Sample Log File - Microsoft ISA Log File Format


This article applies to:

  • Firewall Suite 4.X

Question:

What is an example of a Log File in Microsoft ISA Log File Format?

Information:

Sample Log File Format (ISA Format):

10.0.0.2, anonymous, Mozilla/4.0 (compatible; MSIE 4.01; Windows NT), N, 5/22/2000, 11:03:48, w3proxy, SERVERNAME, -, www.gamespot.com, 206.132.131.50, 80, 250, 426, 293, http, TCP, GET, http://www.gamespot.com/, -, VFInet, 302, 1073741824, -, - <<>>
10.0.0.2, anonymous, Mozilla/4.0 (compatible; MSIE 4.01; Windows NT), N, 5/22/2000, 11:03:49, w3proxy, SERVERNAME, -, www.zdnet.com, 205.181.112.65, 80, 861, 7820, 369, http, TCP, GET, http://www.zdnet.com/gamespot/shared/styles/gs_basic.css, -, VFInet, 200, 8388608, -, -<<>>
10.0.0.2, anonymous, Mozilla/4.0 (compatible; MSIE 4.01; Windows NT), N, 5/22/2000, 11:03:50, w3proxy, SERVERNAME, -, www.zdnet.com, 205.181.112.65, 80, 901, 4233, 366, http, TCP, GET, http://www.zdnet.com/gamespot/shared/styles/gs_ns.css, -, VFInet, 200, 8388608, -, - <<>>
10.0.0.2, anonymous, Mozilla/4.0 (compatible; MSIE 4.01; Windows NT), N, 5/22/2000, 11:03:51, w3proxy, SERVERNAME, -, www.zdnet.com, 205.181.112.65, 80, 2283, 15629, 362, http, TCP, GET, http://www.zdnet.com/gamespot/shared/navbar_js.js, -, VFInet, 200, 8388608, -, - <<>>
10.0.0.2, anonymous, Mozilla/4.0 (compatible; MSIE 4.01; Windows NT), N, 5/22/2000, 11:03:52, w3proxy, SERVERNAME, -, www.zdnet.com, 205.181.112.65, 80, 1713, 680, 405, http, TCP, GET, http://www.zdnet.com/gamespot/shared/all_off.gif, -, VFInet, 200, 8388608, -, - <<>>




Note: Firewall Suite is not able to analyze the W3C format of Microsoft ISA log files. The server should be configured to log in the ISA format. The Firewall Configuration Guide provides further details about how to configure the server for ISA logging. You can obtain this Guide from the following page:

https://support.trustwave.com/Firewall-Suite/Documentation.asp



Sample Log File Format (W3C Format):

#Software: Microsoft(R) Internet Security and Acceleration Server 2000
#Version: 1.0
#Date: 2002-02-27 02:34:42
#Fields: date time source-ip destination-ip protocol param#1 param#2 tcp-flags filter-rule interface ip-header payload
2002-02-27 02:34:42 172.16.0.2 172.16.0.255 Udp 137 137 - BLOCKED 172.16.0.3 45 00 00 4e 1a 77 00 00 80 11 c7 06 ac 10 00 02 ac 10 00 ff 00 89 00 89 00 3a 37 13 d9 b2 01 10 00 01 00 00 00 00 00 00 20 45 47 45 4a 46 43 45 46 46 48 45 42 45 4d 45 4d 46 50 45 4d 45 42 45 43 43 41 43 41 43 41 42 4c 00 00 20 00 01
2002-02-27 02:34:42 172.16.0.2 172.16.0.255 Udp 137 137 - BLOCKED 172.16.0.3 45 00 00 4e 1b 77 00 00 80 11 c6 06 ac 10 00 02 ac 10 00 ff 00 89 00 89 00 3a 36 0f d9 b6 01 10 00 01 00 00 00 00 00 00 20 45 47 45 4a 46 43 45 46 46 48 45 42 45 4d 45 4d 46 50 45 4d 45 42 45 43 43 41 43 41 43 41 42 4d 00 00 20 00 01

This article was previously published as:
NETIQKB2417

Last Modified 4/12/2006.
https://support.trustwave.com/kb/KnowledgebaseArticle10711.aspx