Access Log Fields

This table lists all fields available for creating access log formats. When creating an ELFF format you must use the values from the ELFF column. When creating a custom format you can use values from the ELFF, CPL, or custom column.

ELFF

CPL

Description

Category: bytes

cs-bodylength

 

Number of bytes in the body (excludes header) sent from client to appliance

cs-bytes

 

Number of bytes sent from client to appliance

cs-headerlength

 

Number of bytes in the header sent from client to appliance

rs-bodylength

 

Number of bytes in the body (excludes header) sent from upstream host to appliance

rs-bytes

 

Number of bytes sent from upstream host to appliance

rs-headerlength

 

Number of bytes in the header sent from upstream host to appliance

sc-bodylength

 

Number of bytes in the body (excludes header) sent from appliance to client

sc-bytes

 

Number of bytes sent from appliance to client

sc-headerlength

 

Number of bytes in the header sent from appliance to client

sr-bodylength

 

Number of bytes in the body (excludes header) sent from appliance to upstream host

sr-bytes

 

Number of bytes sent from appliance to upstream host

sr-headerlength

 

Number of bytes in the header sent from appliance to upstream host

Category: connection

c-connect-type

 

The type of connection made by the client to the appliance -- 'Transparent' or 'Explicit'

c-dns

 

Hostname of the client (uses the client's IP address to avoid reverse DNS)

c-ip

client.address

IP address of the client

c-port

 

Source port used by the client

cs-ip   Destination IP address for the client's connection

r-dns

 

Hostname from the outbound server URL

r-ip

 

IP address from the outbound server URL

r-port

 

Port from the outbound server URL

r-supplier-dns

 

Hostname of the upstream host (not available for a cache hit)

r-supplier-ip

 

IP address used to contact the upstream host (not available for a cache hit)

r-supplier-port

 

Port used to contact the upstream host (not available for a cache hit)

sc-connection

 

Unique identifier of the client's connection (i.e. SOCKET)

s-connect-type

 

Upstream connection type

s-dns

 

Hostname of the appliance (uses the primary IP address to avoid reverse DNS)

s-ip

 

IP address of the appliance on which the client established its connection

s-source-port   Source port used by the appliance for upstream connections (not available for a cache hit)

s-supplier-ip

 

IP address used to contact the upstream host (not available for a cache hit)

s-supplier-name

 

Hostname of the upstream host (not available for a cache hit)

x-bluecoat-appliance-name

 

Configured name of the appliance

x-bluecoat-appliance-primary-address

 

Primary IP address of the appliance

x-bluecoat-proxy-primary-address

 

Primary IP address of the appliance

x-appliance-serial-number

 

The serial number of the appliance

x-sr-source-ip   IP address used by the appliance for upstream connections (not available for a cache hit)

Category: req_rsp_line

cs-method

http.method

Request method used from client to appliance

cs-protocol

client.protocol

Protocol used in the client's request

cs-version

http.request.version

Protocol and version from the client's request, e.g. HTTP/1.1

rs-response-line

 

First line (a.k.a. status line) of the response from an upstream host to the appliance

rs-status

http.response.code

Protocol status code of the response from an upstream host to the appliance

rs-version

http.response.version

Protocol and version of the response from an upstream host to the appliance, e.g. HTTP/1.1

sc-status

 

Protocol status code from appliance to client

sc(Content-Encoding)

 

Client Response header: Content-Encoding

sr(Accept-Encoding)

 

Server Request header: Accept-Encoding

Category: special_token

x-bluecoat-special-amp

amp

The ampersand character

x-bluecoat-special-apos

apos

The apostrophe character (a.k.a. single quote)

x-bluecoat-special-cr

cr

Resolves to the carriage return character

x-bluecoat-special-crlf

crlf

Resolves to a carriage return/line feed sequence

x-bluecoat-special-empty

empty

Resolves to an empty string

x-bluecoat-special-esc

esc

Resolves to the escape character (ASCII HEX 1B)

x-bluecoat-special-gt

gt

The greater-than character

x-bluecoat-special-lf

lf

The line feed character

x-bluecoat-special-lt

lt

The less-than character

x-bluecoat-special-quot

quot

The double quote character

x-bluecoat-special-slash

slash

The forward slash character

Category: status

x-bluecoat-release-id

 

