Log messages

JSON fields

All Security Gateway log messages are written in JSON format. This is a list of all available JSON fields including a short description. The column CEF Alias shows the field aliases used in CEF exports.

Field Name

CEF Alias

Description

log_id

Message ID

log_cat

Message category

req_id

cs1

ID of the request

sess_id

cs2

ID of the session the request belongs to

corr_id

Request correlation ID

corr_id_2

Second request correlation ID

corr_id_3

Third request correlation ID

mapping

destinationServiceName

Mapping name used to handle the request

entry_url

Entry URL of the request

entry_path

request

Entry path of the request

entry_query

request

Query parameters of the entry URL

audit_token

suser

Audit token set by the authentication server. This usually represents an individual user.

tech_client_id

Technical client ID extracted from request.

tech_client_display_name

Display name of the technical client.

tech_client_label

Label of the technical client.

tech_client_subscription_id

Subscription ID of the technical client.

tenant

Tenant of the requested mapping or virtual host

th_mode

Threat handling mode

vhost

dhost

The FQDN of the virtual host

vhost_ip

dst / c6a3

The IP address the virtual host is listening on

vhost_port

dpt

The port the virtual host is listening on

vhost_proto

app

The HTTP protocol used in the request

vhost_proto_vers

The HTTP protocol version used in the request

back_host

The back-end host the request was sent to

back_host_ip

The IP address of the back-end host the request was sent to

back_host_port

The port of the back-end host the request was sent to

back_host_proto

The protocol of the back-end host the request was sent to

http_method

requestMethod

The HTTP method used in the request

http_status

cn1

The HTTP status code delivered to the client

http_user_agent

The user agent header sent by the client

http_accept_lang

The accept language header sent by the client

backend_url

Back-end URL of the request

http_redirect_url

The redirect URL delivered to the client

http_referrer

requestContext

The referrer URL sent by the client

req_size

in

The number of bytes received from the client

resp_size

out

The number of bytes received from the back-end

time_total

cn2

The total time taken to handle the request, in microseconds

time_filter

The time taken to filter the request, in microseconds

time_req_icap

The time taken by ICAP services for processing the request, in microseconds

time_backend

The time waited until the back-end sent an answer, in microseconds

time_resp

The time taken to process the response from the back-end, in microseconds

time_resp_icap

The time taken by ICAP services for processing the response, in microseconds

time_wsock_total

The total time taken to handle the WebSocket connection, in microseconds

client_ip

src / c6a2

The IP address of the client. Usually, this is the connection IP address (front_src_ip). If a reverse proxy or load balancer is in place and sets the X-Forwarded-For header, Airlock Gateway can be configured to use the X-Forwarded-For value as client_ip

front_src_ip

The IP address from which the front-end TCP connection was established

front_src_port

The port from which the front-end TCP connection was established

front_dst_ip

The IP address the client connected to

front_dst_port

The port the client connected to

back_src_ip

The IP address Airlock Gateway used to connect to the back-end server

back_src_port

The port Airlock Gateway used to connect to the back-end server

back_dst_ip

The IP address of the back-end server Airlock Gateway connected to

back_dst_port

The port of the back-end server Airlock Gateway connected to

geoip_continent

Continent code resolved for the client IP address (client_ip)

geoip_country

Country code resolved for the client IP address (client_ip)

geoip_location

cs3

Latitude and longitude resolved for the client IP address (client_ip)

wsock_bytes_in

Number of bytes received from the client (WebSocket)

wsock_bytes_out

Number of bytes sent to the client (WebSocket)

