Question:
Are the Transaction IDs in Secure Web Gateway (SWG) log records unique?
Answer:
SWG assigns a Transaction Identifier to each web log entry. No two distinct transactions will ever be identified with the same ID. However, a situation might arise where the same Transaction ID appears more than once in syslog entries and/or log archives within a fairly short period of time. Closer inspection will reveal that these are duplicate records for a single transaction.
Duplicates can occur when a logging service is restarted, as can happen during the application of configuration changes, system shutdown, or unscheduled outages. This happens because a transaction being written to the logs may be in a state where validating its success is impossible due to the shutting down of the service. SWG appliances include built-in precautions which write out the record again upon startup, thus ensuring that that it will not be lost. SWG was designed with the philosophy that it is preferable to create duplicate log messages for the same transaction rather than risk losing log data which could be useful for audits.
Vital Security Reporter appliances automatically factor out any such duplicate transaction records.
Software Versions:
All SWG versions