Administrator's Guide - Kerio Software Archive

Logs
Note:
1. Only accesses to allowed pages are recorded in the HTTP log. Request that were blocked
by HTTP rules are logged to the Filter log (see chapter 22.9), if the Log option is enabled
in the particular rule (see section 13.2).
2. The Http log is intended to be processes by external analytical tools. The Web log (see
bellow) is better suited to be viewed by the Kerio Control administrator.
An example of an HTTP log record in the Apache format:
192.168.64.64 - jflyaway
[18/Apr/2008:15:07:17 +0200]
"GET http://www.kerio.com/ HTTP/1.1" 304 0 +4
• 192.168.64.64 — IP address of the client host
• rgabriel — name of the user authenticated through the firewall (a dash is
displayed if no user is authenticated through the client)
• [18/Apr/2008:15:07:17 +0200] — date and time of the HTTP request. The +0200
value represents time difference from the UTC standard (+2 hours are used in this
example — CET).
• GET — used HTTP method
• http://www.kerio.com — requested URL
• HTTP/1.1 — version of the HTTP protocol
• 304 — return code of the HTTP protocol
• 0 — size of the transferred object (file) in bytes
• +4 — count of HTTP requests transferred through the connection
300