front_tls_sess_id

The ID of the TLS session on the front-end

front_tls_proto

The TLS protocol that has been negotiated on the front-end

front_tls_cipher

The TLS cipher that has been negotiated on the front-end

front_tls_client_subject_dn

The subject's distinguished name (DN) of the TLS client certificate

sess_auth

Flag indicating whether the session was authenticated or not

sess_count_auth

Count of authenticated sessions

sess_count_auth_licensed

The licensed limit of authenticated sessions

sess_count_total

Total count of sessions

reason

Reason for connection or session termination

lifetime

Lifetime of the session in seconds

reject_type

Reject type for the rejected request

block_type

Technology used to block the attack

attack_type

cs4

Type of the blocked attack

rule_name

Name of the rule which triggered the block

rule_key

Short name of the rule which triggered the block

ip_lists

Matching IP list names

rule_group

Name of the deny rule group which triggered the block

rule_group_key

Short name of the deny rule group which triggered the block

action

act

Action taken by Airlock Gateway for this request

constraint

Violated constraint that lead to the block

position

Description of where the error/block was detected

file

Filename

error_code

The error code returned by libcurl

req_rate

The measured request rate (requests per second)

req_rate_licensed

The licensed request rate (requests per second)

ml_app

Anomaly Shield application

ml_anomaly

Anomaly Shield session anomaly tag

message

msg

Message describing the log event

trunc

This field is only added when the truncation mechanism has skipped one or more fields. It is added with the value "1".

Block Summary

A block message will be written whenever a request is blocked, giving a short description of why the request was blocked. The log ID of block messages starts with BLOCK- or BLOCKDET-.

Every message will log the fields listed in the JSON fields. Some fields may be left out when there is no value available, and others may write <n/a> instead.

List of log messages:

Message ID

Attack Type

Block Type

Description

WR-SG-BLOCK-108-01

Filter evasion

Multipart Parser

illegal boundary characters "..." found in multipart POST

WR-SG-BLOCK-108-02

Filter evasion

Multipart Parser

multiple content-disposition headersfound in multipart POST

WR-SG-BLOCK-108-03

Filter evasion

Multipart Parser

nesting level (...) exceeded in multipart POST

WR-SG-BLOCK-108-04

Filter evasion

Multipart Parser

Syntax Error in multipart POST: no delimiter found in request body "..."

WR-SG-BLOCK-108-05

Filter evasion

Multipart Parser

delimiter found in multipart header "..."

WR-SG-BLOCK-108-06

Filter evasion

Multipart Parser

multiple multipart boundary definitions found in content-type header "..."

WR-SG-BLOCK-108-07

Filter evasion

Multipart Parser

Syntax Error in multipart POST: Error while parsing multipart header "..."

WR-SG-BLOCK-108-08

Filter evasion

Multipart Parser

multipart boundary definition not found in content-type header "..."

WR-SG-BLOCK-108-10

Filter evasion

Multipart Parser

Syntax Error in multipart POST: Missing newline characters ...

WR-SG-BLOCK-108-11

Filter evasion

Multipart Parser

Syntax Error in multipart POST: Missing delimiter

WR-SG-BLOCK-108-20

Unsafe multipart headers

Multipart Parser

Multipart header blacklist rule was triggered by multipart header "..."

WR-SG-BLOCK-108-21

Unsafe multipart headers

Multipart Parser

Multipart header allowlist rule was triggered by multipart header "..."

WR-SG-BLOCK-108-30

Filter evasion

Multipart Parser

Error while decoding multipart content: ...: "..."

WR-SG-BLOCK-108-35

Filter evasion

Multipart Parser

Trailing characters found after encoded content "..."

WR-SG-BLOCK-108-40

Filter evasion

Multipart Parser

Filename was empty but content was not

WR-SG-BLOCK-109-01

Filter evasion

JSON Parser

JSON syntaxerrormessage: "..." in ...

WR-SG-BLOCK-109-02

Filter evasion

JSON Parser

Failed to sanitize JSON data (UTF8) in ...

WR-SG-BLOCK-109-03

Filter evasion

JSON Parser

Failed to convert JSON data (from ... to UTF-8) in ...

WR-SG-BLOCK-117-01

Filter evasion

GraphQL

Multiple definition error: "..."

WR-SG-BLOCK-117-02

Filter evasion

GraphQL

Query syntax error: "..."

WR-SG-BLOCK-117-03

Noncompliant API usage

GraphQL

Validation error in operation: "..."

WR-SG-BLOCK-117-04

Filter evasion

GraphQL

Forbidden action in operation "..." : "..."

WR-SG-BLOCK-118

Denial of service

GraphQL

Limit exceeded in operation "..." : "..."

