Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
What is the difference between HTTP logs and TCP logs?
Short answer
HTTP Logs is a request-level record that keeps each request coming to the HTTP vService and the returned response on a single line; it contains the method, host, path, status code, the Backend Service that gave the response, the User-Agent and the transferred data size. TCP Logs, on the other hand, keeps each connection as a single record in L7 TCP vServices; the client address, the vService address and, if TLS is terminated, the TLS version and cipher suite are shown, and there is no HTTP information or Backend Service information. HTTP records are kept in a disk budget of 256 MB per vService, and TCP records stay for 24 hours in a table that holds at most 1,024 connection records (screen structure). Both are produced when LOG is checked on the vService and a Logs profile is selected; there is no LOG in a Network vService.
How Does It Work?
When LOG is checked on the vService and a Logs profile is selected, TR7 produces records for the traffic: in an HTTP vService each request and response, and in an L7 TCP vService each TCP connection, is a record. The records are read from the HTTP logs or TCP logs source in the Logs & Tracking tab of the vService screen; if Log Addresses is defined in the Logs profile, the same traffic is also sent to the log server in the line format selected in the profile.
Comparison
| HTTP Logs | TCP Logs | |
|---|---|---|
| vService type | HTTP | L7 TCP |
| Record unit | Each request and response | Each TCP connection |
| Default columns | Date, Connection info, Location, User-agent, Request, Response | Date, Connection info, SSL info |
| Filters | Status class, Status code, Method, Country, Client IP, Host, Backend service, Response source and others (Filter) | Client IP, TLS version, Cipher (Filter) |
| Backend Service information | Present (the Backend Service and Backend Group that gave the response) | None; which Backend Service the currently open connections go to is seen in the vService Sessions source |
| Storage on the device | 256 MB per vService; when full, the oldest records are deleted | At most 1,024 connection records, 24 hours per record |
| Line limit | Present (default 1000, at most 50000) | None |
| While the vService's Status is Disabled | Records are not fetched; Refresh stays inactive | Records are not fetched; Refresh stays inactive |
| Sending to the log server | In the line format selected in the Logs profile | With Standard Log Format, CEF Format, TR7 JSON Format and the Manual formats; if Apache formats are selected, the Standard line is sent in L7 TCP |
- There is no LOG in a Network vService; connections are monitored only with vService sessions.
- For a more detailed record (timings, termination state, headers, body) in an HTTP vService, Debug Mode Logs is used: What does Debug Mode record; how long should I keep it on?
- The records on the Logs & Tracking screen are independent of the line format selected in the Logs profile; Line format, Log standard and Log addresses determine only the line that goes to the log server.
How Is It Enabled in TR7?
- On the Load Balancer → Load Balancer vService List screen, the vService is right-clicked and Edit is selected.
- In the Details panel, LOG is checked; the Log Profile field gets the first saved Logs profile, or the built-in Stream Log if there is no profile at all. Stream log enables on-device logs and does not send to a log server (how to add to a vService).
- Save is clicked. The records start from the requests that come after this moment and are seen in the HTTP Logs or TCP Logs source in the Left Monitor Panel → vService → Logs & Tracking tab (screen structure). In a cluster, the change is also sent to the peer device with the default auto-sync; if Manual Sync Mode is on, it is sent with Synchronize.
Common Misconceptions
- "The Backend Service that the connection goes to is seen in TCP logs." There is no Backend Service information in a TCP record; the Backend Service of open connections is seen in vService sessions.
- "Records are kept on the device even while LOG is off." If LOG is off, neither an on-device record nor a line to the log server is produced.
- "Logs are read on the screen even after the vService is turned off." While the vService's Status is Disabled, no records are fetched from the HTTP logs and TCP logs sources and Refresh stays inactive (screen structure). TCP records, in addition, are kept only in the table of a running vService.
How it is done in the documentation
