Log messages

JSON fields

All Security Gate log messages are written in JSON format. This is a list of all available JSON fields including a short description. The column CEF Alias shows the field aliases used in CEF exports.

Field Name

CEF Alias

Description

log_id

Log message ID.

log_cat

Log message category.

req_id

cs1

ID of the request.

sess_id

cs2

ID of the session the request belongs to.

corr_id

Request correlation ID.

corr_id_2

Second request correlation ID.

corr_id_3

Third request correlation ID.

mapping

destinationServiceName

Mapping name used to handle the request.

entry_url

Entry URL of the request.

entry_path

request

Entry path of the request.

entry_query

request

Query parameters of the entry URL.

audit_token

suser

Audit token set by the authentication server. This usually represents an individual user.

tech_client_id

Technical client ID extracted from request.

tech_client_display_name

Display name of the technical client.

tech_client_label

Label of the technical client.

tech_client_subscription_id

Subscription ID of the technical client.

tenant

Tenant of the requested mapping or virtual host.

th_mode

Threat handling mode.

vhost

dhost

The FQDN of the virtual host.

vhost_ip

dst / c6a3

The IP address the virtual host is listening on.

vhost_port

dpt

The port the virtual host is listening on.

vhost_proto

app

The HTTP protocol used in the request.

vhost_proto_vers

The HTTP protocol version used in the request.

back_host

The back-end host the request was sent to.

back_host_ip

The IP address of the back-end host the request was sent to.

back_host_port

The port of the back-end host the request was sent to.

back_host_proto

The protocol of the back-end host the request was sent to.

http_method

requestMethod

The HTTP method used in the request.

http_status

cn1

The HTTP status code delivered to the client.

http_user_agent

The user agent header sent by the client.

http_accept_lang

The accept-language header sent by the client.

backend_url

Back-end URL of the request.

http_redirect_url

The redirect URL delivered to the client.

http_referrer

requestContext

The referrer URL sent by the client.

req_size

in

The number of bytes received from the client.

resp_size

out

The number of bytes received from the back-end.

time_total

cn2

The duration1 from the moment all request headers have been read up from the client to the point where all response data has been sent to the client.
Total processing time can vary significantly between different requests.

time_filter

The duration1 the gateway requires to filter the request.

The measured time is a fraction of time_total.

time_backend

The duration1 from establishing the connection between gateway and back-end to receiving the first response byte from the back-end.
The measured time is an indicator of the responsiveness of the back-end.

The measured time is a fraction of time_total.

time_req_icap

Currently not functional.

time_resp_icap

Currently not functional.

time_resp

The duration1 from reading the first response header from the back-end to receiving the last byte of a response from the back-end.
The measured time is a performance indicator of the network and the back-end.

The measured time is a fraction of time_total.

time_wsock_total

The total duration1 required to handle the WebSocket connection. The time measurement starts after the handshake (HTTP upgrade).

client_ip

src / c6a2

The IP address of the client. Usually, this is the connection IP address (front_src_ip). If a reverse proxy or load balancer is in place and sets the X-Forwarded-For header, Airlock Gateway can be configured to use the X-Forwarded-For value as client_ip.

front_src_ip

The IP address from which the front-end TCP connection was established.

front_src_port

The port from which the front-end TCP connection was established.

front_dst_ip

The IP address the client connected to.

front_dst_port

The port the client connected to.

back_src_ip

The IP address Airlock Gateway used to connect to the back-end server.

back_src_port

The port Airlock Gateway used to connect to the back-end server.

back_dst_ip

The IP address of the back-end server Airlock Gateway connected to.

back_dst_port

The port of the back-end server Airlock Gateway connected to.

geoip_continent

Continent code resolved for the client IP address (client_ip).

geoip_country

Country code resolved for the client IP address (client_ip).

geoip_location

cs3

Latitude and longitude resolved for the client IP address (client_ip).

wsock_bytes_in

Number of bytes received from the client (WebSocket).

wsock_bytes_out

Number of bytes sent to the client (WebSocket).

front_tls_sess_id

The ID of the TLS session on the front-end.

front_tls_proto

The TLS protocol that has been negotiated on the front-end.

front_tls_cipher

The TLS cipher that has been negotiated on the front-end.