WR-SG-BLOCK-120-01

URL tampering

URL Encryption

Decryption failed for request URL using passphrase based encryption. URL has been modified by client or was encrypted for a different user session using session based encryption.

WR-SG-BLOCK-120-02

URL tampering

URL Encryption

Decryption failed for request URL using session based encryption. URL hasbeenmodifiedbyclient.

WR-SG-BLOCK-120-03

URL tampering

URL Encryption

Request URL is not or incorrectly encrypted (unrecognized/wrong encryption mode).

WR-SG-BLOCK-120-04

URL tampering

URL Encryption

Decryption failed for encrypted request URL. URL belongs to an unknown (expired or otherwise different) session or the passphrase has changed.

WR-SG-BLOCK-120-05

URL tampering

URL Encryption

Request URL is PBE encrypted but SBE is configured.

WR-SG-BLOCK-131-01

Filter evasion

ParameterNormalization

Filter notification: parameter normalization failed on data "..." using default charset:... fallback:...

WR-SG-BLOCK-131-02

Filter evasion

ParameterNormalization

Filter notification: parameter normalization failed on data "..." using charset from content-type:...

WR-SG-BLOCK-131-03

Filter evasion

ParameterNormalization

Filter notification: parameter normalization not possible from unsupported charset derived from content-type "..."

WR-SG-BLOCK-131-04

Filter evasion

ParameterNormalization

Filter notification: ... in path "...". UTF-8 is enforced.

WR-SG-BLOCK-131-05

Filter evasion

ParameterNormalization

Filter notification: ... in header "...". UTF-8 isenforced.

WR-SG-BLOCK-131-06

Filter evasion

ParameterNormalization

Filter notification: ... in ... "...". UTF-8 is enforced.

WR-SG-BLOCK-131-07

Filter evasion

ParameterNormalization

Filter notification: Charset encoding "..." found in Content-Type header. UTF-8 isenforced.

WR-SG-BLOCK-131-08

Filter evasion

BodyNormalization

Filter notification: ... in body of content-type "...". UTF-8 isenforced.

WR-SG-BLOCK-135-01

Parametertampering

URL Encryption

Location parameter "..." with value "..." is invalid: ...

WR-SG-BLOCK-111-00

URL tampering

Allow Rule

no allow rule matched

WR-SG-BLOCK-111-06

Requesttampering

Allow Rule

Content-Type of request (...) does not match Content-Type pattern "..." , path pattern:"..."

WR-SG-BLOCK-111-05

Requesttampering

Allow Rule

HTTP method "..." does not match the method pattern "..."

WR-SG-BLOCK-111-04

Parametertampering

Allow Rule

Parameter value is not allowed. Value "..." of parameter "..." does not match value pattern "..." , path pattern:"..."

WR-SG-BLOCK-111-08

Parametertampering

Allow Rule

Parameter "..." is not allowed because there is no parameter rule defined that would match the parameter name. The parametervaluewouldbe"..." ,pathpattern:"..."

WR-SG-BLOCK-111-07

Parametertampering

Allow Rule

The request must contain a parameter matching pattern "..." , path pattern:"..."

WR-SG-BLOCK-111-20

URL tampering

Parameter Limits

Path has length ..., but at most ... would be allowed

WR-SG-BLOCK-111-21

Parametertampering

Parameter Limits

There are ... parameters, but at most ... would be allowed

WR-SG-BLOCK-111-22

Parametertampering

Parameter Limits

Length of parameter name "..." is ... bytes, but at most ... bytes would be allowed

WR-SG-BLOCK-111-23

Parametertampering

Parameter Limits

Value "..." of parameter "..." contains ... bytes, but at most ... bytes would be allowed

WR-SG-BLOCK-117-01

Filter evasion

GraphQL

Multiple definitionerror: ...

WR-SG-BLOCK-117-02

Filter evasion

GraphQL

Query syntaxerror: ...

WR-SG-BLOCK-117-03

Noncompliant API usage

GraphQL

Validation error in operation "...": ...

WR-SG-BLOCK-117-04

Filter evasion

GraphQL

Forbidden action in operation "...": ...

