Understand Secure Web Appliance Accesslogs

Section

Sample from Accesslog

Format Specifier

Details

Epoch time

1726597763.348 

%t

Epoch time (often called Unix time or POSIX time) is a system for tracking time by counting the total number of seconds (or milliseconds/microseconds) that have elapsed since January 1, 1970, at 00:00:00 UTC

The Epoch time of when the transaction was finished.

You can convert this value by on-line Epoch time converter or any linux operating system.

Elapsed Time

68855 

%e

The amount of milliseconds the request took before it was completed/aborted and the connection closed. 

Source IP address

192.168.1.10 

%a

 Client/Source IP address.

Transaction Result Code

TCP_MISS

%w

Transaction Result Code indicates how the SWA resolves client requests. 

Here are the list of the Transaction Result Codes:

HTTP Response Code

/200

%h

The HTTP Response Code represents the status code returned by the web server in response to the client HTTP request. 

Here are the list of the most important HTTP Response Code, ( For more information kindly visit HTTP Response Code section in this article)

Total Size Transferred 

97645

%s

Total transferred Bytes for the request.

HTTP Method

TCP_CONNECT

%1r

An HTTP method is a standardized way for a client to specify the desired action to be performed on a resource by a web server, such as retrieving data with GET or submitting data with POST.

Destination

10.37.145.84:443 

%2r

This section, shows the destination server URL and TCP port number.

In transparent redirection, before the traffic gets decrypted, SWA shows the destination IP address and port number.

If the URL starts with tunnel:// it means SWA did not decrypt the traffic yet.

If the URL starts with https:// it means SWA decrypts the traffic.

User name and Authentication Realm 

"AMOJARRA\amirhossein@WCCPrealm"

%A

Credentials used for this connection. 

If the request gets authenticated, SWA logs the user name and the Authentication realms as:

<Domain Name> \ <User Name> @ <Authentication Realm Name>

If the request is not authenticated yet or is exempt from authentication, in the log you see hyphen "-"

Access Type

DIRECT/

%H

Code that describes which server was contacted for the retrieving the request content.

Most common values include:

Server Address

www.cisco.com

%d

Data source or server IP address.

MIME content-type/subtype

- 

%c

 MIME Indicates the nature and format of a document, file or assortment of bytes. MIME types are defined and standardized in IETF RFC 6838

Two primary MIME types are important for the role of default types:

• text/plain is the default value for textual files. A textual file must be human-readable and must not contain binary data.
• application/octet-stream is the default value for all other cases. An unknown file type must use this type. Browsers pay a particular care when manipulating these files, to protect users from software vulnerabilities and possible dangerous behavior.

To get a full list of MIME type please visit: Media Types (iana)

ACL Decision Tag

PASSTHRU_CUSTOMCAT_7-

%D

An ACL decision tag is a field in an access log entry that indicates how the Web Proxy handled the transaction. It includes information from the Web Reputation filters, URL categories, and the scanning engines.

Note: The end of the ACL decision tag includes a dynamically generated number that the Web Proxy uses internally to increase performance. You can ignore this number.

Here is a list of the most important ACL Decision Tags. (For more information please visit ACL Decision Tag section in this article)

Policy Name

DP_site-

N/A

Depends on the type of the traffic, this shows the:

• Decryption Policy name: If the traffic is HTTPS and is not decrypted yet
• Access Policy name: If the traffic is HTTP or is decrypted. 

Identity Policy

IdP_Site-

N/A

Shows the Identification Profile name

Outbound Malware Scanning Policy Group

NONE-

N/A

Outbound Malware Scanning Policy group name.

Any space in the policy group name is replaced with an underscore ( _ )

Data Security Policy Group 

NONE-

N/A

Cisco Data Security Policy group name. When the transaction matches the global Cisco Data Security Policy, this value is DefaultGroup. This policy group name only appears when Cisco Data Security Filters is enabled. “NONE” appears when no Data Security Policy was applied.

Any space in the policy group name is replaced with an underscore ( _ )

External DLP Policy Group

NONE-

N/A

When the transaction matches the global External DLP Policy, this value is DefaultGroup. “NONE” appears when no External DLP Policy was applied.

Any space in the policy group name is replaced with an underscore ( _ ).

Routing Policy Group

DefaultGroup-

N/A

Routing Policy group name asProxyGroupName/ProxyServerName.