front_tls_client_subject_dn

The subject's distinguished name (DN) of the TLS client certificate.

sess_auth

Flag indicating whether the session was authenticated or not.

sess_count_auth

Count of authenticated sessions.

sess_count_auth_licensed

The licensed limit of authenticated sessions.

sess_count_total

Total count of sessions.

reason

Reason for connection or session termination.

lifetime

Lifetime of the session in seconds.

reject_type

Reject type for the rejected request.

block_type

Technology used to block the attack.

attack_type

cs4

Type of the blocked attack.

rule_name

Name of the rule that triggered the block.

rule_key

Short name of the rule that triggered the block.

ip_lists

Matching IP list names.

rule_group

Name of the deny rule group that triggered the block.

rule_group_key

Short name of the deny rule group that triggered the block.

action

act

Action taken by Airlock Gateway for this request.

constraint

Violated constraint that led to the block.

position

Description of where the error/block was detected.

file

Filename

error_code

The error code returned by libcurl.

req_rate

The measured request rate (requests per second).

req_rate_licensed

The licensed request rate (requests per second).

ml_app

Anomaly Shield application.

ml_anomaly

Anomaly Shield session anomaly tag.

message

msg

Message describing the log event.

trunc

This field is only added when the truncation mechanism has skipped one or more fields. It is added with the value 1.

1

The time base for Syslog and Elasticsearch is in microseconds, for Kibana and CSV output in milliseconds.

Block Summary

A block message will be written whenever a request is blocked, giving a short description of why the request was blocked. The log ID of block messages starts with BLOCK- or BLOCKDET-.

Every message will log the fields listed in the JSON fields. Some fields may be left out when there is no value available, and others may write <n/a> instead.

List of log messages:

Message ID

Attack Type

Block Type

Description

WR-SG-BLOCK-108-01

Filter evasion

Multipart Parser

illegal boundary characters "..." found in multipart POST.

WR-SG-BLOCK-108-02

Filter evasion

Multipart Parser

multiple content-disposition headers found in multipart POST.

WR-SG-BLOCK-108-03

Filter evasion

Multipart Parser

nesting level (...) exceeded in multipart POST.

WR-SG-BLOCK-108-04

Filter evasion

Multipart Parser

Syntax Error in multipart POST: no delimiter found in the request body "...".

WR-SG-BLOCK-108-05

Filter evasion

Multipart Parser

delimiter found in multipart header "...".

WR-SG-BLOCK-108-06

Filter evasion

Multipart Parser

multiple multipart boundary definitions found in the content-type header "...".

WR-SG-BLOCK-108-07

Filter evasion

Multipart Parser

Syntax Error in multipart POST: Error while parsing multipart header "...".

WR-SG-BLOCK-108-08

Filter evasion

Multipart Parser

multipart boundary definition not found in content-type header "...".

WR-SG-BLOCK-108-10

Filter evasion

Multipart Parser

Syntax Error in multipart POST: Missing newline characters ...

WR-SG-BLOCK-108-11

Filter evasion

Multipart Parser

Syntax Error in multipart POST: Missing delimiter.

WR-SG-BLOCK-108-20

Unsafe multipart headers

Multipart Parser

Multipart header blacklist rule was triggered by multipart header "...".

WR-SG-BLOCK-108-21

Unsafe multipart headers

Multipart Parser

Multipart header allowlist rule was triggered by multipart header "...".

WR-SG-BLOCK-108-30

Filter evasion

Multipart Parser

Error while decoding multipart content: ...: "...".

WR-SG-BLOCK-108-35

Filter evasion

Multipart Parser

Trailing characters found after encoded content "...".

WR-SG-BLOCK-108-40

Filter evasion

Multipart Parser

Filename was empty but content was not.

WR-SG-BLOCK-109-01

Filter evasion

JSON Parser

JSON syntaxerrormessage: "..." in ...

WR-SG-BLOCK-109-02

Filter evasion

JSON Parser

Failed to sanitize JSON data (UTF8) in ...

WR-SG-BLOCK-109-03

Filter evasion

JSON Parser

Failed to convert JSON data (from ... to UTF-8) in ...

WR-SG-BLOCK-117-01

Filter evasion

GraphQL

Multiple definition error: "..."

