Showing results for 
Search instead for 
Did you mean: 
Level 7

Webwasher 6.8 syslog message parameters


I am trying to send syslog from webwasher  by using custom actions. Bu I coudn't find the parameter list to use in messages. Can anyone point me a link or documentation? There is a built-in block action where it sends a syslog and uses %parameter.

Thanks in advance

0 Kudos
2 Replies
Level 7

Re: Webwasher 6.8 syslog message parameters

These are a few months old but should be accurate. See section 5 of the Reference Guide attached


var             auth_user = "%A";
var       auth_group_full = "%Ag"; //(full format)
var            auth_group = "%AG";
var            quota_user = "%a";
var           blocked_cat = "%B";
var             attribute = "%BA";
var             block_res = "%BR";
var            block_text = "%BT";
var            media_type = "%c";
var            categories = "%C";
var              cat_code = "%Cs";
var             file_name = "%f";
var             extension = "%fe";
var             base_name = "%ff";
var            parameters = "%fp";
var                policy = "%g";
var              own_name = "%h";
var                wwfile = "%#h";
var              hop_host = "%H";
var             hop_proxy = "%Hp";
var           server_name = "%Hs";
var             client_ip = "%i";
var             server_ip = "%I";
var           icap_client = "%ii";
var              icap_mod = "%IM";
var           client_name = "%J";
var             icap_host = "%Ji";
var                method = "%M";
var              own_fqdn = "%o";
var              hop_port = "%p";
var                scheme = "%P";
var                  port = "%ps";
var          quota_length = "%qf";
var         quota_session = "%qi";
var            quota_type = "%qt";
var            quota_name = "%Qt";
var    quota_time_day_max = "%qD";
var   quota_time_day_used = "%qd";
var  quota_time_month_max = "%qM";
var quota_time_month_used = "%qm";
var   quota_time_week_max = "%qW";
var  quota_time_week_used = "%qw";
var     quota_vol_day_max = "%QD";
var    quota_vol_day_used = "%Qd";
var   quota_vol_month_max = "%QM";
var  quota_vol_month_used = "%Qm";
var    quota_vol_week_max = "%QW";
var   quota_vol_week_used = "%Qw";
var               referer = "%r";
var              req_line = "%R";
var             rep_level = "%rl";
var             rep_score = "%rs";
var               version = "%s";
var          sfdb_version = "%S";
var              log_time = "%t";
var                   url = "%u";
var            user_agent = "%U";
var            virus_name = "%V";
var          virus_engine = "%VE";
var              gbf_rule = "%xGBFRule";
var           filter_name = "%xexFilter";
var          lockout_time = "%xpl";
var           ftp_command = "%xFC";
var             ftp_reply = "%xFR";
var             ftp_error = "%xFE";

0 Kudos
Level 7

Re: Webwasher 6.8 syslog message parameters

Thanks a lot! I looked the documentation inside the Virtual Appliance Operating system thinking that they are the most recent. I guess it will be useful to check the mcafee documentation site regardless of the docs provided within appliance.

Thanks again, saved me alot of time.

0 Kudos