Go to the table of contents Go to the previous page Go to the next page View or print as PDF
logs_xml.config
Help | Content Gateway | v8.5.x
The logs_xml.config file defines the custom log file formats, filters, and processing options. The format of this file is modeled after XML, the Extensible Markup Language.
Format
The logs_xml.config file contains the following specifications:
*
*
*
 
Note 
The logs_xml.config file ignores extra white space, blank lines, and all comments.
LogFormat
The following table lists the LogFormat specifications.
 
*
*
LogFilter
The following table lists the LogFilter specifications.
 
LogObject
The following table lists the LogObject specifications.
 
Examples
The following is an example of a LogFormat specification collecting information using three common fields:
<LogFormat>
   <Name = "minimal"/>
   <Format = "%<chi> : %<cqu> : %<pssc>"/>
</LogFormat>
The following is an example of a LogFormat specification using aggregate operators:
<LogFormat>
   <Name = "summary"/>
   <Format = "%<LAST(cqts)> : %<COUNT(*)> : %<SUM(psql)>"/>
   <Interval = "10"/>
</LogFormat>
The following is an example of a LogFilter that will cause only REFRESH_HIT entries to be logged:
<LogFilter>
   <Name = "only_refresh_hits"/>
   <Action = "ACCEPT"/>
   <Condition = "%<pssc> MATCH REFRESH_HIT"/>
</LogFilter>
 
Note 
The following is an example of a LogObject specification that creates a local log file for the minimal format defined earlier. The log filename will be minimal.log because this is an ASCII log file (the default).
<LogObject>
   <Format = "minimal"/>
   <Filename = "minimal"/>
</LogObject>
The following is an example of a LogObject specification that includes only HTTP requests served by hosts in the domain company.com or by the specific server server.somewhere.com. Log entries are sent to collation host logs.company.com on port 4000 and to collation host 209.131.52.129 on port 5000.
<LogObject>
   <Format = "minimal"/>
   <Filename = "minimal"/>
   <ServerHosts = "company.com,server.somewhere.com"/>
   <Protocols = "http"/>
   <CollationHosts = "logs.company.com:4000,209.131.52.129:5000"/>
</LogObject>
WebTrends Enhanced Log Format (WELF)
Content Gateway supports WELF so that you can analyze Content Gateway log files with WebTrends reporting tools. A predefined <LogFormat> that is compatible with WELF is provided at the end of the logs.config file (shown below). To create a WELF format log file, create a <LogObject> that uses this predefined format.
<LogFormat>
   <Name = "welf"/>
   <Format = "id=firewall time=\"%<cqtd> %<cqtt>\" fw=%<phn> pri=6 proto=%<cqus> duration=%<ttmsf> sent=%<psql> rcvd=%<cqhl> src=%<chi> dst=%<shi> dstname=%<shn> user=%<caun> op=%<cqhm> arg=\"%<cqup>\" result=%<pssc> ref=\"%<{Referer}cqh>\" agent=\"%<{user-agent}cqh>\" cache=%<crc>"/>
</LogFormat>

Go to the table of contents Go to the previous page Go to the next page View or print as PDF
Copyright 2020 Forcepoint. All rights reserved.