WR-SG-BLOCK-117-02

Filter evasion

GraphQL

Query syntax error: "..."

WR-SG-BLOCK-117-03

Noncompliant API usage

GraphQL

Validation error in operation: "..."

WR-SG-BLOCK-117-04

Filter evasion

GraphQL

Forbidden action in operation "..." : "..."

WR-SG-BLOCK-118

Denial of service

GraphQL

Limit exceeded in operation "..." : "..."

WR-SG-BLOCK-120-01

URL tampering

URL Encryption

Decryption failed for request URL using passphrase-based encryption. URL has been modified by the client or was encrypted for a different user session using session-based encryption.

WR-SG-BLOCK-120-02

URL tampering

URL Encryption

Decryption failed for request URL using session-based encryption. The URL has been modified by client.

WR-SG-BLOCK-120-03

URL tampering

URL Encryption

The request URL is not or incorrectly encrypted (unrecognized/wrong encryption mode).

WR-SG-BLOCK-120-04

URL tampering

URL Encryption

Decryption failed for the encrypted request URL. URL belongs to an unknown (expired or otherwise different) session or the passphrase has changed.

WR-SG-BLOCK-120-05

URL tampering

URL Encryption

Request URL is PBE encrypted but SBE is configured.

WR-SG-BLOCK-131-01

Filter evasion

ParameterNormalization

Filter notification: parameter normalization failed on data "..." using default charset:... fallback:...

WR-SG-BLOCK-131-02

Filter evasion

ParameterNormalization

Filter notification: parameter normalization failed on data "..." using charset from content-type:...

WR-SG-BLOCK-131-03

Filter evasion

ParameterNormalization

Filter notification: parameter normalization not possible from unsupported charset derived from content-type "..."

WR-SG-BLOCK-131-04

Filter evasion

ParameterNormalization

Filter notification: ... in path "...". UTF-8 is enforced.

WR-SG-BLOCK-131-05

Filter evasion

ParameterNormalization

Filter notification: ... in header "...". UTF-8 is enforced.

WR-SG-BLOCK-131-06

Filter evasion

ParameterNormalization

Filter notification: ... in ... "...". UTF-8 is enforced.

WR-SG-BLOCK-131-07

Filter evasion

ParameterNormalization

Filter notification: Charset encoding "..." found in Content-Type header. UTF-8 is enforced.

WR-SG-BLOCK-131-08

Filter evasion

BodyNormalization

Filter notification: ... in body of content-type "...". UTF-8 is enforced.

WR-SG-BLOCK-135-01

Parameter tampering

URL Encryption

Location parameter "..." with value "..." is invalid: ...

WR-SG-BLOCK-111-00

URL tampering

Allow Rule

no allow rule matched

WR-SG-BLOCK-111-06

Request tampering

Allow Rule

Content-Type of request (...) does not match Content-Type pattern "..." , path pattern:"..."

WR-SG-BLOCK-111-05

Request tampering

Allow Rule

HTTP method "..." does not match the method pattern "..."

WR-SG-BLOCK-111-04

Parameter tampering

Allow Rule

Parameter value is not allowed. Value "..." of parameter "..." does not match value pattern "..." , path pattern:"..."

WR-SG-BLOCK-111-08

Parameter tampering

Allow Rule

Parameter "..." is not allowed because there is no parameter rule defined that would match the parameter name. The parameter value would be"..." ,pathpattern:"..."

WR-SG-BLOCK-111-07

Parameter tampering

Allow Rule

The request must contain a parameter matching pattern "..." , path pattern:"..."

WR-SG-BLOCK-111-20

URL tampering

Parameter Limits

Path has length ..., but at most ... would be allowed

WR-SG-BLOCK-111-21

Parameter tampering

Parameter Limits

There are ... parameters, but at most ... would be allowed

WR-SG-BLOCK-111-22

Parameter tampering

Parameter Limits

Length of parameter name "..." is ... bytes, but at most ... bytes would be allowed

WR-SG-BLOCK-111-23

Parameter tampering

Parameter Limits

Value "..." of parameter "..." contains ... bytes, but at most ... bytes would be allowed

WR-SG-BLOCK-117-01

Filter evasion

GraphQL

Multiple definition error: ...