The release ID of the CacheFlow appliance operating system

x-bluecoat-release-version

 

The release version of the CacheFlow operating system

cs-categories

 

All content categories of the request URL

cs-categories-external

 

All content categories of the request URL that are defined by an external service.

cs-categories-policy

 

All content categories of the request URL that are defined by CPL.

 cs-categories-local

 

All content categories of the request URL that are defined by a Local database.

cs-categories-bluecoat

 

All content categories of the request URL that are defined by Blue Coat Web Filter.

cs-categories-provider

 

All content categories of the request URL that are defined by the current 3rd-party provider.

cs-categories-qualified

 

All content categories of the request URL, qualified by the provider of the category.

cs-category

 

Single content category of the request URL (a.k.a. sc-filter-category)

x-cflo-cachepulse-version

 

The version of CachePulse installed on the appliance.

s-action

 

What type of action did the Appliance take to process this request; possible values include ALLOWED, DENIED, FAILED, SERVER_ERROR, TCP_WEBSOCKET

x-exception-category

 

Defines the content category that caused the triggering of the exception

x-exception-company-name

 

The company name configured under exceptions

x-exception-contact

 

Describes who to contact when certain classes of exceptions occur, configured under exceptions (empty if the transaction has not been terminated)

x-exception-details

 

The configurable details of a selecte policy-aware response page (empty if the transaction has not been terminated)

x-exception-header

 

The header to be associated with an exception response (empty if the transaction has not been terminated)

x-exception-help

 

Help text that accompanies the exception resolved (empty if the transaction has not been terminated)

x-exception-id

 

Identifier of the exception resolved (empty if the transaction has not been terminated)

x-exception-last-error

 

The last error recorded for the current transaction. This can provide insight when unexpected problems are occurring (empty if the transaction has not been terminated)

x-exception-reason

 

Indicates the reason why a particular request was terminated (empty if the transaction has not been terminated)

x-exception-sourcefile

 

Source filename from which the exception was generated (empty if the transaction has not been terminated)

x-exception-sourceline

 

Source file line number from which the exception was generated (empty if the transaction has not been terminated)

x-exception-summary

 

Summary of the exception resolved (empty if the transaction has not been terminated)

x-exception-category-review-message

 

Exception page message that includes a link allowing content categorization to be reviewed and/or disputed.

Category: time

connect-time

 

Total ms required to connect to the origin server

date

date.utc

GMT Date in YYYY-MM-DD format

dnslookup-time

 

Total ms cache required to perform the DNS lookup

duration

 

Time taken (in seconds) to process the request

gmttime

 

GMT date and time of the user request in format: [DD/MM/YYYY:hh:mm:ss GMT]

x-bluecoat-day-utc

day.utc

GMT/UTC day (as a number) formatted to take up two spaces (e.g. 07 for the 7th of the month)

x-bluecoat-hour-utc

hour.utc

GMT/UTC hour formatted to always take up two spaces (e.g. 01 for 1AM)

x-bluecoat-minute-utc

minute.utc

GMT/UTC minute formatted to always take up two spaces (e.g. 01 for 1 minute past)

x-bluecoat-month-utc

month.utc

GMT/UTC month (as a number) formatted to take up two spaces (e.g. 01 for January)

x-bluecoat-monthname-utc

 

GMT/UTC month in the short-form string representation (e.g. Jan for January)

x-bluecoat-second-utc

second.utc

GMT/UTC second formatted to always take up two spaces (e.g. 01 for 1 second past)

x-bluecoat-weekday-utc

weekday.utc

GMT/UTC weekday in the short-form string representation (e.g. Mon for Monday)

x-bluecoat-year-utc

year.utc

GMT/UTC year formatted to always take up four spaces

localtime

 

Local date and time of the user request in format: [DD/MMM/YYYY:hh:mm:ss +nnnn]

x-bluecoat-day

day

Localtime day (as a number) formatted to take up two spaces (e.g. 07 for the 7th of the month)

x-bluecoat-hour

hour

Localtime hour formatted to always take up two spaces (e.g. 01 for 1AM)

x-bluecoat-minute

minute

Localtime minute formatted to always take up two spaces (e.g. 01 for 1 minute past)

x-bluecoat-month

month

Localtime month (as a number) formatted to take up two spaces (e.g. 01 for January)

x-bluecoat-monthname

 

