Schemas for the proxy Superservice

DLF Schema for Proxy superservice

Schema ID: proxy

Timestamp Field: time

This DLF file is adequate to represent most common informations about web proxy events. It has the same information as found in most proxy-like servers log files.

This schema is adequate for proxy servers beyond web proxys servers. It can be used for socks and other types of connection-level proxies.

The DLF schema was designed by studying the WebTrends Enhanced Log Format, squid log files and thinking about SOCKS type of server.

Fields in the Schema

time: Type: timestamp
Defaults: 0
The time at which the request was initiated.
client_ip: Type: ip
Defaults: -
The IP address of the client.
client_host: Type: hostname
Defaults: -
The hostname of the client.
user: Type: string
Defaults: -
If the client was authenticated, this field should contains the authenticated username.
duration: Type: duration
Defaults: 0
The time taken by the connection.
cache_result: Type: string
Defaults: -
Result code for the cache TCP_MISS, TCP_HIT, etc. List is available on Squid page, and in squid_access2dlf(1). All DLF converter should map their native value to the squid's one which is very complete and exhaustive.
req_result: Type: int
Defaults: -
HTTP result of the request. e.g. 200 or 404.
protocol: Type: string
Defaults: -
The protocol of the proxied request: ftp, http, https, telnet, etc.
transport: Type: string
Defaults: -
The protocol used between the client and the proxy server. This is probably TCP, but can be UDP in some case (like SOCKS or ICP).
dst_ip: Type: ip
Defaults: -
The ip address of the destination.
dst_host: Type: hostname
Defaults: -
The hostname of the destination. In the case of web proxy, that will be the website
dst_port: Type: port
Defaults: -
Port of the destination used in IP session
operation: Type: string
Defaults: -
This field should only be defined in the case of web proxy requests. This should contains the HTTP method requested like GET or POST.
requested_url: Type: url
Defaults: -
This field should only be defined in the case of web proxy request. It should contains the URL requested on the remote server.
bytes: Type: bytes
Defaults: -
The number of bytes transferred from proxy server to the client
type: Type: string
Defaults: -
This field should only be defined for web proxy servers, it should contains the MIME type of the HTTP request's result (e.g. text/html or image/jpeg).
rule: Type: string
Defaults: -
This field contains the configuration rule's name that was used to accept or deny to request.
useragent: Type: string
Defaults: -
The useragent used by the client. E.g. 'Mozilla/4.0 (compatible; MSIE 5.0; Win32)' or 'Outlook Express/5.0 (MSIE 5.0; Windows 98; DigExt)'
result_src_code: Type: string
Defaults: -
Code qualifying the next two fields. (i.e. NONE, DIRECT, PARENT_HIT, etc.) All DLF converter should map their native value to the squid's one which is very complete and exhaustive.
result_src_ip: Type: ip
Defaults: -
The IP address of the server which handled the request, i.e. destination or other cache
result_src_host: Type: hostname
Defaults: -
The hostname of the server that handled the request and gave the result.
result_src_port: Type: port
Defaults: -
Port on referring host used in IP session.
cat_action: Type: string
Defaults: -
This field contains either the value block or pass. It is used when access control is based on content filtering.
cat_site: Type: string
Defaults: -
If the proxy server is doing content analysis, this field should contains the category for the requested website.
catlevel_site: Type: int
Defaults: -
Level can be 1 or 2. 1 meaning "no no" categories. 2 meaning "family fun" categories. This was taken from the WELF specification.
cat_page: Type: string
Defaults: -
Like cat_site, but for the actual page.
catlevel_page: Type: int
Defaults: -
Like catlevel_site, but for the actual page.

Prev	Up	Next
Schemas for the print Superservice	Home	Schemas for the syslog