330 APPENDIX H: L OG FORMATSWebTrends ExtendedLog FormatTable 20 lists the WebTrends Extended Log Format logging fields.The format of WebTrends Extended Log Format log file entries is:id=firewall time fw pri proto duration sent rcvd src dstdstname user op arg result ref agent cacheTable 20 WebTrends Extended Log Format (WELF) logging fieldsWebTrends Meaning Examplesid The type of record; for log files produced by theWebcache, the type will always be firewall.id=firewalltime Shows the date and time of the event, in terms of localtime. The form of the date/time field is:time=”yyyy-mm-dd hh:mm:ss”time=”2001-01-01 18:00:00”fw Identifies the webcache that generated the log record.This is represented as an IP address or a client machinename.fw=192.168.1.253fw=Webcache 3000 #1pri The priority of the event. Legal values are: 0 - emergency 1 - alert 2 - critical 3 - error 4 - warning 5 - notice 6 - information 7 - debugpri=0pri=5proto The protocol used by the event. proto=httpproto=ftpproto=snmpduration The time that is required to perform the operation, inseconds. For example, for an FTP file transfer, this wouldbe the amount of time used to perform the transfer.duration=180.00sent The number of bytes transferred from the source to thedestination.sent=1426rcvd The number of bytes transferred from the destination tothe source.rcvd=1426src The IP address that generated the event. src=192.168.1.253dst The IP address that received the event. dst=192.168.1.254(continued)dua1611-5aaa04.book Page 330 Friday, November 29, 2002 8:56 PM
