This article applies to:

• Firewall Suite 4.x
• Security Reporting Center 2.x

Question:

Information:

egSoftware.com - - [28/Nov/1995:01:51:19 +0000] "GET / HTTP/1.0" 501 0&pksi-nl
egSoftware.com - - [28/Nov/1995:01:51:32 +0000] "GET / HTTP/1.0" 501 0&pksi-nl
egSoftware.com - - [28/Nov/1995:01:51:37 +0000] "GET / HTTP/1.0" 501 0&pksi-nl
egSoftware.com - - [28/Nov/1995:01:51:45 +0000] "GET http://www.yahoo.com/ HTTP/1.0" 0 0&pksi-nl
GLENS_486 - - [28/Nov/1995:01:51:52 +0000] "GET http://www.yahoo.com/images/main.gif HTTP/1.0" 200 2800&pksi-nl

Description of Fields:

• Field 1: User Address
  IP or domain name of the user accessing the site.

• Field 2: RFC931
  This field is used to log the domain for multi-homed web servers.

• Field 3: User Authentication
  

• Field 4: Date/Time
  Date and time the user accessed the site.

• Field 5: GMT Offset
  Number of hours from GMT (if this is +0000 it is logged in GMT time).

• Field 6: Action
  The particular operation of the hit (this must be in quotes).

• Field 7: Return Code
  The return code indicates whether or not the action was successful etc.

• Field 8: Size
  The size of the file sent.

This article was previously published as:

NETIQKB2425