WR-SG-BLOCK-118

Denial of service

GraphQL

Limit exceeded in operation "...": ...

WR-SG-BLOCK-115

...

OpenAPI

...

WR-SG-BLOCKDET-115

...

OpenAPI

......

WR-SG-BLOCK-116

...

JSON Limits

...

WR-SG-BLOCK-122-00

Parametertampering

FormProtection

Parameter "..." is illegal according to form signature

WR-SG-BLOCK-122-02

Parametertampering

FormProtection

Value "..." of parameter "..." is illegal according to form signature

WR-SG-BLOCK-122-03

Parametertampering

FormProtection

Value length of parameter "..." (... bytes) exceeds maximum allowed length (... bytes).

WR-SG-BLOCK-122-04

Parametertampering

FormProtection

Form signature ID is invalid.

WR-SG-BLOCK-122-05

Parametertampering

FormProtection

Value "..." for parameter "..." of type "..." is invalid according to validation pattern "..."

WR-SG-BLOCK-122-06

Parametertampering

FormProtection

Required parameters {...} have been omitted

WR-SG-BLOCK-130

Cross-site request forgery

CSRFProtection

CSRF attack detected. CSRF token is invalid or missing.

WR-SG-BLOCK-190

Botaccess

Bot Management

The client does not support cookies: ...

WR-SG-BLOCK-110-01

...

Deny Rule

Deny rule was triggered

WR-SG-BLOCK-112

Unwanted IP

IP Allowlist

IP allowlist did not match

WR-SG-BLOCK-113

...

ThreatIntelligence

Bad IP detected

WR-SG-BLOCK-114

Blacklisted IP

IP Blacklist

IP blacklistmatched

WR-SG-BLOCKDET-110-01

...

Deny Rule

Blockedpath: "..."

WR-SG-BLOCKDET-110-02

...

Deny Rule

Blockedmethod: "..."

WR-SG-BLOCKDET-110-03

...

Deny Rule

Blocked Content-Type: "..."

WR-SG-BLOCKDET-110-05

...

Deny Rule

Blockedparameter: "...=..." (...)

WR-SG-BLOCKDET-110-06

...

Deny Rule

Blockedheader: "...: ..."

WR-SG-BLOCK-140-01

Parameterpollution

HTTP Parameter Pollution

Multiple parameters with the same name "..." and different types (..., ...) found

WR-SG-BLOCK-145

Filter evasion

Web Listener Checks

Maximum request body size exceeded

WR-SG-BLOCK-125

Parametertampering

DyVE

Parameter "..." with value "..." is illegal according to dynamic value endorsement

WR-SG-BLOCK-150-01

Behaviour anomaly

Client Fingerprinting

Client Fingerprinting: Blocking request

WR-SG-BLOCK-150-02

Behaviour anomaly

Client Fingerprinting

Client Fingerprinting: Blocking request and terminating session

WR-SG-BLOCK-160

Denial of service

DOSThresholds

Maximum number of allowed requests (...) within ... seconds for this IP (...) reached

WR-SG-BLOCK-180

RecurringAttack

Dynamic IP Blacklist

Blocked due to Dynamic IP blacklist

WR-SG-BLOCK-170

Illegalpayload

ICAP

ICAP service "..." at ...:... blocked in REQMOD

WR-SG-BLOCK-161

Denial of service

DOSThresholds

Maximum number of allowed sessions (...) for this IP reached

WR-SG-BLOCK-155

Behaviour anomaly

Anomaly Shield

Session anomaly detected. Matched rule "..." with Trigger(s) "...". Executingblockaction(s) "..."

WR-SG-BLOCK-156

Behaviour anomaly

Anomaly Shield

IP blocked due to previous anomalous behavior detected by Anomaly Shield rule

Request Summary

Airlock Gateways' own access log format replaced the classic access-log of Apache, the Request Summary. For each request such a summary will be written. The summary is enhanced with much more information about the request than a normal HTTPd log line can provide. The request summary will be logged with the log ID WR-SG-SUMMARY.

Every message will log the fields listed in the JSON fields. Some fields may be left out when no value is available, and others may write <n/a> instead.

