cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Response.StatusCode originating from Server or Gateway?

Jump to solution

Hello Community,

in the logs, "Response.StatusCode" normally contains the HTTP status code that the MWG receives from the webserver.

But in some cases, e.g. authentication failure, it contains an HTTP status code that is returned by the web gateway itself.

How can I determine which origin returned the error code, if I only have the logs at hand (No troubleshooting in WebUI etc.)?

Thank you and best regards,

Holger

 

 

 

2 Solutions

Accepted Solutions
aloksard
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 2 of 4

.Re: Response.StatusCode originating from Server or Gateway?

Jump to solution

Hi Holger,

Hope you are doing well.

Say for any URL for which only request cycle was evaluated, say for a site which was blocked on MWG  or authentication request , in this case connection to destination server will not be their and MWG is the only one to set status code in logging

 

 In this case we have no response from the server, only the response that MWG generated

[07/Nov/2018:17:31:11 +0000] "" 172.19.212.56 403 "GET https://www.youtube.com/watch?v=p6Z1pHKJofQ&pbj=1 HTTP/2.0" "" "-" "" 3684 175 "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36" "" "0" ""

 

403 response code means request is  blocked by MWG.  

 

[18/Apr/2012:12:00:42+0000] "" *.*.*.* 407 "CONNECT https://licensing.services.sage.comHTTP/1.1" "" "-" "" 2812 """" "0"

407 means that MWG wants this request authenticated

 

Logging is a dedicated cycle, it always comes last.  

So basically response.code  can be either generated by MWG or actual destination server when you execute it in the logging cycle.

You can easily see it if you have a virus file. Response code will be 403, while the server would have send 200.

 

Say for example when a user requested for URL www.google.com, the request cme on MWG , it went through all rules  and is allowed, so in this case a connection will be made form MWG to destination server and a response cycle will be triggered wherein you will see 200 response code from server to MWG if everything was fine at server end.

 

The Logging Cycle kicks off after the Request, Response and all Embedded cycles have completed -- allowing you to write to log files.

 

https://community.mcafee.com/t5/Documents/Web-Gateway-Understanding-the-Rule-Engine-and-Optimizing-y...

 

Regards

Alok Sarda

 

 

 

 

View solution in original post

aloksard
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 4 of 4

Re: .Re: Response.StatusCode originating from Server or Gateway?

Jump to solution

Hi Holgar,

Hope you are doing well.

If you want to make sure to get the status code from the server, then you can try creating  a rule for the same and store it in a user defined property  and check.

 

Regards

Alok Sarda

 

View solution in original post

3 Replies
aloksard
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 2 of 4

.Re: Response.StatusCode originating from Server or Gateway?

Jump to solution

Hi Holger,

Hope you are doing well.

Say for any URL for which only request cycle was evaluated, say for a site which was blocked on MWG  or authentication request , in this case connection to destination server will not be their and MWG is the only one to set status code in logging

 

 In this case we have no response from the server, only the response that MWG generated

[07/Nov/2018:17:31:11 +0000] "" 172.19.212.56 403 "GET https://www.youtube.com/watch?v=p6Z1pHKJofQ&pbj=1 HTTP/2.0" "" "-" "" 3684 175 "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36" "" "0" ""

 

403 response code means request is  blocked by MWG.  

 

[18/Apr/2012:12:00:42+0000] "" *.*.*.* 407 "CONNECT https://licensing.services.sage.comHTTP/1.1" "" "-" "" 2812 """" "0"

407 means that MWG wants this request authenticated

 

Logging is a dedicated cycle, it always comes last.  

So basically response.code  can be either generated by MWG or actual destination server when you execute it in the logging cycle.

You can easily see it if you have a virus file. Response code will be 403, while the server would have send 200.

 

Say for example when a user requested for URL www.google.com, the request cme on MWG , it went through all rules  and is allowed, so in this case a connection will be made form MWG to destination server and a response cycle will be triggered wherein you will see 200 response code from server to MWG if everything was fine at server end.

 

The Logging Cycle kicks off after the Request, Response and all Embedded cycles have completed -- allowing you to write to log files.

 

https://community.mcafee.com/t5/Documents/Web-Gateway-Understanding-the-Rule-Engine-and-Optimizing-y...

 

Regards

Alok Sarda

 

 

 

 

View solution in original post

Re: .Re: Response.StatusCode originating from Server or Gateway?

Jump to solution

Hello Alok,

thank you for your comprehensive answer. I understand it to mean that there is no way to get the orginial server response code into the logs, because Response.StatusCode contains the "last" value after all cycles (Request, Response, Embedded).

Or is there a way to "cache" the server response code in a user-defined variable and write it additionally to the logs?

Best Regards,

Holger

aloksard
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 4 of 4

Re: .Re: Response.StatusCode originating from Server or Gateway?

Jump to solution

Hi Holgar,

Hope you are doing well.

If you want to make sure to get the status code from the server, then you can try creating  a rule for the same and store it in a user defined property  and check.

 

Regards

Alok Sarda

 

View solution in original post

You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community