WR-SG-BLOCK-117-02

Filter evasion

GraphQL

Query syntaxerror: ...

WR-SG-BLOCK-117-03

Noncompliant API usage

GraphQL

Validation error in operation "...": ...

WR-SG-BLOCK-117-04

Filter evasion

GraphQL

Forbidden action in operation "...": ...

WR-SG-BLOCK-118

Denial of service

GraphQL

Limit exceeded in operation "...": ...

WR-SG-BLOCK-115

...

OpenAPI

...

WR-SG-BLOCKDET-115

...

OpenAPI

......

WR-SG-BLOCK-116

...

JSON Limits

...

WR-SG-BLOCK-122-00

Parameter tampering

FormProtection

Parameter "..." is illegal according to form signature

WR-SG-BLOCK-122-02

Parameter tampering

FormProtection

Value "..." of parameter "..." is illegal according to form signature

WR-SG-BLOCK-122-03

Parameter tampering

FormProtection

Value length of parameter "..." (... bytes) exceeds maximum allowed length (... bytes).

WR-SG-BLOCK-122-04

Parameter tampering

FormProtection

Form signature ID is invalid.

WR-SG-BLOCK-122-05

Parameter tampering

FormProtection

Value "..." for parameter "..." of type "..." is invalid according to validation pattern "..."

WR-SG-BLOCK-122-06

Parameter tampering

FormProtection

Required parameters {...} have been omitted

WR-SG-BLOCK-130

Cross-site request forgery

CSRFProtection

CSRF attack detected. CSRF token is invalid or missing.

WR-SG-BLOCK-190

Botaccess

Bot Management

The client does not support cookies: ...

WR-SG-BLOCK-110-01

...

Deny Rule

Deny rule was triggered

WR-SG-BLOCK-112

Unwanted IP

IP Allowlist

IP allowlist did not match

WR-SG-BLOCK-113

...

ThreatIntelligence

Bad IP detected

WR-SG-BLOCK-114

Blacklisted IP

IP Blacklist

IP blacklistmatched

WR-SG-BLOCKDET-110-01

...

Deny Rule

Blockedpath: "..."

WR-SG-BLOCKDET-110-02

...

Deny Rule

Blockedmethod: "..."

WR-SG-BLOCKDET-110-03

...

Deny Rule

Blocked Content-Type: "..."

WR-SG-BLOCKDET-110-05

...

Deny Rule

Blockedparameter: "...=..." (...)

WR-SG-BLOCKDET-110-06

...

Deny Rule

Blocked header: "...: ..."

WR-SG-BLOCK-140-01

Parameterpollution

HTTP Parameter Pollution

Multiple parameters with the same name "..." and different types (..., ...) found.

WR-SG-BLOCK-145

Filter evasion

Web Listener Checks

Maximum request body size exceeded

WR-SG-BLOCK-125

Parameter tampering

DyVE

Parameter "..." with value "..." is illegal according to dynamic value endorsement.

WR-SG-BLOCK-150-01

Behaviour anomaly

Client Fingerprinting

Client Fingerprinting: Blocking request.

WR-SG-BLOCK-150-02

Behaviour anomaly

Client Fingerprinting

Client Fingerprinting: Blocking request and terminating session.

WR-SG-BLOCK-160

Denial of service

DOSThresholds

Maximum number of allowed requests (...) within ... seconds for this IP (...) reached.

WR-SG-BLOCK-180

RecurringAttack

Dynamic IP Blacklist

Blocked due to Dynamic IP blacklist.

WR-SG-BLOCK-170

Illegalpayload

ICAP

ICAP service "..." at ...:... blocked in REQMOD.

WR-SG-BLOCK-161

Denial of service

DOSThresholds

Maximum number of allowed sessions (...) for this IP reached.

WR-SG-BLOCK-155

Behaviour anomaly

Anomaly Shield

Session anomaly detected. Matched rule "..." with Trigger(s) "...". Executingblockaction(s) "...".

WR-SG-BLOCK-156

Behaviour anomaly

Anomaly Shield

IP blocked due to previous anomalous behavior detected by Anomaly Shield rule.

Request Summary

Airlock Gateways' own access log format replaced the classic access-log of Apache, the Request Summary. For each request such a summary will be written. The summary is enhanced with much more information about the request than a normal HTTPd log line can provide. The request summary will be logged with the log ID WR-SG-SUMMARY.