List of log messages:

Message ID

Description

WR-SG-SUMMARY

Request processed

WR-SG-SUMMARY-LP

Session logout propagation with URL "{}"

Reject Summary

A request may be rejected due to errors or system limitations. In that case a reject message will be logged. The log ID of reject messages start with "REJECT-".

Every message will log the fields listed in the JSON fields. Some fields may be left out when no value is available, and others may write <n/a> instead.

List of log messages:

Message ID

Reject Type

Description

WR-SG-REJECT-105

System

Error (...) while matching content-type "..."

WR-SG-REJECT-111-26

Config

allow rule "...": not properly initialized: ...

WR-SG-REJECT-115

Config

OpenAPI configuration is invalid

WR-SG-REJECT-190

Config

Redirecting to the cookie check URL: ...

WR-SG-REJECT-100

Config

... is invalid due to malformed pattern

WR-SG-REJECT-117

Config

GraphQL configuration is invalid

WR-SG-REJECT-120

System

... failed due to communication error with ip-info-service

WR-SG-REJECT-140

Web Listener

Web listener aborted the request with status code ...

WR-SG-REJECT-141

Web Listener

Maximum request read time exceeded

WR-SG-REJECT-101

Config

No matching mapping found

WR-SG-REJECT-102

Config

No matching virtual host found

WR-SG-REJECT-103

Config

No matching Back-end Group found

WR-SG-REJECT-200

Config

Mapping is under maintenance. Redirecting request to maintenance page at "..."

WR-SG-REJECT-250

Config

Running in restricted mode, rejecting request due to missing or invalid license

WR-SG-REJECT-700

Access

Required API key not provided.

WR-SG-REJECT-701

Access

API Policy Service - ...

WR-SG-REJECT-702

Access

API Policy Service - ...

WR-SG-REJECT-703

Access

API Policy Service - ...

WR-SG-REJECT-704

Limit

API Policy Service - ...

WR-SG-REJECT-720

Access

API Policy Service not configured

WR-SG-REJECT-300

Access

User not authorized to access mapping: ...

WR-SG-REJECT-300-01

Access

Browser is not authorized to access the favicon

WR-SG-REJECT-301-01

Config

on-behalf-login error: Basic authentication credentials not set but required by configuration. Aborting request

WR-SG-REJECT-302-01

Config

on-behalf-login error: NTLM credentials not set but required by configuration. Aborting request

WR-SG-REJECT-303-01

Config

on-behalf-login error: Kerberos credentials not set but required by configuration. Aborting request

WR-SG-REJECT-801-01

System

Fatal error during backend request "..." for host "..." (...)

WR-SG-REJECT-802

Environment

Backend timeout occurred

WR-SG-REJECT-804

Environment

Back-end communication error: All Back-end Hosts ... failed

WR-SG-REJECT-301-02

Config

on-behalf-login error: Basic authentication failed. Server returned 401 (not authorized) error. Redirecting request

WR-SG-REJECT-302-02

Config

on-behalf-login error: NTLM authentication failed. Server returned 401 (not authorized) error. Redirecting request

WR-SG-REJECT-303-02

Config

on-behalf-login error: Kerberos authentication failed for SPN "...". Server returned 401 (not authorized) error. Redirecting request

WR-SG-REJECT-400

Config

Request handler mapping error: .........

WR-SG-REJECT-401

Config

Response handler mapping error: ...

WR-SG-REJECT-505

Environment

Cannot perform backend failover because the request body has been truncated

WR-SG-REJECT-520

System

Back-end state machine: Invalid signal "..." for state "..."

WR-SG-REJECT-180

System

Internal stream handler error in ...: ...

WR-SG-REJECT-181

System

Child process has been signaled to terminate.

WR-SG-REJECT-820-02

Environment

ICAP client: Idle request timeout (...s) on ICAP service "..." at ...:...

WR-SG-REJECT-820-03

Environment

ICAP client: Request buffer limit has been exceeded on ICAP service "...", failover not possible

WR-SG-REJECT-820-04

Config

ICAP client: Error initializing ... request, ...

WR-SG-REJECT-820-05

System

ICAP client: ...

