Custom logging fields

%<field symbol> Description
{HTTP header field}cqh

Logs the information in the requested field of the client request HTTP header; for example, to log the Accept- Language field in client request headers, use:

%<{Accept-Language}cqh>

This field cannot be used in custom log filters.
{HTTP header field}cqhua

Logs the information in the requested field of the client request HTTP header; for example, to log the User-Agent field in client request headers, use:

%<{User-Agent}cqhua>
{HTTP header field}pqh

Logs the information in the requested field of the proxy request HTTP header; for example, to log the Authorization field in proxy request headers, use:

%<{Authorization}pqh>

This field cannot be used in custom log filters.
{HTTP header field}psh

Logs the information in the requested field of the proxy response HTTP header; for example, to log the Retry-After field in proxy response headers, use:

%<{Retry-After}psh>

This field cannot be used in custom log filters.
{HTTP header field}ssh

Logs the information in the requested field of the server response HTTP header; for example, to log the Age field in server response headers, use:

%<{Age}ssh>

This field cannot be used in custom log filters.
caun The client authenticated user name; result of the RFC931/ident lookup of the client user name.
cfsc The client finish status code; specifies whether the client request to the proxy was successfully completed (FIN) or interrupted (INTR).
chi The client host IP; the IP address of the client’s host machine.
cqbl The client request transfer length; the body length in the client’s request to Content Gateway in bytes.
cqhl The client request header length; the header length in the client’s request to Content Gateway.
cqhm The HTTP method in the client request to Content Gateway: GET, POST, and so on (subset of cqtx).
cqhv The client request HTTP version.
cqtd The client request time stamp; specifies the date of the client request in the format yyyy-mm-dd, where yyyy is the 4-digit year, mm is the 2-digit month, and dd is the 2-digit day.
cqtn The client request time stamp; date and time of the client’s request (in the Netscape time stamp format).
cqtq The client request time stamp with millisecond resolution.
cqts The client request time stamp in Squid format; the time of the client request in seconds since January 1, 1970.
cqtt The client request time stamp; the time of the client request in the format hh:mm:ss, where hh is the 2-digit hour in 24- hour format, mm is the 2-digit minutes, and ss is the 2-digit seconds. For example, 16:01:19.
cqtx The full HTTP client request text, minus headers. For example: GET http://www.company.com HTTP/1.0
cqu The client request URI; universal resource identifier (URI) of the request from client to Content Gateway (subset of cqtx).
cquc The client request canonical URL; differs from cqu in that blanks (and other characters that might not be parsed by log analysis tools) are replaced by escape sequences. The escape sequence is a percentage sign followed by the ASCII code number in hex.
cqup The client request URL path; specifies the argument portion of the URL (everything after the host). For example, if the URL is http://www.company.com/images/x.gif, this field displays /images/x.gif.
cqus The client request URL scheme (HTTP, FTP, etc.).
crc The cache result code; specifies how the cache responded to the request (HIT, MISS, and so on).
pfsc The proxy finish status code; specifies whether the Content Gateway request to the origin server was successfully completed (FIN) or interrupted (INTR).
phn The host name of the Content Gateway server that generated the log entry in collated log files.
phr The proxy hierarchy route; the route that Content Gateway used to retrieve the object.
pqbl The proxy request transfer length; the body length in the Content Gateway request to the origin server.
pqhl The proxy request header length; the header length in the Content Gateway request to the origin server.
pqsi The proxy request server IP address (0 on cache hits and parent-ip for requests to parent proxies).
pqsn The proxy request server name; the name of the server that fulfilled the request.
pscl The proxy response transfer length; the length of the Content Gateway response to the client in bytes.
psct The proxy response content type; content type of the document (for example, img/gif) from server response header.
pshl The proxy response header length; the header length in the Content Gateway response to the client.
psql The proxy response transfer length in Squid format (includes header and content length).
pssc The proxy response status code; the HTTP response status code from Content Gateway to the client.
shi

The IP address resolved from the DNS name lookup of the host in the request. For hosts with multiple IP addresses, this field records the IP address resolved from that particular DNS lookup. This can be misleading for cached documents.

For example, if the first request was a cache miss and came from IP1 for server S and the second request for server S resolved to IP2 but came from the cache, the log entry for the second request will show IP2.
shn The host name of the origin server.
sscl The server response transfer length; response length, in bytes, from origin server to Content Gateway.
sshl The server response header length; the header length in the origin server’s response to Content Gateway in bytes.
sshv The server response HTTP version (1.0, 1.1, and so on).
sssc The server response status code; the HTTP response status code from origin server to Content Gateway.
ttms The time Content Gateway spends processing the client request; the number of milliseconds between the time that the client establishes the connection with Content Gateway and the time that Content Gateway sends the last byte of the response back to the client.
ttmsf The time Content Gateway spends processing the client request as a fractional number of seconds; specifies the time in millisecond resolution, but instead of formatting the output as an integer (as with ttms), the display is formatted as a floating-point number representing a fractional number of seconds. For example, if the time is 1500 milliseconds, this field displays 1.5 while the ttms field displays 1500 and the tts field displays 1.
tts The time Content Gateway spends processing the client request; the number of seconds between the time that the client establishes the connection with the proxy and the time that the proxy sends the last byte of the response back to the client.
wc The predefined or custom category of the URL for the data being scanned. For example, “News and Media”.
wct The content type of the web page. For example, “text/html; charset=UTF-8”.
wsds The scan disposition string. For example: CATEGORY_BLOCKED, PERMIT_ALL, FILTERED_AND_PASSED.
wsr The scan recommended bit (“true” or “false”). The URL database identifies and recommends data that should be analyzed further. Depending on the policy used, the data may or may not be analyzed further.
wstms The scan time in milliseconds that it took to scan a downloaded file or page.
wui The authenticated user’s ID used to select the policy for scanning data of the client request.