Which HTTP and TCP log formats are supported (Standard, Apache Combined, Apache VHost, CEF, TR7 JSON, TR7 WAF, Manual JSON, Manual CEF, Manual log line)?

Short answer

There are nine options in the Line Format list of the Logs profile: Standard Log Format, Apache Combined Log Format, Apache VHost Log Format, CEF Format, TR7 JSON Format, TR7 WAF Log, Manual JSON Format, Manual CEF Format and Manual Log Line Format. The list does not change by vService type; the content of the line is determined by the type of the vService to which the profile is assigned. On an L7 TCP vService, Standard and the two Apache formats produce the same TCP line, CEF and TR7 JSON are written with TCP fields, and TR7 WAF Log produces no line at all on a vService without WAF enabled. The format determines only the line going to the log server; the HTTP Logs and TCP Logs in Logs & Tracking are independent of the format.

How Does It Work?

When LOG is checked on the vService and a Logs profile with a log server address defined is selected, TR7 produces one line according to the Line Format in the profile for each request on an HTTP vService and for each connection on an L7 TCP vService. A syslog header according to the Log Standard is added to the start of the line, and the line is sent to each server in the Log Addresses list. Which fields the line carries is determined by the format and the type of the vService together.

Log Formats in TR7

Format	HTTP vService	L7 TCP vService
Standard Log Format	Client address, time, request line, status code, response size	Connection line: client address and port, time, vService, Backend Service, wait and connection times, size, termination state, connection counters, queue, Backend Service address
Apache Combined Log Format	Standard + Referer + User-Agent	The same TCP line as Standard Log Format
Apache VHost Log Format	Host + Apache Combined	The same TCP line as Standard Log Format
CEF Format	CEF line for SIEMs: client, vService and Backend Service addresses, TLS, request and response information; if WAF is enabled, the WAF fields are filled	CEF line with TCP connection fields
TR7 JSON Format	Timings, connection counters, termination state (tstate), retries, TLS, request and response details; if WAF is enabled, the WAF fields are filled	The same structure without the request, response and WAF fields
TR7 WAF Log	Only the requests blocked by WAF; if WAF is not enabled, no line is produced	No line is produced
Manual JSON Format	JSON from the Key/Value rows in the Manual Log Entries table; all values are written as text	Variables that are invalid in TCP are written with an empty value
Manual CEF Format	Automatic CEF header + Key/Value fields; a field left empty is removed from the line	TCP|TCP is written in the header instead of the status code and the response source; fields that are invalid in TCP are removed
Manual Log Line Format	Free line with Smart Variables	No protocol check is performed; if an HTTP-specific variable is used, the vService cannot be started

In Manual JSON Format and Manual CEF Format, the variables that remain invalid in the protocol of the vService are reported with a notification. Defining custom formats: Can I define my own log format?

Selected Together with the Format

• Log Addresses: The log servers to which the line will be sent (at least one address). Each address has Protocol (default UDP), IP, Port and a separate Sampling setting. The Port field comes empty in the interface and filling it is required (the common port for syslog is 514); in WEB-CLI, if the port is not written, 514 is used.
• Log Standard: Determines the syslog header of the line; its default value is local, and the other options are rfc3164, rfc5424, priority and raw.
• If the response time of the Backend Service is needed, the time fields in TR7 JSON Format or the Response time of the backend service variable (%TIMESERVERRES) in the Manual formats are used.

Creating the profile and assigning it to the vService: How do I send logs to a SIEM (Syslog)?

Common Misconceptions

• "The format changes the Logs & Tracking screen." The HTTP Logs and TCP Logs on the device are kept with fixed fields; the format determines only the line going to the log server.
• "There is a separate format list for TCP." The list is the same; the format produces a TCP line according to the type of the vService to which the profile is assigned.
• "TR7 WAF log writes every request." This format writes only the requests blocked by WAF; on a vService without WAF enabled or on an L7 TCP vService, no line at all goes to the log server.
• "The built-in Stream log profile also sends to the log server." Stream log only enables the HTTP Logs and TCP Logs records on the device; it does not send lines out (default behavior).

How it is done in the documentation

• Logs profile · The Supported Log Formats
• Logs profile · Line Format
• Manual Formats · About the Format
• L7 TCP vService · LOG

Related questions

• How do I send logs to a SIEM (Syslog)?
• Can I define my own log format?
• What is the difference between HTTP logs and TCP logs?