This article applies to:
Question:
What does "DEFAULT" mean in the traffic logs?
Reply
What does "DEFAULT" mean in the traffic logs?
The username field of the Realtime Traffic Log (shadow.log) gives you an indication whether the user was being filtered by the (1) Global Group Profile, (2) IP Group Profile, (3) NT/LDAP Group Profile.
1. If the word "DEFAULT" appears by itself in the username field, this indicates that the user was being filtered by the Global Group Profile.
e.g.
10.45.90.14,DEFAULT,2008/08/31,12:05:36,REFERE,0,3,,http://WWW.DICTIONARY.COM...
2. If the word "IPGROUP" appears by itself in the username field, this indicates that the user was being filtered by an IP Group Profile.
e.g.
10.45.90.14,IPGROUP,2008/08/31,12:05:36,REFERE,0,3,,http://WWW.DICTIONARY.COM...
3a. If the word "DEFAULT" appears in the username field, in-between the name of your NT/LDAP domain, and the username, this indicates that the user was authenticated, and was being filtered by the default Rule assigned to the domain.
e.g.
10.45.90.14 ,8e6domain\DEFAULT\jsmith,2008/08/31...
3b. If you've created sub-groups under your domain on the R3000 (this is usually done to assign different profiles for different groups of users), the word "DEFAULT" will be replaced by the name of the sub-group.
e.g.
10.45.90.14 ,8e6domain\Tech Support\jsmith,2008/08/31...
3c. If you've created an "Individual" profile for a specific user under your NT/LDAP domain on the R3000, this is reflected by the word "INDIVIDUAL" in the username field.
e.g.
10.45.90.14 ,8e6domain\INDIVIDUAL\jsmith,2008/08/31...
- This article was previously published as:
- 8e6 KB 294819