Web Proxy Server 2.0 Log File Format

ID: Q234147

The information in this article applies to:

Microsoft Proxy Server version 2.0

SUMMARY

Microsoft Proxy Server 2.0 has logging capabilities that allow an administrator to track Proxy Server usage. The information in this article can be used to identify and understand the fields in a Web Proxy Server log.

MORE INFORMATION

Field Position Field Value Description

1 ClientIP The requesting client's IP Address

2 ClientUserName Windows NT Account of the user making the request. "Anonymous" will be recorded if Proxy Access Control is not being used.

3 ClientAgent Contains the browser type sent by the client in the HTTP header. When Proxy Server is actively caching, the client agent is "MSProxy/2.0"

4 ClientAuthenticate Indicates whether or not client has authenticated with the Proxy Server (Y/N)

5 LogDate Timestamp indicating date when client request was made.

6 LogTime Timestamp indicating time when client request was made. The LogTime is in local system time.

7 Service Indicates which Proxy Server service the client is using.

8 ServerName The local Proxy Server's Host name.

9 ReferredServer If Proxy Server is used upstream in a chained configuration, this indicates the ServerName of the downstream server that sent the request.

10 DestHost If Proxy Server is being downstream used in a chained configuration, this indicates the ServerName of the upstream server.

11 DestHostIP The IP address of the destination. A hyphen indicates that the request was serviced from the Proxy Server's cache.

12 DestHostPort The TCP or UDP destination port.

13 ProcessingTime Connection time (in milliseconds). Begins when Proxy Server receives client request and ends when client closes the connection.

14 BytesSent Number of bytes sent to remote host by Proxy Server.

15 BytesRecvd Number of bytes received by Proxy from the remote host.

16 Protocol Specifies the Application protocol used for the connection (HTTP, FTP, Gopher, Secure)

17 Transport Specifies the Transport protocol used for the connection (TCP, UDP)

18 Operation Specifies the Application method being used (GET, PUT, POST, and so on)

19 URL Destination URL

20 MimeType The Multipurpose Internet Mail Extension of the requested object. (Text/Plain, Image/GIF, and so on)

21 ObjectSource Indicates final source of request object.
0 = No information available
Cache = Source is the Proxy cache
Inet = Source is the Internet
VCache = Source is cache. Object was verified against original source
NVCache = Source is cache but original source could not be verified
VFInet = Source is Internet. Object was in cache, but original source was newer.
NotModified = Object retrieved from cache. Client performed an If-Modofied-Since and object was found to be current
MemberObject = Source is the cache of another Proxy array member server
Upstream = Source is an upstream Proxy Server's cache

22 ResultCode Status code of transaction
A value less than 100 is a Win32 error code.
A value between 100 and 1000 is an HTTP status code
A value greater than 10000 is a Winsock status code.

23 CacheInfo A random cache number. If the Combined Hotfix is installed, the value is always zero.

Note: The BytesSent and BytesRecvd behavior changes slightly after the Proxy Server 2.0 Combined Hotfix has been installed.

For additional information, please see the following article(s) in the Microsoft Knowledge Base:

Field Position	Field Value	Description
1	ClientIP	The requesting client's IP Address
2	ClientUserName	Windows NT Account of the user making the request. "Anonymous" will be recorded if Proxy Access Control is not being used.
3	ClientAgent	Contains the browser type sent by the client in the HTTP header. When Proxy Server is actively caching, the client agent is "MSProxy/2.0"
4	ClientAuthenticate	Indicates whether or not client has authenticated with the Proxy Server (Y/N)
5	LogDate	Timestamp indicating date when client request was made.
6	LogTime	Timestamp indicating time when client request was made. The LogTime is in local system time.
7	Service	Indicates which Proxy Server service the client is using.
8	ServerName	The local Proxy Server's Host name.
9	ReferredServer	If Proxy Server is used upstream in a chained configuration, this indicates the ServerName of the downstream server that sent the request.
10	DestHost	If Proxy Server is being downstream used in a chained configuration, this indicates the ServerName of the upstream server.
11	DestHostIP	The IP address of the destination. A hyphen indicates that the request was serviced from the Proxy Server's cache.
12	DestHostPort	The TCP or UDP destination port.
13	ProcessingTime	Connection time (in milliseconds). Begins when Proxy Server receives client request and ends when client closes the connection.
14	BytesSent	Number of bytes sent to remote host by Proxy Server.
15	BytesRecvd	Number of bytes received by Proxy from the remote host.
16	Protocol	Specifies the Application protocol used for the connection (HTTP, FTP, Gopher, Secure)
17	Transport	Specifies the Transport protocol used for the connection (TCP, UDP)
18	Operation	Specifies the Application method being used (GET, PUT, POST, and so on)
19	URL	Destination URL
20	MimeType	The Multipurpose Internet Mail Extension of the requested object. (Text/Plain, Image/GIF, and so on)
21	ObjectSource	Indicates final source of request object. 0 = No information available Cache = Source is the Proxy cache Inet = Source is the Internet VCache = Source is cache. Object was verified against original source NVCache = Source is cache but original source could not be verified VFInet = Source is Internet. Object was in cache, but original source was newer. NotModified = Object retrieved from cache. Client performed an If-Modofied-Since and object was found to be current MemberObject = Source is the cache of another Proxy array member server Upstream = Source is an upstream Proxy Server's cache
22	ResultCode	Status code of transaction A value less than 100 is a Win32 error code. A value between 100 and 1000 is an HTTP status code A value greater than 10000 is a Winsock status code.
23	CacheInfo	A random cache number. If the Combined Hotfix is installed, the value is always zero.

Q186799 Proxy Server: Logging Bytes Sent and Bytes Received

Additional query words: logfile w3 logging


Keywords          : 
Version           : winnt:2.0
Platform          : winnt 
Issue type        : kbhowto

Last Reviewed: July 20, 1999