Localtime month in the short-form string representation (e.g. Jan for January)

x-bluecoat-second

second

Localtime second formatted to always take up two spaces (e.g. 01 for 1 second past)

x-bluecoat-weekday

weekday

Localtime weekday in the short-form string representation (e.g. Mon for Monday)

x-bluecoat-year

year

Localtime year formatted to always take up four spaces

time

time.utc

GMT time in HH:MM:SS format

timestamp

 

Unix type timestamp

time-taken

 

Time taken (in milliseconds) to process the request

rs-time-taken

 

Total time taken (in milliseconds) to send the request and receive the response from the origin server

x-bluecoat-end-time-wft

 

End local time of the transaction represented as a windows file time

x-bluecoat-start-time-wft

 

Start local time of the transaction represented as a windows file time

x-bluecoat-end-time-mssql

 

End local time of the transaction represented as a serial date time

x-bluecoat-start-time-mssql

 

Start local time of the transaction represented as a serial date time

x-cookie-date

 

Current date in Cookie time format

x-http-date

 

Current date in HTTP time format

x-timestamp-unix

 

Seconds since UNIX epoch (Jan 1, 1970) (local time)

x-timestamp-unix-utc

 

Seconds since UNIX epoch (Jan 1, 1970) (GMT/UTC)

cs-categorization-time-dynamic

 

Time taken (in milliseconds) to dynamically categorize the request URL

Category: url

cs-host

 

Hostname from the client's request URL.

c-uri

 url

The original URL requested.

c-uri-address

 url.address

IP address from the original URL requested. DNS is used if the URL is expressed as a hostname.

c-uri-cookie-domain

 url.cookie_domain

The cookie domain of the original URL requested

c-uri-extension

 url.extension

Document extension from the original URL requested

c-uri-host

 url.host

Hostname from the original URL requested

c-uri-hostname

 url.hostname

Hostname from the original URL requested. RDNS is used if the URL is expressed as an IP address

c-uri-path

 url.path

Path of the original URL requested without query.

c-uri-pathquery

 url.pathquery

Path and query of the original URL requested

c-uri-port

 url.port

Port from the original URL requested

c-uri-query

 url.query

Query from the original URL requested

c-uri-scheme

 url.scheme

Scheme of the original URL requested

c-uri-stem

 

Stem of the original URL requested

x-cs(Referer)-uri

 request.header.Referer.url

The URL from the Referer header.

x-cs(Referer)-uri-address

 request.header.Referer.url.address

IP address from the 'Referer' URL. DNS is used if URL uses a hostname.

x-cs(Referer)-uri-extension

 request.header.Referer.url.extension

Document extension from the 'Referer' URL.

x-cs(Referer)-uri-host

 request.header.Referer.url.host

Hostname from the 'Referer' URL.

x-cs(Referer)-uri-hostname

 request.header.Referer.url.hostname

Hostname from the 'Referer' URL. RDNS is used if the URL uses an IP address.

x-cs(Referer)-uri-path

 request.header.Referer.url.path

Path from the 'Referer' URL. Does not include query.

x-cs(Referer)-uri-pathquery

 request.header.Referer.url.pathquery

Path and query from the 'Referer' URL.

x-cs(Referer)-uri-port

 request.header.Referer.url.port

Port from the 'Referer' URL.

x-cs(Referer)-uri-query

 request.header.Referer.url.query

Query from the 'Referer' URL.

x-cs(Referer)-uri-scheme

 request.header.Referer.url.scheme

Scheme from the 'Referer' URL.

x-cs(Referer)-uri-stem

 

Stem from the 'Referer' URL. The stem includes everything up to the end of path, but does not include the query.

Category: request_header

cs(<header_name>)

request.header.header_name

Request header

cs(<header_name>).length request.header.header_name.length Length of the HTTP request header
cs(<header_name>).count request.header.header_name.count Number of HTTP request header

Category: response_header

rs(<header_name>)

response.header.header_name

Response header

Category: log_summaries

The proceeding fields are applicable only to cflo-top-sites, this field cannot be used in custom access log formats.

count   The number of entries for which the listed data, field has type <integer>.
x-nc-bytes   The number of client-side bytes in the transaction that are not cacheable.
time-to   The time at which sampling ended, field has type <time>.
interval   Time over which sampling occurred in seconds, field has type <integer>.