Cisco Cisco Web Security Appliance S390 Betriebsanweisung
I N C L U D I N G H T T P / H T T P S H E A D E R S I N L O G F I L E S
C H A P T E R 2 0 : L O G G I N G
459
I N C L U D I N G H T T P / H T T P S H E A D E R S I N L O G F I L E S
If the list of predefined access log and W3C log fields does not include all header information
you want to log from HTTP/HTTPS transactions, you can type a user defined log field in the
Custom Fields text box when you configure the access and W3C log subscriptions.
you want to log from HTTP/HTTPS transactions, you can type a user defined log field in the
Custom Fields text box when you configure the access and W3C log subscriptions.
Custom log fields can be any data from any header sent from the client or the server. If a
request or response does not include the header added to the log subscription, the log file
includes a hyphen as the log field value.
request or response does not include the header added to the log subscription, the log file
includes a hyphen as the log field value.
Table 20-12 defines the syntax to use for access and W3C logs.
For example, if you want to log the If-Modified-Since header value in client requests, enter the
following text in the Custom Fields box for a W3C log subscription:
following text in the Custom Fields box for a W3C log subscription:
cs(If-Modified-Since)
Table 20-12 Configuring HTTP/HTTPS Headers in Log Files
Header Type
Access Log Format
Specifier Syntax
Specifier Syntax
W3C Log Custom Field Syntax
Header from the client
application
application
%<ClientHeaderName:
cs(ClientHeaderName)
Header from the server
%<ServerHeaderName: sc(ServerHeaderName)