Meaning for access log

I have retrieved some access log for the user ID, COuld you explain about the conn,op,msgID and method.What it defines ?

Hi,
here you'll find the official product page that explains how the access/error logs are structured:
http://download.oracle.com/docs/cd/E19656-01/821-1507/fnyss/index.html
When an LDAP-client application binds to the Directory Server, then it creates a 'connection' object that will handle all the data flow from that specific client, so that if you do:
# grep <CONNECTION> access
you'll have the history of all operations performed: the IP address from which the connection was initiated, the bind identity, the type of LDAP commands used (SRCH/ADD/DEL/MOD/MODRDN) and the result of each command
The operation is a counter to uniquely identify the sequence of operations of a given connection
The message id identifies the LDAP operation within the connection, but from client side (and of course can be different from the operation number)
HTH,
marco

Similar Messages

  • Change directory for access.log

    I would like to know if it's possible to change the path of the accesslog.
    The work directory of weblogic server is D:\weblogic\myserver and the path
    of access.log is automatically in this directory.
    I want to put the access.log file in the directory : D:\log_serveur.
    I know it's possible for the weblogic.log
    adding -Dweblogic.system.logFile=D:\Log_serveur\weblogiclog\weblogic.log
    parameter in the startweblogic.bat file.
    Do -Dweblogic.httpd.logFile parameter exist and can I add it in
    startweblogic or in weblogic.properties??
    Thanks.
    Bruno LACHOT
    ST-INGENIERIE
    [email protected]

    It's not possible to change the location of this log file. It is safe to ignore it, however.
    Regards,
    Danny

  • Reporting tool for access.log and other files

    Any know of a good reporting tool to make useful reports out of the log files in
    Weblogic?

    I think you should verify this with Oracle Support.
    This is the perfect measure to have them drop the phone on you.
    Sybrand Bakker
    Senior Oracle DBA

  • Rotation of access logs unsuccessful !!

    Hi everybody,
    I tried setting up the rotation for access log (WLS 6.0), as per the user documentation.This
    doesn't seem to work, neither "by Size" nor "by Date". My config.xml does show
    proper tags for logging.
    <WebServer DefaultWebApp="DefaultWebApp_myserver" LogFileBufferKBytes="15" LogFileName="./config/mydomain/logs/sushil.log"
    LogRotationPeriodMins="1" LogRotationTimeBegin="06-07-2001-14:19:30" LogRotationType="size"
    LoggingEnabled="true" Name="myserver" />
    Am I missing something here. I was wondering if someone could give me an insight
    on this.
    Thanks in advance,
    Sushil

    I see there is no space between 1000" and max.
    <access-log path="../log/http-web-access.log" max-file-size="1000"max-directory-size="10000"/>
    However, you need to use the ODL logging line in config
         <odl-access-log path="../log/http-web-access" max-file-size="1000" max-directory-size="10000"/>

  • Username not showing up in access log for authenticated users

    I'm using form-based authentication in a Java web application on Sun One Web Server v6.1 to restrict access to authenticated users. However, even after the users authenticate and access the application, the username field in the access log is showing them as anonymous.
    request.getRemoteUser() is reporting the correct username, so it just seems to be the access log that is in error. Right now it is set to the default but changing formats to custom doesn't seem to help in displaying the username.
    Here's an excerpt from the access log:
    // anonymous access attempt, redirects to login page...
    10.100.168.110 - - [01/May/2006:14:34:42 -0400] "GET /profile/index.jsp HTTP/1.1" 302 0
    10.100.168.110 - - [01/May/2006:14:34:42 -0400] "GET /profile/login.jsp HTTP/1.1" 200 3355
    10.100.168.110 - - [01/May/2006:14:34:47 -0400] "POST /profile/j_security_check HTTP/1.1" 302 0
    // at this point they are logged in and their username should be reflected in the access log, but is not:
    10.100.168.110 - - [01/May/2006:14:34:47 -0400] "GET /profile/index.jsp HTTP/1.1" 200 3532 And the relevant code from the web application's web.xml:
    <security-constraint>
        <web-resource-collection>
          <web-resource-name>AllFiles</web-resource-name>
          <description>
                     Restricts anonymous access.
                  </description>
          <url-pattern>/*</url-pattern>
          <http-method>POST</http-method>
          <http-method>GET</http-method>
        </web-resource-collection>
        <auth-constraint>
          <description>
                   Authenticated Users
                  </description>
          <role-name>user</role-name>
        </auth-constraint>
      </security-constraint>I've searched the forums and the manuals but can't see anything showing that the access log's username field doesn't work with form-based authentication. Can anyone shed some light on this?

