|
Condition
|
Description
|
|
Date
|
Not localised = always YYYY-MM-DD (GMT/UTC)
|
|
Time
|
Not localised = HH:MM:SS or HH:MM:SS.ZZZ (GMT/UTC) * Note-unfortunately this has two formats (Site
|
|
|
has no .ZZZ milliseconds)
|
|
x-mil
|
Site format only = millisecond of time stamp
|
|
c-ip
|
Client IP as best can be derived from network or X-Forwarded-For header
|
|
c-port
|
Client port as best can be derived from network or X-Forwarded-For header
|
|
cs-username
|
Client’s user-name request field
|
|
s-ip
|
ALB’s listening port
|
|
s-port
|
ALB’s listening VIP
|
|
x-xff
|
Value of X-Forwarded-For header
|
|
x-xffcustom
|
Value of configured-named X-Forwarded-For type request header
|
|
cs-host
|
Host name in the request
|
|
x-r-ip
|
IP address of Real Server used
|
|
x-r-port
|
Port of Real Server used
|
|
cs-method
|
HTTP request method * except Brief format
|
|
method
|
* Only brief format uses this name for cs-method
|
|
cs-uri-stem
|
Path of the requested resource * except Brief format
|
|
cs-uri-query
|
Query for the requested resource * except Brief format
|
|
uri
|
* brief format logs a combined path and query-string
|
|
sc-status
|
HTTP response code
|
|
cs(User-Agent)
|
Browser’s User-Agent string (as sent by client)
|
|
referer
|
Referring page (as sent by client)
|
|
x-c-version
|
Client’s request HTTP version
|
|
x-r-version
|
Content-Server’s response HTTP version
|
|
cs-bytes
|
Bytes from client, in the request
|
|
sr-bytes
|
Bytes forwarded to Real Server, in the request
|
|
rs-bytes
|
Bytes from Real Server, in the response
|
|
sc-bytes
|
Bytes sent to client, in the response
|
|
x-percent
|
Compression percentage * = 100 * ( 1 – output / input) including headers
|
|
time-taken
|
How long the Real Server took in seconds
|
|
x-trip-times new
pcon
|
millisecond from connect to posting in “newbie list”
millisecond from connect to placing the connection to the Real Server
|
|
acon
|
millisecond from connect to finishing placing the connection to the Real Server
|
|
rcon
|
millisecond from connect to establishing real-server connection
|
|
rqf
|
millisecond from connect to receiving the first byte of request from the client
|
|
rql
|
millisecond from connect to receiving the last byte of request from the client
|
|
tqf
|
millisecond from connect to sending the first byte of request to the Real Server
|
|
tql
|
millisecond from connect to sending the last byte of request to the Real Server
|
|
rsf
|
millisecond from connect to receiving the first byte of response from the Real Server
|
|
rsl
|
millisecond from connect to receiving the last byte of response from the Real Server
|
|
tsf
|
millisecond from connect to sending the first byte of response to the client
|
|
tsl
|
millisecond from connect to sending the last byte of response to the client
|
|
dis
|
millisecond from connect to disconnect (both sides – last one to disconnect)
|
|
log
|
millisecond from connect to this log record usually followed by (Load-balance policy and reasoning)
|
|
x-round-trip-time
|
How long ALB took in seconds
|
|
x-closed-by
|
What action caused the connection to be closed (or kept open)
|
|
x-compress-action
|
How compression was carried out, or prevented
|
|
x-sc(Content-Type)
|
Content-Type of response
|
|
x-cache-action
|
How caching responded, or was prevented
|
|
x-finish
|
Trigger that caused this log row
|
