Custom logging fields
%<field symbol> | Description |
---|---|
{HTTP header field}cqh |
Logs the information in the requested field of the client request HTTP header; for example, to log the Accept- Language field in client request headers, use: %<{Accept-Language}cqh> This field cannot be used in custom log filters. |
{HTTP header field}cqhua |
Logs the information in the requested field of the client request HTTP header; for example, to log the User-Agent field in client request headers, use: %<{User-Agent}cqhua> |
{HTTP header field}pqh |
Logs the information in the requested field of the proxy request HTTP header; for example, to log the Authorization field in proxy request headers, use: %<{Authorization}pqh> This field cannot be used in custom log filters. |
{HTTP header field}psh |
Logs the information in the requested field of the proxy response HTTP header; for example, to log the Retry-After field in proxy response headers, use: %<{Retry-After}psh> This field cannot be used in custom log filters. |
{HTTP header field}ssh |
Logs the information in the requested field of the server response HTTP header; for example, to log the Age field in server response headers, use: %<{Age}ssh> This field cannot be used in custom log filters. |
caun | The client authenticated user name; result of the RFC931/ident lookup of the client user name. |
cfsc | The client finish status code; specifies whether the client request to the proxy was successfully completed (FIN) or interrupted (INTR). |
chi | The client host IP; the IP address of the client’s host machine. |
cqbl | The client request transfer length; the body length in the client’s request to Content Gateway in bytes. |
cqhl | The client request header length; the header length in the client’s request to Content Gateway. |
cqhm | The HTTP method in the client request to Content Gateway: GET, POST, and so on (subset of cqtx). |
cqhv | The client request HTTP version. |
cqtd | The client request time stamp; specifies the date of the client request in the format yyyy-mm-dd, where yyyy is the 4-digit year, mm is the 2-digit month, and dd is the 2-digit day. |
cqtn | The client request time stamp; date and time of the client’s request (in the Netscape time stamp format). |
cqtq | The client request time stamp with millisecond resolution. |
cqts | The client request time stamp in Squid format; the time of the client request in seconds since January 1, 1970. |
cqtt | The client request time stamp; the time of the client request in the format hh:mm:ss, where hh is the 2-digit hour in 24- hour format, mm is the 2-digit minutes, and ss is the 2-digit seconds. For example, 16:01:19. |
cqtx | The full HTTP client request text, minus headers. For example: GET http://www.company.com HTTP/1.0 |
cqu | The client request URI; universal resource identifier (URI) of the request from client to Content Gateway (subset of cqtx). |
cquc | The client request canonical URL; differs from cqu in that blanks (and other characters that might not be parsed by log analysis tools) are replaced by escape sequences. The escape sequence is a percentage sign followed by the ASCII code number in hex. |
cqup | The client request URL path; specifies the argument portion of the URL (everything after the host). For example, if the URL is http://www.company.com/images/x.gif, this field displays /images/x.gif. |
cqus | The client request URL scheme (HTTP, FTP, etc.). |
crc | The cache result code; specifies how the cache responded to the request (HIT, MISS, and so on). |
pfsc | The proxy finish status code; specifies whether the Content Gateway request to the origin server was successfully completed (FIN) or interrupted (INTR). |
phn | The host name of the Content Gateway server that generated the log entry in collated log files. |
phr | The proxy hierarchy route; the route that Content Gateway used to retrieve the object. |
pqbl | The proxy request transfer length; the body length in the Content Gateway request to the origin server. |
pqhl | The proxy request header length; the header length in the Content Gateway request to the origin server. |
pqsi | The proxy request server IP address (0 on cache hits and parent-ip for requests to parent proxies). |
pqsn | The proxy request server name; the name of the server that fulfilled the request. |
pscl | The proxy response transfer length; the length of the Content Gateway response to the client in bytes. |
psct | The proxy response content type; content type of the document (for example, img/gif) from server response header. |
pshl | The proxy response header length; the header length in the Content Gateway response to the client. |
psql | The proxy response transfer length in Squid format (includes header and content length). |
pssc | The proxy response status code; the HTTP response status code from Content Gateway to the client. |
shi |
The IP address resolved from the DNS name lookup of the host in the request. For hosts with multiple IP addresses, this field records the IP address resolved from that particular DNS lookup. This can be misleading for cached documents. For example, if the first request was a cache miss and came from IP1 for server S and the second request for server S resolved to IP2 but came from the cache, the log entry for the second request will show IP2. |
shn | The host name of the origin server. |
sscl | The server response transfer length; response length, in bytes, from origin server to Content Gateway. |
sshl | The server response header length; the header length in the origin server’s response to Content Gateway in bytes. |
sshv | The server response HTTP version (1.0, 1.1, and so on). |
sssc | The server response status code; the HTTP response status code from origin server to Content Gateway. |
ttms | The time Content Gateway spends processing the client request; the number of milliseconds between the time that the client establishes the connection with Content Gateway and the time that Content Gateway sends the last byte of the response back to the client. |
ttmsf | The time Content Gateway spends processing the client request as a fractional number of seconds; specifies the time in millisecond resolution, but instead of formatting the output as an integer (as with ttms), the display is formatted as a floating-point number representing a fractional number of seconds. For example, if the time is 1500 milliseconds, this field displays 1.5 while the ttms field displays 1500 and the tts field displays 1. |
tts | The time Content Gateway spends processing the client request; the number of seconds between the time that the client establishes the connection with the proxy and the time that the proxy sends the last byte of the response back to the client. |
wc | The predefined or custom category of the URL for the data being scanned. For example, “News and Media”. |
wct | The content type of the web page. For example, “text/html; charset=UTF-8”. |
wsds | The scan disposition string. For example: CATEGORY_BLOCKED, PERMIT_ALL, FILTERED_AND_PASSED. |
wsr | The scan recommended bit (“true” or “false”). The URL database identifies and recommends data that should be analyzed further. Depending on the policy used, the data may or may not be analyzed further. |
wstms | The scan time in milliseconds that it took to scan a downloaded file or page. |
wui | The authenticated user’s ID used to select the policy for scanning data of the client request. |