cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Highlighted

Truncate "Request.Header.FirstLine" before first appearance of "?"

Jump to solution

Hello,

we currently write "Request.Header.FirstLine" to our access log.

This is becoming a problem, because the often very long session information consumes more (disk) space then the rest of the entry, and security department has concerns about leakage of sensitive data.

To address this, I would like to truncate the line before the beginning of the "query" part (i.e. first appearance of "?").

So far, this works with 

String.ReplaceIfEquals (String.ReplaceFirstMatch (Request.Header.FirstLine, regex(\?.*), "?TRUNCATED"), "", "-")

But then every single log entry has to be parsed with a Regular Expression (I tried wildcard "\?*", but that did not work), which I fear wil be resource intensive.

Is their a smarter way to achieve this?

Best Regards,

Holger

1 Solution

Accepted Solutions
Highlighted
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 2 of 5

Re: Truncate "Request.Header.FirstLine" before first appearance of "?"

Jump to solution

Hi Holger,

Apparently the Community doesnt like the text in my replies.... so here is an awesome screenshot of what I wrote..

Best Regards,

Jon

View solution in original post

4 Replies
Highlighted
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 2 of 5

Re: Truncate "Request.Header.FirstLine" before first appearance of "?"

Jump to solution

Hi Holger,

Apparently the Community doesnt like the text in my replies.... so here is an awesome screenshot of what I wrote..

Best Regards,

Jon

View solution in original post

Highlighted

Re: Truncate "Request.Header.FirstLine" before first appearance of "?"

Jump to solution

Hello Jon,

I realized that that URL.path sometimes includes newlines. I wonder how that is possible, as these are no valid URLs, at least not properly encoded.

Would "String.URLEncode" help in this case or do I have to use my RegEx solution after all?

Best Regards,

Holger

Highlighted
Level 12
Report Inappropriate Content
Message 4 of 5

Re: Truncate "Request.Header.FirstLine" before first appearance of "?"

Jump to solution

Every URL that goes through our proxies gets run through at least one regex. It might not be as onerous on the system as you fear.

On the other hand, since we went to 7.5, I do see increased load on the systems that I haven't yet had the time to track down so your mileage may vary...

BTL

Highlighted

Re: Truncate "Request.Header.FirstLine" before first appearance of "?"

Jump to solution

Hello Jon,

great, thank you. Works fine and does not truncate the protocol version like my solution did 😞

Best Regards,

Holger

You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community