more proxy dlf fields (was: Re: PROPOSAL: schema for proxy superservice)

[Joost van Baal]

On Wed, Jan 09, 2002 at 04:58:24PM -0500, Francis J. Lacoste wrote:
> Proposal for the Proxy superservice schema
> ------------------------------------------

> The following fields convers all informations available across those
> format:
> 
> timestamp    - timestamp of the request
<snipped some others>

I've found

    'c-agent'        => 'ms_agent',
    # e.g. Mozilla/4.0 (compatible; MSIE 5.0; Win32)
    # or Outlook Express/5.0 (MSIE 5.0; Windows 98; DigExt)
    
    'cs-protocol'    => 'protocol',
    
    'cs-referred'    => 'referred_host',
    # Referring server name (cs-referred): If ISA Server is used upstream in
    # a chained configuration, this indicates the server name of the
    # downstream server that sent the request.
    
    'r-host'         => 'dst_host',

    'r-ip'           => 'dst_ip',

    'r-port'         => 'dst_port',

    's-computername' => 'computername',
    # Proxy name (s-computername) The name of the computer running ISA Server.
    # This is the computer name that is assigned in Windows 2000. e.g. GRO1SYX01

    's-object-source'=> 'object_source',
    # Object source (s-object-source) Indicates the source that was used to·
    # retrieve the current object. This field applies only to the Web Proxy·
    # service log.·
    #
    # values and their meanings:
    # 0           No source information is available.
    # Cache       Source is the cache. Object returned from cache.
    # Inet        Source is the Internet. Object added to cache.
    # Member      Returned from another array member.
    # NotModified Source is the cache. Client performed an If-Modified-Since
    #              request and object had not been modified.
    # NVCache     Source is the cache. Object could not be verified to source.
    # Upstream    Object returned from an upstream proxy cache.
    # Vcache      Source is the cache. Object was verified to source and had
    #              not been modified.·
    # VFInet      Source is the Internet. Cached object was verified to source
    #              and had been modified.

    's-operation'    => 'operation',

in a MS ISA server log.  How about adding these to the proxy dlf
specification?  Or do you feel an extended scheme could better be used
for these?  I have no clue about this yet...

Bye,

Joost

-- 
Joost van Baal              . .           http://www.logreport.org/
                           .   .
/^LogReport$/               . .               joostvb at logreport.org

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: not available
Url : http://lists.logreport.org/pipermail/development/attachments/20020118/d58a029c/attachment.bin