    Some background:
    The Java Servlet container has its own authentication infrastructure (which is what you configure in web.xml) which is separate from the non-Java authentication infrastructure (ACLs, etc.). If you set up authentication via ACLs the resulting user identity can (though you may configure it not to) propagate to the Java Servlet container such that request.getRemoteUser() will return it, even though no web.xml-driven authentication occurred. The coverse is not true, however: if you authenticate via a Java Realm, based on web.xml configuration, that user identity is not available to non-Java code.
    (Your web.xml snippet doesn't show you using FORM auth - but it doesn't matter, the explanation above applies in any case.)
    That is why the log file (generated from non-Java code) doesn't have access to that user. It probably should, but there's no config option today for you to make that happen.
    If you're using BASIC auth you may consider moving the authentication configuration from web.xml to ACLs as a possible workaround. It will then show up in the access logs.
    If you prefer web.xml-based authentication, consider the <SECURITY audit="true"> option in server.xml. It won't be in the access log but you'll have an audit trail of authentications, which may help.

  • Access Log format for Sun One Web Server 6.0 SP6

    Is it possible to add the Process Id to the access log? If so, what is the proper format for the access log entry in magnus.conf. We would like to be able to see which process each request used, just like in the error log.
    Thanks

    User agent and referer information can be logged. Refer to following docs(see under Table 7-1):
    http://docs.sun.com/source/816-5686-10/07_magnu.htm#33046
    Thanks,
    Manish

  • Query apache access logs for Vists, Visit duration

    I need help in querying for Vists, Visit duration in mins ..etc from apache access logs. A Visit is considered new if time difference between requests is greater than 60 mins.
    ID VISITS VISIT-DURATION-MINS
    'Usr-A' 3          112
    'Usr-B' 2          34
    My data is as below:
    ID,TIME-HR-MIN
    'Usr-A','01/01/2012 00:45'
    'Usr-A','01/01/2012 00:49'
    'Usr-A','01/01/2012 00:53'
    'Usr-A','01/01/2012 01:04'
    'Usr-A','01/01/2012 01:05'
    'Usr-A','01/01/2012 01:09'
    'Usr-A','01/01/2012 01:10'
    'Usr-A','01/01/2012 01:11'
    'Usr-A','01/01/2012 01:13'
    'Usr-A','01/01/2012 01:14'
    'Usr-A','01/01/2012 01:15'
    'Usr-A','01/01/2012 02:00'
    'Usr-A','01/01/2012 02:01'
    'Usr-A','01/01/2012 02:19'
    'Usr-A','01/01/2012 03:53'
    'Usr-A','01/01/2012 03:59'
    'Usr-A','01/01/2012 04:07'
    'Usr-A','01/01/2012 04:11'
    'Usr-A','01/01/2012 16:30'
    'Usr-A','01/01/2012 16:37'
    'Usr-A','01/01/2012 16:38'
    'Usr-A','01/01/2012 16:39'
    'Usr-B','01/01/2012 01:45'
    'Usr-B','01/01/2012 01:46'
    'Usr-B','01/01/2012 01:48'
    'Usr-B','01/01/2012 01:49'
    'Usr-B','01/01/2012 01:50'
    'Usr-B','01/01/2012 02:07'
    'Usr-B','01/01/2012 02:08'
    'Usr-B','01/01/2012 02:09'
    'Usr-B','01/01/2012 02:10'
    'Usr-B','01/01/2012 05:21'
    'Usr-B','01/01/2012 05:23'
    'Usr-B','01/01/2012 05:30'