WR-SG-REJECT-820-06

Environment

ICAP client: No more servers available for ICAP service "..."

WR-SG-REJECT-821-01

Environment

ICAP client: ICAP response parser failed: ... (invalid response from icap server)

WR-SG-REJECT-821-02

Environment

ICAP client: No encapsulation header present in ICAP response

WR-SG-REJECT-822-01

Environment

ICAP client: Error creating HTTP ...

WR-SG-REJECT-060

Environment

ICAP client: ICAP response contains HTTP request - This should not happen when ICAP request mode was not REQMOD

WR-SG-REJECT-061

Environment

ICAP client: ICAP response contains malformed ...

WR-SG-REJECT-171

Environment

ICAP service "..." at ...:... responded in ... with ICAP status code ...

WR-SG-REJECT-823-01

Config

ICAP client: Forbidden path change detected during ICAP REQMOD (Client View) from path:... to path:... that would change the mapping from mapping:... to mapping:... , service "..." at ...:...

WR-SG-REJECT-823-02

Config

ICAP client: Forbidden path change detected during ICAP REQMOD (Client View) from path:... to path:... (slash is missing) , ICAP service "..." at ...:...

WR-SG-REJECT-823-03

Config

ICAP client: Forbidden path change detected for an encrypted request during ICAP REQMOD (Client View) from path ... to path ... ICAP service "..." at ...:...

WR-SG-REJECT-823-04

Config

ICAP client: Forbidden query change detected for an encrypted request during ICAP REQMOD (Client View) from query ... to query ..., ICAP service "..." at ...:...

WR-SG-REJECT-805-01

System

Idle child timeout for child ... after ... seconds. Invoking child terminator.

WR-SG-REJECT-805-02

System

Hard child timeout for child ... after ... seconds. Invoking child terminator.

WR-SG-REJECT-150-01

System

Failed to create session. Rejecting request. Reason of failure: ...

WR-SG-REJECT-150-02

System

Failed to create session. Rejecting request. Reason of failure: ...

WR-SG-REJECT-151

System

Session tracking mode switch to ...:... failed. Rejecting request.

WR-SG-REJECT-152

System

Failed to assure session tracking mode. Rejecting request.

WR-SG-REJECT-560

System

Allowed number of concurrent authenticated sessions exceeded. Licensed are ..., grace margin is ... and currently used are .... Please contact product support or sales for a license upgrade.

WR-SG-REJECT-112

System

Not enough space in credentials store for credential "...". ... bytes used (limit ...) and ... credentials stored

WR-SG-REJECT-113

System

Too many entries in credentials store. Limit of ... entries reached. Rejected credential "..."

WR-SG-REJECT-155

Config

Request for SSL-tracked Airlock Gateway session uses wrong SSL session. Terminating session.

WR-SG-REJECT-901

limit

Virtual host: ...

WR-SG-REJECT-902

limit

Mapping: ...

WR-SG-REJECT-903

limit

Back-end group: ...

Back-end messages

Some events that occur during back-end requests will be reported with back messages. Depending on the severity of the event an according reject message may follow.

Every message will log the fields listed in the JSON fields. Some fields may be left out when no value is available, and others may write <n/a> instead.

List of log messages:

Message ID

Description

WR-SG-BACK-500

Timeout during back-end request "..."

WR-SG-BACK-502

Communication error (...; ...) (errno:...: ...) during backend request "..."

WR-SG-BACK-503

HTTP response indicates back-end failure "..." for request "..."

WR-SG-BACK-506

Resetting original request for back-end failover

WR-SG-BACK-510

Backend request handler: Internal error during back-end request: .... Errno:... ...

WR-SG-BACK-511

Backend request handler: Curl multi error during back-end request: CURLMcode:... .... Errno:... ...

Session start and end messages

There are two messages reporting the start and the end of a session and one message reporting the start of a new TLS session.

Every message will log the fields listed in the JSON fields. Some fields may be left out when no value is available, and others may write <n/a> instead.

Message ID

Description

WR-SG-SESS-004

Session created

WR-SG-SESS-005

Session finished: {}

WR-SG-TLS-SESS-START

TLS session started