Event Logging Formats


%<field symbol>	Description
{HTTP header field}cqh	Logs the information in the requested field of the client request HTTP header; for example, to log the Accept-Language field in client request headers, use: %<{Accept-Language}cqh> This field cannot be used in custom log filters.
{HTTP header field}cqhua	Logs the information in the requested field of the client request HTTP header; for example, to log the User-Agent field in client request headers, use: %<{User-Agent}cqhua>
{HTTP header field}pqh	Logs the information in the requested field of the proxy request HTTP header; for example, to log the Authorization field in proxy request headers, use: %<{Authorization}pqh> This field cannot be used in custom log filters.
{HTTP header field}psh	Logs the information in the requested field of the proxy response HTTP header; for example, to log the Retry-After field in proxy response headers, use: %<{Retry-After}psh> This field cannot be used in custom log filters.
{HTTP header field}ssh	Logs the information in the requested field of the server response HTTP header; for example, to log the Age field in server response headers, use: %<{Age}ssh> This field cannot be used in custom log filters.
caun	The client authenticated user name; result of the RFC931/ident lookup of the client user name.
cfsc	The client finish status code; specifies whether the client request to the proxy was successfully completed (FIN) or interrupted (INTR).
chi	The client host IP; the IP address of the client's host machine.
cqbl	The client request transfer length; the body length in the client's request to Content Gateway in bytes.
cqhl	The client request header length; the header length in the client's request to Content Gateway.
cqhm	The HTTP method in the client request to Content Gateway: GET, POST, and so on (subset of cqtx).
cqhv	The client request HTTP version.
cqtd	The client request time stamp; specifies the date of the client request in the format yyyy-mm-dd, where yyyy is the 4-digit year, mm is the 2-digit month, and dd is the 2-digit day.
cqtn	The client request time stamp; date and time of the client's request (in the Netscape time stamp format).
cqtq	The client request time stamp with millisecond resolution.
cqts	The client request time stamp in Squid format; the time of the client request in seconds since January 1, 1970.
cqtt	The client request time stamp; the time of the client request in the format hh:mm:ss, where hh is the 2-digit hour in 24-hour format, mm is the 2-digit minutes, and ss is the 2-digit seconds. For example, 16:01:19.
cqtx	The full HTTP client request text, minus headers. For example: GET http://www.company.com HTTP/1.0
cqu	The client request URI; universal resource identifier (URI) of the request from client to Content Gateway (subset of cqtx).
cquc	The client request canonical URL; differs from cqu in that blanks (and other characters that might not be parsed by log analysis tools) are replaced by escape sequences. The escape sequence is a percentage sign followed by the ASCII code number in hex.
cqup	The client request URL path; specifies the argument portion of the URL (everything after the host). For example, if the URL is http://www.company.com/images/x.gif, this field displays /images/x.gif.
cqus	The client request URL scheme (HTTP, FTP, etc.).
crc	The cache result code; specifies how the cache responded to the request (HIT, MISS, and so on).
pfsc	The proxy finish status code; specifies whether the Content Gateway request to the origin server was successfully completed (FIN) or interrupted (INTR).
phn	The host name of the Content Gateway server that generated the log entry in collated log files.
phr	The proxy hierarchy route; the route that Content Gateway used to retrieve the object.
pqbl	The proxy request transfer length; the body length in the Content Gateway request to the origin server.
pqhl	The proxy request header length; the header length in the Content Gateway request to the origin server.
pqsi	The proxy request server IP address (0 on cache hits and parent-ip for requests to parent proxies).
pqsn	The proxy request server name; the name of the server that fulfilled the request.
pscl	The proxy response transfer length; the length of the Content Gateway response to the client in bytes.
psct	The proxy response content type; content type of the document (for example, img/gif) from server response header.
pshl	The proxy response header length; the header length in the Content Gateway response to the client.
psql	The proxy response transfer length in Squid format (includes header and content length).
pssc	The proxy response status code; the HTTP response status code from Content Gateway to the client.
shi	The IP address resolved from the DNS name lookup of the host in the request. For hosts with multiple IP addresses, this field records the IP address resolved from that particular DNS lookup. This can be misleading for cached documents. For example, if the first request was a cache miss and came from IP1 for server S and the second request for server S resolved to IP2 but came from the cache, the log entry for the second request will show IP2.
shn	The host name of the origin server.
sscl	The server response transfer length; response length, in bytes, from origin server to Content Gateway.
sshl	The server response header length; the header length in the origin server's response to Content Gateway in bytes.
sshv	The server response HTTP version (1.0, 1.1, and so on).
sssc	The server response status code; the HTTP response status code from origin server to Content Gateway.
ttms	The time Content Gateway spends processing the client request; the number of milliseconds between the time that the client establishes the connection with Content Gateway and the time that Content Gateway sends the last byte of the response back to the client.
ttmsf	The time Content Gateway spends processing the client request as a fractional number of seconds; specifies the time in millisecond resolution, but instead of formatting the output as an integer (as with ttms), the display is formatted as a floating-point number representing a fractional number of seconds. For example, if the time is 1500 milliseconds, this field displays 1.5 while the ttms field displays 1500 and the tts field displays 1.
tts	The time Content Gateway spends processing the client request; the number of seconds between the time that the client establishes the connection with the proxy and the time that the proxy sends the last byte of the response back to the client.
wc	The predefined or custom category of the URL for the data being scanned. For example, "News and Media".
wct	The content type of the web page. For example, "text/html; charset=UTF-8".
wsds	The scan disposition string. For example: CATEGORY_BLOCKED, PERMIT_ALL, FILTERED_AND_PASSED.
wsr	The scan recommended bit ("true" or "false"). The URL database identifies and recommends data that should be analyzed further. Depending on the policy used, the data may or may not be analyzed further.
wstms	The scan time in milliseconds that it took to scan a downloaded file or page.
wui	The authenticated user's ID used to select the policy for scanning data of the client request.