    Hello
    I think this gives you what you need, although I think Usr-A has a total of 121 minutes not 112...
    with visit as
    (   select 'Usr-A' id,TO_DATE('01/01/2012 00:45','dd/mm/yyyy hh24:mi') time_hr_min from dual union all
        select 'Usr-A' id,TO_DATE('01/01/2012 00:49','dd/mm/yyyy hh24:mi') time_hr_min from dual union all
        select 'Usr-A' id,TO_DATE('01/01/2012 00:53','dd/mm/yyyy hh24:mi') time_hr_min from dual union all
        select 'Usr-A' id,TO_DATE('01/01/2012 01:04','dd/mm/yyyy hh24:mi') time_hr_min from dual union all
        select 'Usr-A' id,TO_DATE('01/01/2012 01:05','dd/mm/yyyy hh24:mi') time_hr_min from dual union all
        select 'Usr-A' id,TO_DATE('01/01/2012 01:09','dd/mm/yyyy hh24:mi') time_hr_min from dual union all
        select 'Usr-A' id,TO_DATE('01/01/2012 01:10','dd/mm/yyyy hh24:mi') time_hr_min from dual union all
        select 'Usr-A' id,TO_DATE('01/01/2012 01:11','dd/mm/yyyy hh24:mi') time_hr_min from dual union all
        select 'Usr-A' id,TO_DATE('01/01/2012 01:13','dd/mm/yyyy hh24:mi') time_hr_min from dual union all
        select 'Usr-A' id,TO_DATE('01/01/2012 01:14','dd/mm/yyyy hh24:mi') time_hr_min from dual union all
        select 'Usr-A' id,TO_DATE('01/01/2012 01:15','dd/mm/yyyy hh24:mi') time_hr_min from dual union all
        select 'Usr-A' id,TO_DATE('01/01/2012 02:00','dd/mm/yyyy hh24:mi') time_hr_min from dual union all
        select 'Usr-A' id,TO_DATE('01/01/2012 02:01','dd/mm/yyyy hh24:mi') time_hr_min from dual union all
        select 'Usr-A' id,TO_DATE('01/01/2012 02:19','dd/mm/yyyy hh24:mi') time_hr_min from dual union all
        select 'Usr-A' id,TO_DATE('01/01/2012 03:53','dd/mm/yyyy hh24:mi') time_hr_min from dual union all
        select 'Usr-A' id,TO_DATE('01/01/2012 03:59','dd/mm/yyyy hh24:mi') time_hr_min from dual union all
        select 'Usr-A' id,TO_DATE('01/01/2012 04:07','dd/mm/yyyy hh24:mi') time_hr_min from dual union all
        select 'Usr-A' id,TO_DATE('01/01/2012 04:11','dd/mm/yyyy hh24:mi') time_hr_min from dual union all
        select 'Usr-A' id,TO_DATE('01/01/2012 16:30','dd/mm/yyyy hh24:mi') time_hr_min from dual union all
        select 'Usr-A' id,TO_DATE('01/01/2012 16:37','dd/mm/yyyy hh24:mi') time_hr_min from dual union all
        select 'Usr-A' id,TO_DATE('01/01/2012 16:38','dd/mm/yyyy hh24:mi') time_hr_min from dual union all
        select 'Usr-A' id,TO_DATE('01/01/2012 16:39','dd/mm/yyyy hh24:mi') time_hr_min from dual union all
        select 'Usr-B' id,TO_DATE('01/01/2012 01:45','dd/mm/yyyy hh24:mi') time_hr_min from dual union all
        select 'Usr-B' id,TO_DATE('01/01/2012 01:46','dd/mm/yyyy hh24:mi') time_hr_min from dual union all
        select 'Usr-B' id,TO_DATE('01/01/2012 01:48','dd/mm/yyyy hh24:mi') time_hr_min from dual union all
        select 'Usr-B' id,TO_DATE('01/01/2012 01:49','dd/mm/yyyy hh24:mi') time_hr_min from dual union all
        select 'Usr-B' id,TO_DATE('01/01/2012 01:50','dd/mm/yyyy hh24:mi') time_hr_min from dual union all
        select 'Usr-B' id,TO_DATE('01/01/2012 02:07','dd/mm/yyyy hh24:mi') time_hr_min from dual union all
        select 'Usr-B' id,TO_DATE('01/01/2012 02:08','dd/mm/yyyy hh24:mi') time_hr_min from dual union all
        select 'Usr-B' id,TO_DATE('01/01/2012 02:09','dd/mm/yyyy hh24:mi') time_hr_min from dual union all
        select 'Usr-B' id,TO_DATE('01/01/2012 02:10','dd/mm/yyyy hh24:mi') time_hr_min from dual union all
        select 'Usr-B' id,TO_DATE('01/01/2012 05:21','dd/mm/yyyy hh24:mi') time_hr_min from dual union all
        select 'Usr-B' id,TO_DATE('01/01/2012 05:23','dd/mm/yyyy hh24:mi') time_hr_min from dual union all
        select 'Usr-B' id,TO_DATE('01/01/2012 05:30','dd/mm/yyyy hh24:mi') time_hr_min from dual
    SELECT
        id,
        COUNT(*) num_visits,
        SUM(visit_time) total_visit_time
    FROM
            SELECT
                id,
                SUM(visit_time) * 60 visit_time
            FROM
                    SELECT
                        id,
                        time_hr_min,
                        visit_time,
                        MAX(marker)OVER(PARTITION BY id ORDER BY time_hr_min) marker
                    FROM
                        (   SELECT
                                id,
                                time_hr_min,
                                CASE
                                    WHEN visit_dur > 1
                                    THEN
                                        0
                                    ELSE
                                        visit_dur
                                END visit_time,
                                CASE
                                    WHEN rn = 1
                                    THEN
                                        1
                                    WHEN visit_dur > 1
                                    THEN
                                        rn
                                END marker
                            FROM
                                (   SELECT
                                        id,
                                        time_hr_min,
                                        ROW_NUMBER() OVER(PARTITION BY id ORDER BY time_hr_min) rn,
                                        (time_hr_min - LAG(time_hr_min) OVER(   PARTITION BY
                                                                                    id
                                                                                ORDER BY
                                                                                    time_hr_min)
                                         ) * 24 visit_dur
                                    FROM
                                        visit
            GROUP BY
                id,
                marker
    GROUP BY
        id
    ORDER BY
        id
    ID    NUM_VISITS TOTAL_VISIT_TIME
    Usr-A          3              121
    Usr-B          2               34
    2 rows selected. HTH
    David