Every message will log the fields listed in the JSON fields. Some fields may be left out when no value is available, and others may write <n/a> instead.

List of log messages:

Message ID

Description

WR-SG-SUMMARY

Request processed

WR-SG-SUMMARY-LP

Session logout propagation with URL "{}"

Reject Summary

A request may be rejected due to errors or system limitations. In that case a reject message will be logged. The log ID of reject messages start with "REJECT-".

Every message will log the fields listed in the JSON fields. Some fields may be left out when no value is available, and others may write <n/a> instead.

List of log messages:

Message ID

Reject Type

Description

WR-SG-REJECT-105

System

Error (...) while matching content-type "..."

WR-SG-REJECT-111-26

Config

allow rule "...": not properly initialized: ...

WR-SG-REJECT-115

Config

OpenAPI configuration is invalid

WR-SG-REJECT-190

Config

Redirecting to the cookie check URL: ...

WR-SG-REJECT-100

Config

... is invalid due to malformed pattern

WR-SG-REJECT-117

Config

GraphQL configuration is invalid

WR-SG-REJECT-120

System

... failed due to communication error with ip-info-service

WR-SG-REJECT-140

Web Listener

Web listener aborted the request with status code ...

WR-SG-REJECT-141

Web Listener

Maximum request read time exceeded

WR-SG-REJECT-101

Config

No matching mapping found

WR-SG-REJECT-102

Config

No matching virtual host found

WR-SG-REJECT-103

Config

No matching Back-end Group found

WR-SG-REJECT-200

Config

Mapping is under maintenance. Redirecting request to maintenance page at "..."

WR-SG-REJECT-250

Config

Running in restricted mode, rejecting request due to missing or invalid license

WR-SG-REJECT-700

Access

Required API key not provided.

WR-SG-REJECT-701

Access

API Policy Service - ...

WR-SG-REJECT-702

Access

API Policy Service - ...

WR-SG-REJECT-703

Access

API Policy Service - ...

WR-SG-REJECT-704

Limit

API Policy Service - ...

WR-SG-REJECT-720

Access

API Policy Service not configured

WR-SG-REJECT-300

Access

User not authorized to access mapping: ...

WR-SG-REJECT-300-01

Access

Browser is not authorized to access the favicon

WR-SG-REJECT-301-01

Config

on-behalf-login error: Basic authentication credentials not set but required by configuration. Aborting request

WR-SG-REJECT-302-01

Config

on-behalf-login error: NTLM credentials not set but required by configuration. Aborting request

WR-SG-REJECT-303-01

Config

on-behalf-login error: Kerberos credentials not set but required by configuration. Aborting request

WR-SG-REJECT-801-01

System

Fatal error during backend request "..." for host "..." (...)

WR-SG-REJECT-802

Environment

Backend timeout occurred

WR-SG-REJECT-804

Environment

Back-end communication error: All Back-end Hosts ... failed

WR-SG-REJECT-301-02

Config

on-behalf-login error: Basic authentication failed. Server returned 401 (not authorized) error. Redirecting request

WR-SG-REJECT-302-02

Config

on-behalf-login error: NTLM authentication failed. Server returned 401 (not authorized) error. Redirecting request

WR-SG-REJECT-303-02

Config

on-behalf-login error: Kerberos authentication failed for SPN "...". Server returned 401 (not authorized) error. Redirecting request

WR-SG-REJECT-400

Config

Request handler mapping error: .........

WR-SG-REJECT-401

Config

Response handler mapping error: ...

WR-SG-REJECT-505

Environment

Cannot perform backend failover because the request body has been truncated

WR-SG-REJECT-520

System

Back-end state machine: Invalid signal "..." for state "..."

WR-SG-REJECT-180

System

Internal stream handler error in ...: ...

WR-SG-REJECT-181

System

Child process has been signaled to terminate.

WR-SG-REJECT-820-02

Environment

ICAP client: Idle request timeout (...s) on ICAP service "..." at ...:...

WR-SG-REJECT-820-03

Environment

ICAP client: Request buffer limit has been exceeded on ICAP service "...", failover not possible

WR-SG-REJECT-820-04

Config

ICAP client: Error initializing ... request, ...

