Unable to view User-Agent details in Access Log
search cancel

Unable to view User-Agent details in Access Log

book

Article ID: 169066

calendar_today

Updated On:

Products

ProxySG Software - SGOS

Issue/Introduction

Unable to view User-Agent details in the access-log even though the access-log has the variable/field " http_user_agent" enabled for displaying the User-Agent details.

Fields: date time time-taken c-ip cs-username cs-auth-group x-exception-id sc-filter-result cs-categories cs(Referer) sc-status s-action cs-method rs(Content-Type) cs-uri-scheme cs-host cs-uri-port cs-uri-path cs-uri-query cs-uri-extension cs(User-Agent) s-ip sc-bytes cs-bytes x-virus-id x-bluecoat-application-name x-bluecoat-application-operation

Cause

 If you have the field enabled for User Agent and still do not have the details populated on access log then please verify if SSL interception is turned on if not Proxy won't be able to identify the User Agent details. Sample below.

Without SSL interception
2016-05-04 10:26:08 360 xx.xx.xx.x - - - PROXIED "none" 0 TUNNELED unknown - ssl www.example.com 443 - - xx.xx.xx.x 1509 1240 - none - - high www.example.com "none"

With SSL interception
2016-05-04 10:25:34 636 xx.xx.xx.x - - - PROXIED "none" 200 TCP_NC_MISS GET image/png https www.example.com 443 png "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)" xx.x.x.xx 94375 721 - none - - high www.example.com "none"

Resolution

Enable Protocol Detection and SSL interception.