Log Export

Timestamp

Aug 22 11:58:14

The time recorded in the following format: "yyyy-mm-dd hh:mm:ss.s" (one or more digits representing a decimal fraction of a second) TZD (time zone designator, which is either Z or +hh:mm or -hh:mm)

LogType

WAAS_EVENT

Type of log: Web Firewall Log, Access Log, or Event Log.

Event Log Categories

Server Health

Category of the event to which the component belongs.

Server IP

10.222.40.71

IP address of the backend web server.

Server Port

80

Port associated with the backend web server.

Event Message

Status Down ,Reason: TCP connection timedout error

Message displayed for the generated event.

%ai - Application IP

IP address of the application that receives the traffic.

%ap - Application Port

Port associated with the application IP address.

%at - Action Taken

The appropriate action applied on the traffic.

• DENY – denotes that the traffic is denied.

• LOG – denotes monitoring of the traffic with the assigned rule.

• WARNING – warns about the traffic.

%ad - Attack Description

Name of the attack triggered by the request.

%adl - Attack Details

Details of the attack triggered by the request.

%ag - Attack Group

Name of the attack group as categorized by Barracuda WAF-as-a-Service based on the violations/attacks.

%aid - Attack ID

Predefined ID assigned to the attack.

%au - Authenticated User

Username of the currently authenticated client requesting the web page.

%sn - Application ID

Application ID and the unique ID assigned to the application.

%ci - Client IP

IP address of the client sending the request.

%cp - Client Port

Port associated with the client IP address.

%cc - Country Code

The two-letter country code of the location from where the request originated.

%cwe - CWE

Common Weakness Enumeration (CWE) ID(s) that provides information about security vulnerabilities.

%fa - Follow-up Action

The follow-up action as specified by the action policy. It can be either None or Locked in case the lockout is chosen.

%lt - Log Type

Type of log: Web Firewall Log, Access Log, or Event Log.

%m - Method

HTTP method used by the request.

Values: GET, POST, HEAD, etc.

%owasp - OWASP

Attack category listed by OWASP.

%owasp_at - OWASP Automated Threats

Type of automated threat identified by the OWASP Automated Threats.

%owasp_api - OWASP API

API Security risk category listed by OWASP.

%owasp_rs - OWASP Risk Score

Risk score assigned by the Barracuda WAF-as-a-Service to the vulnerability. It indicates the severity of the vulnerability in the detected attack.

%p - Protocol

Protocol used for the request.

%px - Proxy IP

If the client requests are coming through a proxy or gateway, this field provides the IP address of the proxy.

%pp - Proxy Port

The port of the proxy server whose IP address has been logged in the Proxy IP field above.

%r - Referer

The value contained in the Referrer HTTP request header. It identifies the web resource from which the client was “referred” to the requested URL.

%ri - Rule ID

Name of the policy to which the Barracuda WAF-as-a-Service matched the request.

%rn - Rule Name

Name of the Traffic Rule.

NOTE:
If a request matches the configured traffic rule and the log is exported, the traffic rule name is displayed in the exported log file. But, if the request does not match any configured traffic rule of an application, the exported log displays the traffic rule with the blank value (i.e. "-").

%rt - Rule Type

Indicates the type of rule that was hit by the request that caused the attack. The following is the list of expected values for Rule Type:

• Global – indicates that the request matched one of the global rules configured under Security Policies.

• Global URL ACL – indicates that the request matched one of the global URL ACL rules configured under Security Policies.

• URL ACL – indicates that the request matched one of the Allow/Deny rules configured specifically for the given website.

• URL Policy – indicates that the request matched one of the Advanced Security rules configured specifically for the given website.

• URL Profile – indicates that the request matched one of the rules configured on the URL Profile.

• Parameter Profile – indicates that the request matched one of the rules configured on the Parameter Profile.
  Header Profile – indicates that the request matched one of the rules configured on the Header Profile.

%sid - Session ID

Value for this field remains blank.

%sl - Severity Level

Defines the seriousness of the attack.

Values:

• EMERGENCY – System is unusable (highest priority).

• ALERT – Response must be taken immediately.

• CRITICAL – Critical conditions.

• ERROR – Error conditions.

• WARNING – Warning conditions.

• NOTICE – Normal but significant condition.

• INFORMATION – Informational message (on ACL configuration changes).

• DEBUG – Debug-level message (lowest priority).

%t - Time Stamp

The time recorded in the following format: "yyyy-mm-dd hh:mm:ss.s" (one or more digits representing a decimal fraction of a second) TZD (time zone designator, which is either Z or +hh:mm or -hh:mm)

%u - URL

URL specified in the request.

%ua - User Agent

The value contained in the User-Agent request header. Normally, this information is submitted by the clients, which details the browser, operating system, software vendor, or software revision, in an identification string.

%un - Unit Name

Name of the unit.

%uid - Unique ID

ID generated for the request. A unique ID is generated for every log.

%ai - Application IP

IP address of the application that receives the traffic.

%ap - Application Port

Port associated with the application IP address.

%au - Authenticated User

Username of the currently authenticated client requesting the web page.