WR-SG-REJECT-820-05

System

ICAP client: ...

WR-SG-REJECT-820-06

Environment

ICAP client: No more servers available for ICAP service "..."

WR-SG-REJECT-821-01

Environment

ICAP client: ICAP response parser failed: ... (invalid response from icap server)

WR-SG-REJECT-821-02

Environment

ICAP client: No encapsulation header present in ICAP response

WR-SG-REJECT-822-01

Environment

ICAP client: Error creating HTTP ...

WR-SG-REJECT-060

Environment

ICAP client: ICAP response contains HTTP request - This should not happen when ICAP request mode was not REQMOD

WR-SG-REJECT-061

Environment

ICAP client: ICAP response contains malformed ...

WR-SG-REJECT-171

Environment

ICAP service "..." at ...:... responded in ... with ICAP status code ...

WR-SG-REJECT-823-01

Config

ICAP client: Forbidden path change detected during ICAP REQMOD (Client View) from path:... to path:... that would change the mapping from mapping:... to mapping:... , service "..." at ...:...

WR-SG-REJECT-823-02

Config

ICAP client: Forbidden path change detected during ICAP REQMOD (Client View) from path:... to path:... (slash is missing) , ICAP service "..." at ...:...

WR-SG-REJECT-823-03

Config

ICAP client: Forbidden path change detected for an encrypted request during ICAP REQMOD (Client View) from path ... to path ... ICAP service "..." at ...:...

WR-SG-REJECT-823-04

Config

ICAP client: Forbidden query change detected for an encrypted request during ICAP REQMOD (Client View) from query ... to query ..., ICAP service "..." at ...:...

WR-SG-REJECT-805-01

System

Idle child timeout for child ... after ... seconds. Invoking child terminator.

WR-SG-REJECT-805-02

System

Hard child timeout for child ... after ... seconds. Invoking child terminator.

WR-SG-REJECT-150-01

System

Failed to create session. Rejecting request. Reason of failure: ...

WR-SG-REJECT-150-02

System

Failed to create session. Rejecting request. Reason of failure: ...

WR-SG-REJECT-151

System

Session tracking mode switch to ...:... failed. Rejecting request.

WR-SG-REJECT-152

System

Failed to assure session tracking mode. Rejecting request.

WR-SG-REJECT-560

System

Allowed number of concurrent authenticated sessions exceeded. Licensed are ..., grace margin is ... and currently used are .... Please contact product support or sales for a license upgrade.

WR-SG-REJECT-112

System

Not enough space in credentials store for credential "...". ... bytes used (limit ...) and ... credentials stored

WR-SG-REJECT-113

System

Too many entries in credentials store. Limit of ... entries reached. Rejected credential "..."

WR-SG-REJECT-155

Config

Request for SSL-tracked Airlock Gateway session uses wrong SSL session. Terminating session.

WR-SG-REJECT-901

limit

Virtual host: ...

WR-SG-REJECT-902

limit

Mapping: ...

WR-SG-REJECT-903

limit

Back-end group: ...

Back-end messages

Some events that occur during back-end requests will be reported with back messages. Depending on the severity of the event an according reject message may follow.

Every message will log the fields listed in the JSON fields. Some fields may be left out when no value is available, and others may write <n/a> instead.

List of log messages:

Message ID

Description

WR-SG-BACK-500

Timeout during back-end request "..."

WR-SG-BACK-502

Communication error (...; ...) (errno:...: ...) during backend request "..."

WR-SG-BACK-503

HTTP response indicates back-end failure "..." for request "..."

WR-SG-BACK-506

Resetting original request for back-end failover

WR-SG-BACK-510

Backend request handler: Internal error during back-end request: .... Errno:... ...

WR-SG-BACK-511

Backend request handler: Curl multi error during back-end request: CURLMcode:... .... Errno:... ...

Session start and end messages

There are two messages reporting the start and the end of a session and one message reporting the start of a new TLS session.

Every message will log the fields listed in the JSON fields. Some fields may be left out when no value is available, and others may write <n/a> instead.

Message ID

Description

WR-SG-SESS-004

Session created

WR-SG-SESS-005

Session finished: {}

WR-SG-TLS-SESS-START

TLS session started