Sophos XG Firewall | Appendix A - Logs | 551
Data Fields
srczone dstzonetype dstzone dir_disp conn_event conn_id vconn_id
Type
string string string string integer integer
Description
Name of source zone
Type of destination zone, e.g., WAN
Name of destination zone
Packet direction. Possible values:“org”, “reply”, “”
Event on which this log is generated
Unique identifier of connection
Connection ID of the master connection
Web Filter Logs
Logs are displayed only if Web Protection Module is subscribed.
Message ID
16001
16002
16003
16004
16005
16006
16007
16008
16009
Message
web site/file/application access is allowed according to the internet access policy web site/file/application access is blocked according to the internet access policy
HTTP File upload allowed
Token override
Website/file/application access is warned allowed according to the Internet access policy
Website/file/application access is warned blocked according to the Internet access policy
HTTP file upload warned allowed
Sandbox file allowed
Sandbox file denied
Sample Logs:
device="SFW" date=2017-01-31 time=14:03:33 timezone="IST" device_name="CR750iNG-XP" device_id=C44313350024-P29PUA log_id=050901616001 log_type="Content Filtering" log_component="HTTP" log_subtype="Allowed" status="" priority=Information fw_rule_id=2 user_name="gaurav" user_gp="Open Group" iap=1 category="Entertainment" category_type="Unproductive" url="https://r8---sn-ci5gup-qxas.googlevideo.com/" contenttype="" override_token="" httpresponsecode="" src_ip=10.198.47.71 dst_ip=182.79.221.19 protocol="TCP" src_port=9444 dst_port=443 sent_bytes=0 recv_bytes=319007 domain=r8---sn-ci5gup-qxas.googlevideo.com
exceptions= activityname="" reason="" device="SFW" date=2017-02-01 time=18:20:21 timezone="IST" device_name="SG115" device_id=S110016E28BA631 log_id=050902616002 log_type="Content Filtering" log_component="HTTP" log_subtype="Denied" status="" priority=Information fw_rule_id=1 user_name="" user_gp="" iap=13 category="Religion & Spirituality" category_type="Unproductive" url="http://hanuman.com/" contenttype="" override_token="" httpresponsecode="" src_ip=5.5.5.15 dst_ip=216.58.197.44 protocol="TCP" src_port=46719 dst_port=80 sent_bytes=0 recv_bytes=0 domain=hanuman.com exceptions= activityname=""
Module-specific Fields
