accesslog format Options

Juniper Networks recommends that you do not change the default format as it conforms to NCSA standard, followed by APACHE, SQUID etc; however, you may do so if you wish. Media Flow Controller is capable of tracking all the fields indicated below. Options are given in Table 22 (use any combination).

Table 22 Accesslog Format Options  

Field	Description
%9 (RFC 931 authentication server)	The username associated with the client connection, determined from an Ident (RFC 931) server running on the client host.
%b (Bytes Out No Header) (default)	The size of the object returned to the client, not including the response headers. If no content was returned to the client, this value is "-" (dash).
%c (cache_hit)	Shows from where the object is delivered; for example, Buffer (from buffer cache), Origin (from origin), Tunnel (from tunnel path), SSD (from SSD disk), SAS (from SAS disk), SATA (from STAT disk), NFS (from NFS manager), TFM (from temporary file manager).
%f (filename)	The requested filename.
%h (remote_host)	The IP address of the client (remote host) that made the request. The IP address reported here is not necessarily the address of the machine at which the user is sitting. If a proxy server exists between the user and the server, this address is the address of the proxy, rather than the originating machine.
%i (header)	Contents of header line(s) in the request sent to the server.
%m (request_method)	The method the incoming request used.
%o (response_header)	Contents of the header lines in the response.
%q (query_string)	The query string; prepended with a ? if a query string exists, otherwise an empty string.
%r (request_line) (default)	The request line from the client, including the method, path, query-string, and protocol; this is equivalent to %m %U %H.
%s (status) (default)	The request status code the server sends back to the client: • Successful response (codes begin at 2), • Redirection (codes begin at 3), • Error (at client, codes begin at 4), at Server (codes begin at 5). See “Status/Error Codes” on page 115 for more details.
%t (timestamp) (default)	The time that the server finished processing the request. The format is day/month/year:hour:minute:second zone: • day = 2*digit • month = 3*letter • year = 4*digit • hour = 2*digit • minute = 2*digit • second = 2*digit • zone = (`+' | `-') 4*digit
%u (remote_user) (default)	Remote userid (from auth); may be bogus if return status (%s) is 401 because the user is not yet authenticated. If the document is not password protected, this entry "-" (dash).
%v (server_name)	The canonical ServerName of the server serving the request.
%y (status_subcode) (default)	If present, provides more detail describing the status of the response.
%D (time_used_ms)	Time taken to serve the request, in milliseconds.
%E (time_used_in_seconds)	The elapsed real (wall clock) time used by the process.
%H (request_protocol)	The protocol the incoming request used.
%I (bytes_in)	Bytes received, including request and headers; cannot be zero.
%N (Namespace name)	The namespace referenced in the URL.
%O (bytes_out)	Bytes sent, including headers; cannot be zero.
%U (URL)	The URL path requested, not including any query string.
%V (HTTP_host) (default)	The server name according to the UseCanonicalName setting.
%X (remote_address)	Socket client IP address.
%Y (local_address)	Media Flow Controller local socket IP address referring to one of the network interfaces.
%Z (server_port)	Media Flow Controller port number; the port through which the client made the successful transaction (usually 80).

The Referer and User-Agent (default) fields are from the HTTP client request. Example:

10.1.1.101 10.1.1.11 - [30/Dec/2008:20:03:54 +0000] "GET /bbb HTTP/1.0" 200 712 "-" "test client"

The "referer" gives the site that the client reports having been referred from; the "user-agent" is the identifying information that the client browser reports about itself.