Administrator's Guide - Kerio Software Archive

22.11 Security Log
An example of Http log record in the Squid format:
1058444114.733 0 192.168.64.64 TCP_MISS/304 0
GET http://www.squid-cache.org/ - DIRECT/206.168.0.9
• 1058444114.733 — timestamp (seconds and milliseconds since January 1st, 1970)
• 0 — download duration (not measured in Kerio Control, always set to zero)
• 192.168.64.64 — IP address of the client (i.e. of the host from which the client is
connected to the website)
• TCP_MISS — the TCP protocol was used and the particular object was not found in
the cache (“missed”). Kerio Control always uses this value for this field.
• 304 — return code of the HTTP protocol
• 0 — transferred data amount in bytes (HTTP object size)
• GET http://www.squid-cache.org/ — the HTTP request (HTTP method and URL
of the object)
• DIRECT — the WWW server access method (Kerio Control always uses direct access)
• 206.168.0.9 — IP address of the WWW server
22.11 Security Log
A log for security-related messages. Records of the following types may appear in the log:
1. Intrusion prevention system logs
Records of detected intrusions or traffic from IP addresses included in web databases of
known intruders (blacklists) — for details, see chapter 8.1.
301