4. Log


Prev	Chapter 5. Web application firewall (WAF)	Next

4.1. Deny log

The Deny log window provides access to all denied request to the proxy. Filtering functions allows for specification of fine grained filtering of log information.

4.1.1. Specifying filter criteria

The filter function allows you to specify conditions for showing a subset of the log entries. Until reset the filter conditions also apply to the log report.

When the log filter section is not expanded a Filter button and current filter criteria is shown on a general level. When filter criteria are defined a reset button will be available at the left of the filter button. When the reset button is pressed the filter criteria will be reset.

When the Filter button is clicked the filter section expands and filter criteria can be specified. Following filter criteria are available:

ID Input field	Number identifying a log entry. Valid input Number of type integer. Input example `20567` Default value `<none>`
Path Input field	Pattern or string specifying filter based on the URL path. Valid input A string or a simple wildcard. Use the following characters to specify wildcards: `* =` any string any length. `? =` one occurrence of any character. Input example `/store/` - matches all URL paths beginning with string /store/ including the string itself. `.php` - matches all url paths in all sub directories with the extension .php . Default value `<none>`
Parameters Input field	Filter based on the number of parameters. Valid input `digits` and operators `<`, `>` and `=` Input example `>3` - more than 3 parameters. `2` - exactly two parameters. Default value `<none>`
IP Input field	Source IP address of the originating client Valid input An IP address in the format xxx.xxx.xxx.xxx Input example `192.168.45.17` Default value `<none>`
Host Input field	Host information from the request blocked. Valid input A string or a simple wildcard. Use the following characters to specify wildcards: `* =` any string any length. `? =` one ocurrence of any character. Input example `www.mycompany.com` `*.mycompany.com` Default value `<none>`
Date from Input field	Filter based on request timestamp. Date from specifies the date of the oldest log records that should be included. Valid input A date string in the format: mm/dd/yyyy Input example `02/27/2008` Default value `<none>`
Date to Input field	Filter based on request timestamp. Date to specifies the date of the newest log records that should be included. Use Date from and Date to to specify a time interval. Valid input A date string in the format: mm/dd/yyyy Input example `02/29/2008` Default value `<none>`
Attack classification Multiple checkboxes	Filter based on attack classification. Valid input Any combination of checked items in the list of attack classes. Default value `<none>`
Policy violation Multiple checkboxes	Filter based on policy violation. Valid input Any combination of checked items in the list of policy violations. Default value `<none>`
Reset Button	Resets the filter criteria to default values.
Apply Button	Applies defined filter to deny log database.
Close Button	Closes the filter section.

4.1.2. Blocked and failed requests

Displays requests for resources for the selected proxy that were blocked by Web Security Manager.

HTTP headers, URL, parameters and values (if any) that were blocked in the request are highlighted in red color.

Also failed requests are shown in the deny log allowing for identifying broken internal and external links and broken robots not abiding the 404 not found message.

Total number of log entries matching the current filter criteria (if specified) is displayed as Query returned #number records. If the total number of records is larger then the Entries per page selection, use navigation arrows to navigate the log record back and forth.

Details are expandable: Click details icon in the rightmost column to expand.

Checkbox	Mark log entry for adding to the access policy. To allow further requests based on the information in the selected log entry/entries, select them and click on the Add selected to ACL button. Note: parameters that are defined as `regexp` in web applications and global policy are not automatically updated to allow new values based on the input from the logged requests. In this case, values need to be updated manually. If adding is not possible the checkbox is inactive.
Time	Date and time the request was logged.
Country	Country the requests originated from.
Host	Hostname from the original request or none if none was present.
Risk	Risk classification of the log entry. Options are: Critical High Medium Low None
Source IP	Source IP the request originated from. Click on IP-address to get whois information.
Class	Attack classification of the log entry. Options are: SQL injection XPath injection SSI injection OS commanding XSS (Cross Site Scripting) Path traversal Enumeration Format string Buffer overflow DoS attempt Worm probe Access violation Malformed request HTML tags Session invalid XSRF (Cross Site Request Forgery) Session expired Detection evasion Remote file inclusion Information leak Backend error Broken robot Broken int. link Broken ext. link Other None False positive Friendly
Action	Block action taken on the request. Options are: Allow The request was allowed, either because the current mode and white list configuration or because the requests was allowed according to policy. If the request was allowed by policy the reason for the request being logged in the deny log is typically that the backend server responded with an error. Expand the request to see details. Block The request was blocked by Web Security Manager. Block-IP The request was blocked by Web Security Manager and the source IP was blacklisted resulting in further requests from that source being blocked at the network level. Strip The offending part of the request was stripped before allowing the request. Used for instance to remove session cookies for expired sessions.
URL Path	The URL path requested.
Method Detail - click details to view.	Offending method (if any)
Violation Detail - click details to view.	Shows the general violation description as defined by Web Security Manager. See the list of violations below
Resp. status Detail - click details to view.	If applicable shows the response status from the backend server like `404 not found` or `200 (OK)`.
Resp. time Detail - click details to view.	The time from Web Security Manager received the request and forwarded it to the backend server until the response is sent to the client from Web Security Manager.
Referer Detail - click details to view.	The refering source, internal or external, from which the request originated.
Header Detail - click details to view.	Offending header fields and values (if any).
Query Detail - click details to view.	Offending parameter names and values (if any).
Raw Detail - click details to view.	Shows the original request as send by the client. To view it, click on the View RAW request button.

