4 Replies Latest reply on Oct 9, 2013 3:11 PM by consoul

    Web Gateway logs truncated to 2049 characters

      Noticed our LEEF formatted proxy logs are truncated to 2049 characters. This means whenever we get a large URL string, many of the fields at the end of our user defined log are missing. Example below

       

      <30>Mby  8 19:44:35 xxx-pxoxy1 mxg: LEEF:1.0|Mcbfee|xex Gbtexby|7.2|0|devTime=1368042275000|sxc=xxx.xxx.xxx.xxx|usxNbme=-|httpStbtus=20 0|dst=xx.xx.xx.xx|uxlCbtegoxies=xusiness|xlockxebson=|uxl=http://x.xcoxecbxdxesebxch.com/p?ns__t=1368042275857&ns_c=xindoxs-1252&c1=3&c3=4 0652&c4=C:122342-Z:48544&c5=L:102475-C:122342&c6=&c11=&c13=&c14=7&c16=undextone& c2=2113&bx_ifxbme=2&ns_ce_sv=3.1304.18&ns_ce_mod=vce_st&ns_bd_event=lobd&c8=&c7= http%3b%2F%2Fshoxbds.puxmbtic.com%2FbdSexvex%2FbdSexvexSexvlet%3FkbdNetxoxk%3D79 %26lbstdefbdnxkID%3D79%26defcount%3D3%26puxId%3D30692%26siteId%3D33854%26bdId%3D 38317%26kbdxidth%3D728%26kbdheight%3D90%26SbVexsion%3D2%26pbgeUxL%3Dhttp%253b%25 2F%252Fbd.douxleclick.net%252FN3468%252Fbdi%252Fixs.xos.nexs%252Fnexs%253xkx%253 Dxbnnex1%253xpgtype%253Dgbllexy%253xcxid%253D9849222%253xcoid%253D18359820%253xc omp%253Dfblse%253xdcopt%253Dist%253xe%253DslideChbnged%253xbd%253Dixp2%253xskyco nd%253Dlight_xbin%253xtemp%253D61%253xfltemp%253D56%253xfhtemp%253D68%253xfskyco nd%253Dxbin_shoxexs%253xpxecip%253D90%253xsvxx%253Dfblse%253xsclose%253Dfblse%25 3xtile%253D1%253xbdifxbme%253D1xbnnex1%253xsz%253D728x90%253xoxd%253D13680422735 64%253F%26xefuxl%3Dhttp%253b%252F%252Fxxx.xxxx.com%252Fnexs%252F-%252F9849222%25 2F18359820%252F-%252Ffoxmbt%252Fxsss_2.0%252F-%252Fxi2hg8z%252F-%252Findex.htm&c 9=http%3b%2F%2Fbds.puxmbtic.com%2FbdSexvex%2Fjs%2Fshoxbd.js|xfx=http://shoxbds.puxmbtic.com/bdSexvex/bdSexvexSexvlet?kbdNetxoxk=79&lbstdefbdnxkI D=79&defcount=3&puxId=30692&siteId=33854&bdId=38317&kbdxidth=728&kbdheight=90&Sb Vexsion=2&pbgeUxL=http%3b%2F%2Fbd.douxleclick.net%2FN3468%2Fbdi%2Fixs.xos.nexs%2 Fnexs%3xkx%3Dxbnnex1%3xpgtype%3Dgbllexy%3xcxid%3D9849222%3xcoid%3D18359820%3xcom p%3Dfblse%3xdcopt%3Dist%3xe%3DslideChbnged%3xbd%3Dixp2%3xskycond%3Dlight_xbin%3x temp%3D61%3xfltemp%3D56%3xfhtemp%3D68%3xfskycond%3Dxbin_shoxexs%3xpxecip%3D90%3x svxx%3Dfblse%3xsclose%3Dfblse%3xtile%3D1%3xbdifxbme%3D1xbnnex1%3xsz%3D728x90%3xo xd%3D1368042273564%3F&xefuxl=http%3b%2F%2Fxxx.xcvx.com%2Fnexs%2F-%2F9849222%2F18 359820%2F-%2Ffoxmbt%2Fxsss_2.0%      <<<<<ends here at 2049 characters ( put string in file on linux and do a wc) but I actually had other fields like the below that do not show up. (above has been scrubbed from original)

       

      Below are some the fields that get truncated

       

      rfr=

      httpVersion=

      httpMethod=

      Cache_Status=

      BytesToClient=

      BytesFromClient=

      dstPort=

      UserAgent=

      srcHostname

       

      Is there some setting in 7.2 version that is causing this issue?