Enabling extended logging

You can enable extended logging for the following UTM profiles:

• antivirus
• application
• dlp
• ips
• waf
• webfilter

When extended logging is enabled, the following fields are included in http-transaction logs:

• useragent
• referralurl
• httpmethod
• statuscode
• rawdata

See Explicit proxy logging for more information.

Antivirus, dlp, webfilter

For antivirus, dlp, and webfilter, extended logging can be enabled per policy (or globally for implicit policy). For example:

config firewall policy

edit <policy_id>

set log-http-transaction enable

set extended-log enable

next

end

config webproxy global

set log-http-transaction enable

set extended-log enable

end

Application, ips, waf

For application, ips, and waf, extended logging can be enabled using the extended-log option in the UTM profile. For example:

# waf profile

config waf profile

edit "test-waf"

set extended-log enable

next

end

Syslog server mode

The Syslog server mode changed to udp, reliable, and legacy-reliable. You must set the mode to reliable to support extended logging, for example:

config log syslogd setting

set status enable

set server "<ip address>"

set mode reliable

set facility local6

end