When the transaction matches the global Routing Policy, this value is DefaultRouting. When no upstream proxy server is used, this value is DIRECT

Any space in the policy group name is replaced with an underscore ( _ ).

Web Traffic Tap

NONE 

N/A

Web Traffic Tap Policy name.

URL Category Abbreviation

<"C_Cisc",

%XC

URL Category that that the request is matching.

Web Reputation Score

-,

%XW

This field shows the Web Reputation (WBRS) score.

ns means the URL has no score.

Webroot Scanning 

-,"-",-,-,-,

These 5 fields are related to Webroot scanning

McAfee Scanning

-,"-",-,-,-,"-",

These 6 fields are related to McAfee scanning.

Sophos Scanning

-,-,"-","-",

These 4 fields are related to Sophos scanning

Cisco Data Security Scan Verdict

-,

%Xl

The Cisco Data Security scan verdict based on the action in the Content column of the Cisco Data Security Policy.

This list describes the possible values for this field:

0.Allow

1.Block

- (hyphen).No scanning was initiated by the Cisco Data Security Filters. This value appears when the Cisco Data Security Filters are disabled, or when the URL category action is set to Allow.

External DLP Scan Verdict

-,

%Xp

The External DLP scan verdict based on the result given in the ICAP response.

This list describes the possible values for this field:

0.Allow

1.Block

- (hyphen).No scanning was initiated by the external DLP server. This value appears when External DLP scanning is disabled, or when the content was not scanned due to an exempt URL category on the External DLP Policies > Destinations page.

Predefined URL Category Verdict

"-",

%XQ

The predefined URL category verdict determined during request-side scanning, abbreviated.

This field lists a hyphen ( - ) when URL filtering is disabled.

If the request hits a Custom URL Category, you can still see the predefined URL category name in your Accesslog but the decision was taken by the custom URL category.

For a list of URL category abbreviations, seeURL Category Descriptions.

URL Category Verdict

-,

%XA

The URL category verdict determined by the Dynamic Content Analysis (DCA) engine during response-side scanning, abbreviated.

Applies to the Cisco Web Usage Controls URL filtering engine only.

nc: This value appears in the request-side scanning verdict when the Dynamic Content Analysis engine is enabled and no URL category is assigned at request time, indicating the URL is un-categorized during the initial request phase before response-side scanning categorizes it

Unified Inbound DVS Verdict

"-",

%XZ

Unified response-side Anti-Malware scanning verdict that provides the Malware category independent of which scanning engines are enabled. Applies to transactions blocked or monitored due to server response scanning.

Web Reputation Filter Threat Type 

"-",

%Xk

The Category Name or Threat Type is returned by the Web Reputation filters. The Category Name is returned when the Web Reputation is high and Threat Type returned when the reputation is low.

Typically, this field is populated for sites at reputation of -4 and below.

Google Translate Encapsulated URL

"-",

%X#10#

The URL which is encapsulated inside Google translate engine. If there is no encapsulated URL, the field value be “-”.

Application Control  (AVC/ADC) 

"-","-","-",

In these 3 fields statistics of Application Visibility and Control (AVC) and Application Discovery and Control (ADC) are logged.

Safe Browsing Verdict

"-",

%XS

This value indicates whether either the safe search or the site content ratings feature was applied to the transaction.

Average Bandwidth

11.35,

%XB

The average bandwidth consumed serving the request, in Kb/sec.

Bandwidth Limit Control 

0,

%XT

A value that indicates whether the request was throttled due to bandwidth limit control settings.

“1” indicates the request was throttled.

“0” indicates the request was not throttled.

User Type

-,

%l

The type of user making the request, either “[Local]” or “[Remote].”

Only applies when AnyConnect Secure Mobility is enabled.

When it is not enabled, the value is a hyphen (-)

Outbound Malware Scanning

"-","-",

These 2 fields applies to transactions blocked or monitored due to client request scanning when an Outbound Malware Scanning Policy applies.

Advanced Malware Protection

-,"-",-,-,"-","-",

These 6 fields are related to Secure Endpoint (Also known as Advanced Malware Protection):

Archive Scan

-,-,"-",

These 3 fields indicates the status of the Archive file scanning:

Web Tap

-,

%XU

Web Tap Behavior.

YouTube URL category

->

%X#29#

The YouTube URL category assigned to the transaction, abbreviated. This field shows “nc” when no category is assigned.

Temporary Redirect for Authentication

(Usually seen in the transparent deployment while SWA is authenticating the user)