LevelBlue Knowledge Base

KB Home Search Latest Additions Most Popular

Knowledgebase

Home » Knowledgebase » Legacy Products » Firewall Suite » INFO: Sample Log File - Microsoft ISA Log File Format

INFO: Sample Log File - Microsoft ISA Log File Format

Show/Hide Article Tools

This article applies to:

Firewall Suite 4.X

Question:

What is an example of a Log File in Microsoft ISA Log File Format?

Information:

Sample Log File Format (ISA Format):

10.0.0.2, anonymous, Mozilla/4.0 (compatible; MSIE 4.01; Windows NT), N, 5/22/2000, 11:03:48, w3proxy, SERVERNAME, -, www.gamespot.com, 206.132.131.50, 80, 250, 426, 293, http, TCP, GET, http://www.gamespot.com/, -, VFInet, 302, 1073741824, -, - <<>> 10.0.0.2, anonymous, Mozilla/4.0 (compatible; MSIE 4.01; Windows NT), N, 5/22/2000, 11:03:49, w3proxy, SERVERNAME, -, www.zdnet.com, 205.181.112.65, 80, 861, 7820, 369, http, TCP, GET, http://www.zdnet.com/gamespot/shared/styles/gs_basic.css, -, VFInet, 200, 8388608, -, -<<>> 10.0.0.2, anonymous, Mozilla/4.0 (compatible; MSIE 4.01; Windows NT), N, 5/22/2000, 11:03:50, w3proxy, SERVERNAME, -, www.zdnet.com, 205.181.112.65, 80, 901, 4233, 366, http, TCP, GET, http://www.zdnet.com/gamespot/shared/styles/gs_ns.css, -, VFInet, 200, 8388608, -, - <<>> 10.0.0.2, anonymous, Mozilla/4.0 (compatible; MSIE 4.01; Windows NT), N, 5/22/2000, 11:03:51, w3proxy, SERVERNAME, -, www.zdnet.com, 205.181.112.65, 80, 2283, 15629, 362, http, TCP, GET, http://www.zdnet.com/gamespot/shared/navbar_js.js, -, VFInet, 200, 8388608, -, - <<>> 10.0.0.2, anonymous, Mozilla/4.0 (compatible; MSIE 4.01; Windows NT), N, 5/22/2000, 11:03:52, w3proxy, SERVERNAME, -, www.zdnet.com, 205.181.112.65, 80, 1713, 680, 405, http, TCP, GET, http://www.zdnet.com/gamespot/shared/all_off.gif, -, VFInet, 200, 8388608, -, - <<>>

Note: Firewall Suite is not able to analyze the W3C format of Microsoft ISA log files. The server should be configured to log in the ISA format. The Firewall Configuration Guide provides further details about how to configure the server for ISA logging. You can obtain this Guide from the following page:

https://support.levelblue.com/Firewall-Suite/Documentation.asp

Sample Log File Format (W3C Format):

#Software: Microsoft(R) Internet Security and Acceleration Server 2000
#Version: 1.0
#Date: 2002-02-27 02:34:42
#Fields: date time source-ip destination-ip protocol param#1 param#2 tcp-flags filter-rule interface ip-header payload
2002-02-27 02:34:42 172.16.0.2 172.16.0.255 Udp 137 137 - BLOCKED 172.16.0.3 45 00 00 4e 1a 77 00 00 80 11 c7 06 ac 10 00 02 ac 10 00 ff 00 89 00 89 00 3a 37 13 d9 b2 01 10 00 01 00 00 00 00 00 00 20 45 47 45 4a 46 43 45 46 46 48 45 42 45 4d 45 4d 46 50 45 4d 45 42 45 43 43 41 43 41 43 41 42 4c 00 00 20 00 01
2002-02-27 02:34:42 172.16.0.2 172.16.0.255 Udp 137 137 - BLOCKED 172.16.0.3 45 00 00 4e 1b 77 00 00 80 11 c6 06 ac 10 00 02 ac 10 00 ff 00 89 00 89 00 3a 36 0f d9 b6 01 10 00 01 00 00 00 00 00 00 20 45 47 45 4a 46 43 45 46 46 48 45 42 45 4d 45 4d 46 50 45 4d 45 42 45 43 43 41 43 41 43 41 42 4d 00 00 20 00 01