  • Weblogic Access Logs not getting generated / updated only for Admin server

    Hi All,
    I have a query ,
    We recently noticed that the weblogic access logs for our admin server are not getting generated.
    However we checked that the access logs are getting generated for the managed servers that we have.
    There is not much difference between the logging settings between the admin and the managed servers.
    We thought that there might be some problem with the buffering and that the data might not be written to the files immediately.
    So after researching we found the parameter "-Dweblogic.logging.bufferSizeKB=0" and added that to the java options however it did not make any difference.
    Also we tried modifying the config script as ,
    <server>
    <web-server>
    <web-server-log>
    <buffer-size-kb>0</buffer-size-kb>
    </web-server-log>
    </web-server>
    </server>
    However no luck .....
    We are using weblogic 9.2 MP3 and think there might be some bug with this version , however its hard to believe that the logs are generated and updated for managed servers and not for the admin servers.
    The only thing we notice in the access logs of the admin server is 404 errors.
    Any suggestions ?
    Regards,
    Stacey.

    This has come up recently here:
    access log not writing to disk in a timely fashion
    I didn't find that buffer-size-kb capability in the docs in 9.2. I recommend checking with support.

  • WSA access logging for HTTPS traffic

    Hi,
    We have a WSA s370 with AsyncOS  version 7.5.1-079 and it is configured as a transparent proxy.
    HTTPS proxy is enabled and all the URL categories set to pass through ( no decrytpting or monitoring ).
    Seems like the WSA does not generate logs for HTTPS transactions.
    I would like to know whether this is the expected behaviour.
    Is there any way that I can monitor HTTPS transactions without decrypting ?
    Thanks,
    Wipula.

    In addition to what Ken mentioned, the only way you can monitor HTTPS traffic without decrypting it will be done so using the IP address.
    In the access logs, you will see the following transaction when accessing an HTTPS site (google for example):
    TCP_CONNECT 74.125.101.50
    It will only report URLs once decrypted.  At that point, it is just HTTP.
    -Vance

  • How to turn off  "DEBUG SOURCE=cs Setting status to 304 for file="  in access.log

    I see this entry in the log file every few seconds. How can I turn this OFF? I
    can set the EnableLogfile to false but then I don't get any logs. We are running
    WLS 5.1.
    Regards,
    Pat.

    Pat:
    I dont see this string appearing anywhere in the src in any version of th
    510 line (all Sp's included).
    What version of 5.1? i.e. what SP?
    Are you using extended log format? Did a developer write a custom elf logger
    package?
    What are the ELF headers at the top of the access.log?
    Cheers
    mbg
    "Pat" <[email protected]> wrote in message
    news:[email protected]..
    >
    I see this entry in the log file every few seconds. How can I turn thisOFF? I
    can set the EnableLogfile to false but then I don't get any logs. We arerunning
    WLS 5.1.
    Regards,
    Pat.

