cancel
Showing results for 
Search instead for 
Did you mean: 

Truncate "Request.Header.FirstLine" before first appearance of "?"

Jump to solution

Hello,

we currently write "Request.Header.FirstLine" to our access log.

This is becoming a problem, because the often very long session information consumes more (disk) space then the rest of the entry, and security department has concerns about leakage of sensitive data.

To address this, I would like to truncate the line before the beginning of the "query" part (i.e. first appearance of "?").

So far, this works with 

String.ReplaceIfEquals (String.ReplaceFirstMatch (Request.Header.FirstLine, regex(\?.*), "?TRUNCATED"), "", "-")

But then every single log entry has to be parsed with a Regular Expression (I tried wildcard "\?*", but that did not work), which I fear wil be resource intensive.

Is their a smarter way to achieve this?

Best Regards,

Holger

1 Solution

Accepted Solutions
McAfee Employee jscholte
McAfee Employee
Report Inappropriate Content
Message 2 of 5

Re: Truncate "Request.Header.FirstLine" before first appearance of "?"

Jump to solution

Hi Holger,

Apparently the Community doesnt like the text in my replies.... so here is an awesome screenshot of what I wrote..

Best Regards,

Jon

4 Replies
McAfee Employee jscholte
McAfee Employee
Report Inappropriate Content
Message 2 of 5

Re: Truncate "Request.Header.FirstLine" before first appearance of "?"

Jump to solution

Hi Holger,

Apparently the Community doesnt like the text in my replies.... so here is an awesome screenshot of what I wrote..

Best Regards,

Jon

Re: Truncate "Request.Header.FirstLine" before first appearance of "?"

Jump to solution

Hello Jon,

I realized that that URL.path sometimes includes newlines. I wonder how that is possible, as these are no valid URLs, at least not properly encoded.

Would "String.URLEncode" help in this case or do I have to use my RegEx solution after all?

Best Regards,

Holger

btlyric
Level 12
Report Inappropriate Content
Message 4 of 5

Re: Truncate "Request.Header.FirstLine" before first appearance of "?"

Jump to solution

Every URL that goes through our proxies gets run through at least one regex. It might not be as onerous on the system as you fear.

On the other hand, since we went to 7.5, I do see increased load on the systems that I haven't yet had the time to track down so your mileage may vary...

BTL

Re: Truncate "Request.Header.FirstLine" before first appearance of "?"

Jump to solution

Hello Jon,

great, thank you. Works fine and does not truncate the protocol version like my solution did 😞

Best Regards,

Holger

More McAfee Tools to Help You
  • Subscription Service Notification (SNS)
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • eSupport: Policy Orchestrator
  • Community Help Hub

      New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

    • Find Forum FAQs
    • Learn How to Earn Badges
    • Ask for Help
    Go to Community Help

    Join the Community

      Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

    • Get helpful solutions from McAfee experts.
    • Stay connected to product conversations that matter to you.
    • Participate in product groups led by McAfee employees.
    Join the Community
    Join the Community