Sophos XG Firewall | Appendix A - Logs | 552
Data Fields
fw_rule_id user_name user_gp iap category category_type url content_type httpresponsecode src_ip dst_ip protocol src_port dst_port sent_bytes recv_bytes domain string string string string string string string integer integer
Type
integer string string integer integer integer integer string
Description
Firewall Rule ID which is applied on the traffic
User name
Group name to which the user belongs.
Web Filter policy ID applied on the traffic
Name of the category under which website falls
Type of category under which website falls
URL of the webpage accessed
Type of the content code of HTTP response
Original Source IP address of traffic
Original Destination IP address of traffic
Protocol number of traffic
Original Source Port of TCP and UDP traffic
Original Destination Port of TCP and
UDP traffic
Total number of bytes sent
Total number of bytes received
Domain of the website accessed
Application Filter Logs
Logs are displayed only if Web Protection Module is subscribed.
Message ID
17051
Message
Application access was denied according to application filter policy
Sample Logs
device="SFW" date=2017-02-01 time=18:13:29 timezone="IST" device_name="SG115" device_id=S110016E28BA631 log_id=054402617051 log_type="Content Filtering" log_component="Application" log_subtype="Denied" priority=Information fw_rule_id=1 user_name="" user_gp="" application_filter_policy=8 category="Mobile Applications" application_name="Gtalk Android" application_risk=4 application_technology="Client Server" application_category="Mobile Applications" src_ip=5.5.5.15
src_country_code=DEU dst_ip=74.125.130.188 dst_country_code=USA protocol="TCP" src_port=49128 dst_port=5228 sent_bytes=0 recv_bytes=0 status="Deny" message=""
Module-specific Fields
Sophos XG Firewall | Appendix A - Logs | 553
Data Fields
fw_rule_id user_name user_group application_filter_policy category application_name application_risk
Type
integer string string integer string string integer application_technology application_category src_ip src_country_code dst_ip dst_country_code protocol src_port dst_port sent_bytes recv_bytes status message string string string string string integer integer integer integer integer integer string string
Description
Firewall Rule ID which is applied on the traffic
User name
Group name to which the user belongs.
Application Filter Policy ID applied on the traffic
Name of the category under which application falls
Name of the application accessed
Risk level assigned to the application
1 - VERY LOW
2 - LOW
3 - MEDIUM
4 - HIGH
5 - VERY HIGH
Technology of the application
Browser Based
Client Server
Network Protocol
P2P
Name of the category under which application falls
Original Source IP address of traffic
Code of the country to which the source
IP belongs
Original Destination IP address of traffic
Code of the country to which the destination IP belongs
Protocol number of traffic
Original Source Port of TCP and UDP traffic
Original Destination Port of TCP and
UDP traffic
Total number of bytes sent
Total number of bytes received
Ultimate state of traffic – accept/deny
Message displayed