%br - Bytes Received

Bytes received from the client as a part of the request.

%bs - Bytes Sent

Bytes sent as a response by the Barracuda WAF-as-a-Service to the client.

%ch - Cache Hit

Specifies whether the response is served out of the Barracuda WAF-as-a-Service cache or from the backend server.

Values:

0 – if the request is fetched from the server and given to the user.

1 – if the request is fetched from the cache and given to the user.

%cu - Certificate User

Username as found in the SSL certificate when Client Authentication is enforced by the Barracuda WAF-as-a-Service.

%ci - Client IP

IP address of the client sending the request.

%cp - Client Port

Port associated with the client IP address.

%c - Cookie

Cookie as found in the HTTP request headers.

%ct - Client Type

Specifies the type of client making the request. 

Values: 

• Whitelist Bot

• Fake Bot

• Bot

• Attack Bot

• Attack

• Unknown

%cfp - Client Fingerprint

A unique client fingerprint generated for the client sending the request.

%crs - Client Risk Score

Risk score assigned to the client fingerprint.

%cc - Country Code

The two-letter country code of the location from where the request originated.

%cs1 - Custom Header 1

The header name for which you want to see the value in the Access Logs.

%cs2 - Custom Header 2

The header name for which you want to see the value in the Access Logs.

%cs3 - Custom Header 3

The header name for which you want to see the value in the Access Logs.

%cs4 - Custom Header 4

The header name for which you want to see the value in the Access Logs.

%cs5 - Custom Header 5

The header name for which you want to see the value in the Access Logs.

%cs6 - Custom Header 6

The header name for which you want to see the value in the Access Logs.

%h - Host

IP address of the host or website accessed by the user.

%s - HTTP Status

The standard response code that helps identify the cause of the problem when a web page or other resource does not load properly.

%id - Login ID

Login ID used by the client when authentication is set to On for the application.

%lt - Log Type

Type of log: Web Firewall Log, Access Log, or Event Log.

%m - Method

HTTP method used by the request.

Values: GET, POST, HEAD, etc.

%p - Protocol

Protocol used for the request.

%pf - Protected Field

Specifies whether the request went through the Barracuda WAF-as-a-Service rules and policy checks.

Values: PASSIVE, PROTECTED, UNPROTECTED.

%px - Proxy IP

If the client requests are coming through a proxy or gateway, this field provides the IP address of the proxy.

%pmf - Profile Matched Field

Specifies whether the request matched a defined URL or Parameter Profile.

Values: DEFAULT, PROFILED.

%pp - Proxy Port

Port of the proxy server whose IP address has been logged in the Proxy IP field above.

%q - Query

Query part of the request.

%r - Referer

The value contained in the Referrer HTTP request header. It identifies the web resource from which the client was “referred” to the requested URL.

%rtf - Response Type Field

Specifies whether the response came from the backend server or from the Barracuda WAF-as-a-Service. 

Values: INTERNAL, SERVER.

%rrs - Request Risk Score

Risk score assigned to the request.

%rn - Rule Name

Name of the Traffic Rule.

NOTE:
If a request matches the configured traffic rule and the log is exported, the traffic rule name is displayed in the exported log file. But, if the request does not match any configured traffic rule of an application, the exported log displays the traffic rule with the blank value (i.e. "-").

%sid - Session ID

Value for this field remains blank.

%si - Server IP

IP address of the backend web server.

%sp - Server Port

Port associated with the backend web server.

%st - Server Time

Total time taken (in milliseconds) by the back-end server to serve the request forwarded to it by the Barracuda WAF-as-a-Service.

%sn - Application ID

Application ID and the unique ID assigned to the application.

%t - Time

Date and time of the log when it was generated.

%tt - Time Taken

Total time taken to serve the request from the time the request landed on the Barracuda WAF-as-a-Service until the last byte given out to the client.

%u - URL

URL of the request without the query part.

%ua - User Agent

The value contained in the User-Agent request header. Normally, this information is submitted by the clients, which details the browser, operating system, software vendor or software revision, in an identification string.

%un - Unit Name

Name of the unit, which is same as the default hostname.

%uid - Unique ID

ID generated for the request. A unique ID is generated for every log.

%v - Version

HTTP version used by the request.

%wmf - WF Matched

Specifies whether the request is valid.

Values: INVALID, VALID.

%tarc - Epoch/Unix Timestamp

Time is displayed in the Epoch/Unix timestamp format.

%ta - American Standard Format Timestamp

Time is displayed in the American Standard timestamp format.

%t - Timestamp

The time recorded in the following format: "yyyy-mm-dd hh:mm:ss.s" (one or more digits representing a decimal fraction of a second) TZD (time zone designator, which is either Z or +hh:mm or -hh:mm)

%lt - LogType

Type of log: Web Firewall Log, Access Log, or Event Log.

%si - Server IP

IP address of the backend web server.

%sp - Server Port

Port associated with the backend web server.

%waas_category - Event Log Categories

Category of the event to which the component belongs.

The event types are:

• ApplicationHealth

• ServerHealth

• DDoS

• Certificate

• DNS

• License

%waas_message - Event Message

Message displayed for the generated event.