To view all entries in the list expanded click the Report button in the lower button bar.

	Note
In order not to lock the management interface by returning huge amounts of data a maximum of 500 log entries at a time will be displayed in the interactive log interface. Use the XML export function to download larger lists (or the complete log) for off line analysis and archival purposes.

Note

In order not to lock the management interface by returning huge amounts of data a maximum of 500 log entries at a time will be displayed in the interactive log interface.

Use the XML export function to download larger lists (or the complete log) for off line analysis and archival purposes.

4.1.2.1. Violations

4.1.2.1.1. Content violations

Path unknown	No policy rules allow the path segment of the URL, either because it does not match a positive policy rule or because it matches a negative policy rule - a signature.
Path denied	The path is explicitly denied by an URL blocking policy rule.
Query unknown	No positive policy rules match the name of the request parameter.
Query illegal	No policy rules allow the value of the request parameter, either because it does not match a positive policy rule or because it matches a negative policy rule - a signature.
Session validation failed	The request session ID is not valid, either because the session token has been tampered with or hijacked.
Form validation failed	The form submitted cannot be verified as having been issued by the web application in a response to a request from the current user session. This is an indication of a CSRF attack.
Session expired	The request session has exceeded the idle expiration threshold configured in Web Security Manager for the web application.
Malformed XML	Submitted XML request is malformed and hence cannot be parsed and validated.
Multiple or %u encoded request	The request contains elements that are encoded more than twice or it contains elements that are encoded using %u-encoding.
Authorization failed	User is not authorized to access requested resource.
Header unknown	Request header not RFC 2616 compliant.
Header illegal	Header value failed strict validation.
Header validation failed	Header value failed pragmatic validation.
Output illegal	Server response contains illegal string.

4.1.2.1.2. Protocol violations

Generic protocol violation	Protocol violations like missing content length or content type headers for POST requests.
HTTP Protocol version	HTTP protocol version not allowed.
Method illegal	HTTP method not allowed.
Missing hostname	Request does not specify host name.
Invalid hostname	Not website proxy is configured for the requested host name.
Request line maximum length	Entire request line (URI?query) exceeds allowed maximum length.
Request path maximum length	Request path exceeds allowed maximum length.
Query string maximum length	Request query exceeds allowed maximum length.
Content type not enabled	Request content type is supported but not enabled.
Header name length	Header name exceeds allowed maximum length.
Header value length	Header value exceeds allowed maximum length.
Maximum number of headers	Header number exceeds allowed maximum.
Upload attempt	Upload attempted but upload not allowed.
Payload length exceeded	POST payload exceeds allowed maximum size.
Maximum number of upload files	Number of files to upload in a request exceeds allowed maximum.
Total upload size	Total size of upload files in request exceeds allowed maximum.
Maximum file size	Size of a single upload file exceeds allowed maximum.
Cookie version not allowed	Request cookie version not allowed.
Maximum number of cookies	Number of cookies in request exceeds allowed maximum.
Cookie name length	Name of a cookie exceeds allowed maximum length.
Cookie value length	Value of a cookie exceeds allowed maximum length.
Maximum number of GET parameters	GET parameter number exceeds allowed maximum.
GET parameter name length	GET parameter name exceeds allowed maximum length.
GET parameter value length	GET parameter value exceeds allowed maximum length.
GET parameter combined length	Combined length of GET parameter name and value exceeds allowed maximum length.
Maximum number of POST parameters	POST parameter number exceeds allowed maximum.
POST parameter name length	POST parameter name exceeds allowed maximum length.
POST parameter value length	POST parameter value exceeds allowed maximum length.
POST parameter combined length	Combined length of POST parameter name and value exceeds allowed maximum length.
General request violation	Other generic violations.

4.1.3. Lower button bar

The lower button bar contains the following buttons.

Flush log

Button

Use with caution!

When clicking this button and accepting the confirm pop-up window.

All log data for that proxy will be deleted!

Log report

Button

Generate a printable report based on defined filter criteria (if any).

Add selected to ACL

Button

Adds selected log records to access policy.

4.2. Access log

When access logging is enabled all requests to the website is logged.

The access log is generated on a per day basis. The current log can be monitored and viewed and closed logs are made available for download.

The fields displayed depends on the selected access log format.

4.3. Access log files

When log files are available for download the filename is an active link. To download an access log file click on the filename.

When remote backup is enabled, the latest access log file made available for download will be compressed (using gzip) and copied to the remote backup destination along with the backup of the system configuration.

Several log file formats are available. A condensed Web Security Manager specific and some standardized formats, like NCSA Combined (Apache Combined), suitable for importing into log analysis and report generation tools.

See Access Log formats for log format definitions.

Prev	Up	Next
3. Learning	Home	5. Reports