff=- cred=token auth=token
2026-10-18T11:09:24Z POST /customers/demo-felhom/floor 303 9ms remote=10.42.0.1 xff=- cred=token auth=token
2026-10-18T11:10:59Z POST /configuration/global-floor 303 39ms remote=10.42.0.1 xff=- cred=token auth=token
2026-10-18T11:10:59Z POST /customers/tester-1/floor 303 8ms remote=10.42.0.1 xff=- cred=token auth=token
2026-10-18T11:11:00Z POST /customers/demo-hp/floor 303 11ms remote=10.42.0.1 xff=- cred=token auth=token
2026-10-18T11:11:00Z POST /customers/demo-felhom/floor 303 7ms remote=10.42.0.1 xff=- cred=token auth=token
2026-10-18T12:22:00Z POST /api/v1/admin/hosts/tester-1-d70be4/jobs 201 14ms remote=10.42.0.1 xff=- cred=bearer auth=global
== negative-control search: plex pod IP 10.42.0.52 anywhere
0
== credentialed requests (cred!=none) by xff and auth (count)
   2511 xff=192.168.0.155 cred=bearer auth=customer
   2444 xff=192.168.0.149 cred=bearer auth=customer
   1889 xff=192.168.0.148 cred=bearer auth=customer
   1272 xff=192.168.0.110 cred=session-cookie auth=session
    552 xff=192.168.0.104 cred=bearer auth=host
    549 xff=37.191.56.193 cred=bearer auth=host
    531 xff=192.168.0.154 cred=bearer auth=host
    523 xff=192.168.0.101 cred=bearer auth=customer
    444 xff=192.168.0.133 cred=bearer auth=customer
    263 xff=192.168.0.134 cred=bearer auth=-
    261 xff=192.168.0.151 cred=bearer auth=customer
    241 xff=192.168.0.125 cred=bearer auth=customer
    173 xff=37.191.56.193 cred=bearer auth=customer
    160 xff=- cred=token auth=token
    130 xff=192.168.0.139 cred=bearer auth=customer
    112 xff=192.168.0.128 cred=bearer auth=host
     95 xff=192.168.0.134 cred=bearer auth=host
     48 xff=192.168.0.128 cred=bearer auth=-
     42 xff=192.168.0.159 cred=bearer auth=-
     32 xff=192.168.0.110 cred=session-cookie auth=-
     32 xff=- cred=bearer auth=global
     27 xff=192.168.0.133 cred=bearer auth=host
     23 xff=176.77.140.26 cred=session-cookie auth=session
     22 xff=192.168.0.157 cred=bearer auth=customer
     22 xff=192.168.0.135 cred=bearer auth=customer
     20 xff=192.168.0.109 cred=bearer auth=-
     15 xff=176.77.140.26 cred=session-cookie auth=-
     14 xff=192.168.0.128 cred=passphrase auth=-
     13 xff=- cred=token auth=-
      9 xff=37.191.56.193 cred=session-cookie auth=session

== lines with xff in 10.42.x (all)
2026-10-23T13:00:38Z GET / 302 0ms remote=10.42.0.200 xff=10.42.0.1 cred=- auth=-
2026-10-23T13:02:09Z GET / 302 0ms remote=10.42.0.200 xff=10.42.0.1 cred=- auth=-
2026-10-23T14:00:08Z GET / 302 0ms remote=10.42.0.213 xff=10.42.0.1 cred=- auth=-
== remote=10.42.0.213: first/last and path set
2026-10-23T14:00:08Z GET / 302 0ms remote=10.42.0.213 xff=10.42.0.1 cred=- auth=-
2026-10-23T15:21:24Z GET /api/v1/wait 200 240000ms remote=10.42.0.213 xff=37.191.56.193 cred=bearer auth=customer
      8 GET / 200
      2 GET / 302
     22 GET /api/v1/wait 200
      1 GET /configuration 200
      4 GET /hosts 200
      1 GET /login 200
      1 GET /style.css 200
      6 POST /api/v1/host-report 200
      7 POST /api/v1/report 200
      1 POST /appliances/49/discard 303
      1 POST /login 303
== remote=10.42.0.107 = this session's probe pod cc-p2s-probe (positive control: a direct pod call is logged with the pod IP)
2026-10-23T15:20:21Z GET / 302 0ms remote=10.42.0.107 xff=- cred=- auth=-
2026-10-23T15:22:25Z GET /healthz 200 0ms remote=10.42.0.107 xff=- cred=- auth=-
2026-10-23T15:22:25Z GET / 302 0ms remote=10.42.0.107 xff=- cred=- auth=-