  • Thousands of entries in Apache access logs for a single IP

    We are seeing thousands of connections in our Apache access logs coming from the same IP address connecting to the
    same pages with in a short period of time (~5-20 minutes). We see this in Firefox 27, 28, 29, and 30. Below is an example of the entries, and how they loop continuously. I have not been able to reproduce the problem manually, but this happens several times a week, and I see evidence in our logs, and by monitoring the session count in our database, which increase when this happens.
    Why is this happening? Is this a bug? I see a bug report filed at https://bugzilla.mozilla.org/show_bug.cgi?id=976878, but I do not see any replies.
    xxx.xxx.xxx.xxx - - [18/Jun/2014:16:03:50 -0400] "GET /webapps/login?new_loc=%2Fwebapps%2Fportal%2Fframeset.jsp HTTP/1.1" 302 - "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:30.0) Gecko/20100101 Firefox/30.0" "-"
    xxx.xxx.xxx.xxx - - [18/Jun/2014:16:03:50 -0400] "GET /webapps/login/?new_loc=%2Fwebapps%2Fportal%2Fframeset.jsp HTTP/1.1" 200 1000 "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:30.0) Gecko/20100101 Firefox/30.0" "-"
    xxx.xxx.xxx.xxx - - [18/Jun/2014:16:03:50 -0400] "GET /webapps/portal/frameset.jsp HTTP/1.1" 200 1160 "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:30.0) Gecko/20100101 Firefox/30.0" "-"
    xxx.xxx.xxx.xxx - - [18/Jun/2014:16:03:50 -0400] "GET /webapps/login?new_loc=%2Fwebapps%2Fportal%2Fframeset.jsp HTTP/1.1" 302 - "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:30.0) Gecko/20100101 Firefox/30.0" "-"
    xxx.xxx.xxx.xxx - - [18/Jun/2014:16:03:50 -0400] "GET /webapps/login/?new_loc=%2Fwebapps%2Fportal%2Fframeset.jsp HTTP/1.1" 200 1000 "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:30.0) Gecko/20100101 Firefox/30.0" "-"
    xxx.xxx.xxx.xxx - - [18/Jun/2014:16:03:50 -0400] "GET /webapps/portal/frameset.jsp HTTP/1.1" 200 1160 "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:30.0) Gecko/20100101 Firefox/30.0" "-"

    Sorry, beyond the scope of this Firefox user support forum.
    You could try posting to the Web Development / Standards Evangelism forum at MozillaZine. The helpers over there are more knowledgeable about web site issues with Firefox.
    http://forums.mozillazine.org/viewforum.php?f=25
    You'll need to register and login to be able to post in that forum.
    Or you could add information to that Bug report or create a new Bug report.
    Or the appropriate Google Group, linked in the right column of this page after you scroll-down a bit - http://www.mozilla.org/about/forums/

  • What is the meaning of stream capture waiting for archive log ?

    today I fing the oracle alert that stream capture waiting for archive log in other class,and use a lot of database time.
    What is it? And Can I prevent it happening ?

    today I fing the oracle alert that stream capture waiting for archive log in other class,and use a lot of database time.
    What is it? And Can I prevent it happening ?

  • DPS 6.3.1 access log info message for ssl incorrect

    In dps "data sources" I have all my connections to backend servers over 389 and their config says "never use ssl". Why do I get this error in the access log? I know its just info and not bad but its reporting something it shouldn't.
    [04/May/2009:14:57:16 -0700] - CONNECT - INFO - conn=14982 client=x.x.x.x:2882 server=sales.company.com:636 protocol=LDAPS
    [04/May/2009:14:57:16 -0700] - DISCONNECT - INFO - conn=14982 reason="other" msg="Exception caught while polling client connection LDAPS.x.x.x.x.2882 -- java.io.IOException: Received CLOSED during initial handshaking"
    Moreover my backend ldap servers dont use the standard ports like 636.

    Thanks. Issue resolved. The error went away. I was in early testing and the set up may have been inaccurate.

  • How to track browser type in the access log

    I have looked through the documentation on logging features on how to log the browser
    type for visitors. Is there a straightforward way to do add this information
    to the access.log?
    We are using Weblogic Portal 7.0 sp4
    Thank you.

    Hi,
    What do you mean by current and old version? Any changes in history log under general settings-->service tab?
    Thanks & Regards,
    Nagarajan

  • Why can't read access log file in real-time? (Oracle Weblogic Server 10.3)

    We can't read access log file in real-time. If access log is rotation to new file so can read access log file but can't read real-time.
    *** Oracle Weblogic Server versions 10 R3

    what's your meaning? try this command "tail -f access.log".
    Threre is a buffer about 8K for WebLogic to write the access info into the log files, so you can't see the access info untill the buffer is full.

Maybe you are looking for