Contents of syslog messages about traffic processing events

Each syslog message contains the following fields defined by the parameters of the Syslog protocol in the operating system:

date and time of the event;
name of the host where the event happened;
name of the application (the value is always KWTS).

Fields of the syslog message about a traffic processing event, which are defined by application options, have the format <key>="<value>". If a key has multiple values, these values are separated with a comma. A colon is used as the separator between keys.

Example:

Oct 9 10:13:06 localhost KWTS: type="Response": method="GET": action="Block": blocked_by_rule="protection_rules [Workspace1/-/Rule2]": processing_time="952": scan_result="Malware": workspace="Workspace1": http_user_name="example@test.local": http_user_agent="curl/7.29.0": http_user_ip="192.0.2.0": url="http://example.com/eicar.com": kata-alert="NotDetected": "eicar.com", filesize="69", kata_upload="SkippedByAction", guid="", rules="access_rules [Workspace1/Group1/Rule1], protection_rules [Workspace1/-/Rule2]", av-status="Detected", threats="EICAR-Test-File/Block", ap-status="NotDetected", mlf-status="NotDetected", encrypted="NotDetected", macros="NotDetected", kata-alert="NotDetected"

The keys, as well as their values contained in a message, are presented in the table below.

Information about traffic processing events in a syslog message

Key	Description and possible values

`type`	Type of HTTP message. Its value may be `Request` or `Response`.
`method`	HTTP request method.
`action`	Action taken on a detected object. It can take one of the following values: `Allow` – Allow. `Block` – Block. `Redirect` – Redirect.
`blocked_by_rule`	Name of the traffic processing rule that caused the web resource to be blocked. It is displayed in the following format: For bypass rules: `"[<Rule name>]"` For protection rules and access rules: `"[<Workspace name>/<Name of rule group>/<Rule name>]"`
`redirected_by_rule`	Name of the traffic processing rule that caused the user to be redirected to the specified URL. It is displayed in the following format: For bypass rules: `"[<Rule name>]"` For access rules: `"[<Workspace name>/<Name of rule group>/<Rule name>]"`
`processing_time`	Duration of HTTP message processing, in milliseconds. The time is counted from the start of processing of the HTTP message header until a record of the completed scan is saved in the application event log and in the Syslog event log.
`scan_result`	Result of scanning the HTTP message. If multiple threats are detected, the name of the highest-priority threat is displayed. If threats were eliminated or were not detected, the highest-priority scan result is displayed (Disinfected, Not detected, Not scanned).
`workspace`	Name of the workspace associated with the traffic processing event. If there is no workspace, a dash is displayed.
`http_user_name`	Name of the user account that initiated the HTTP request.
`http_user_agent`	Client application that initiated the HTTP request.
`http_user_ip`	IP address of the computer from which the HTTP request was sent.
`url`	URL of the web resource that the user requested.
`kata-alert`	Result of scanning a URL to check if it matches objects detected by KATA. The following values are possible: `NotDetected` – the URL was scanned, and no threats were detected. `Detected` – a match with an object in the KATA cache was detected. The object ID, match criterion, and technology are indicated. For example, `kata-alert="Detected/128563/Url/Sb"`. `NotScanned/AccessRuleSettings` – a scan was not performed because the protection rule is not applied in accordance with the action defined in the access rule. `NotScanned/BypassRuleSettings` – a scan was not performed because the file was skipped without scanning based on a bypass rule. `NotScanned/ProtectionRuleSettings` – a scan was not performed because the Skip scanning action is defined for Objects detected by KATA objects in the protection rule. `NotScanned/ApplicationSettings` – a scan was not performed because the mode for receiving objects detected by KATA or KATA integration is disabled in accordance with the application settings. `ScanError/InternalError` – the scan ended with an error.
For a multipart MIME type object, information about all constituent parts is provided. For each constituent part, the `part` key is used with the sequence number, after which all attributes of this constituent part is transmitted (the following keys: `filename`, `filesize`, `part_mimetype`, `kata_upload`, `guid`, `rules`, `av_status`, `ap_status`, `mlf-status`, `encrypted`, `macros` and `kata-alert`). For example, `part1 "news.html", <attributes of constituent part 1>: part2 <attributes of constituent part 2>`.
`filename`	Name of the scanned object. If the HTTP message does not contain any objects, `"nofile"` is indicated. In this case, all subsequent fields pertain to the scanned URL.
`filesize`	Size of the scanned object. If the HTTP message does not contain objects or the file size is not required for applying rules, `"NotApplicable"` is indicated.
`part_mimetype`	MIME type of the multipart object constituent part. The Content-Type header value is used. If the HTTP message does not contain objects or the MIME type definition is not required for applying rules, `"NotApplicable"` is indicated.
`kata_upload`	Result of checking whether an object must be sent to the KATA server. The following values are possible: `NotApplicable` – the HTTP message does not contain files. `Scheduled` – file transmission is scheduled. `DisabledBySettings` – the mode for sending files to the KATA server or KATA integration is disabled in the application settings. `SkippedByAction` – the HTTP message was skipped according to the bypass rule without being scanned, or the Block or Redirect action was applied to it. `RejectedByFilter` – the file does not satisfy the conditions for being sent to the KATA server. `Failed/QueueOverflowed` – the file must be sent to the KATA server, but transmission could not be scheduled due to a queue overflow. `Failed/InternalError` – the file must be sent to the KATA server, but transmission could not be scheduled due to an internal error of the application.
`guid`	ID assigned to an object by the application. The ID is transmitted only if one of the following statuses was assigned when checking whether the object must be sent to the KATA server: `Scheduled`. `Failed/QueueOverflowed`. `Failed/InternalError`. For other statuses, the `guid` field is transmitted with a blank value.
`rules`	Names of triggered traffic processing rules in the following format: `"bypass_rule [<Rule name>], access_rules [<Workspace name>/<Name of rule group>/<Rule name>], protection_rules [<Workspace name>/<Name of rule group>/<Rule name>]"`. If a rule is not associated with a workspace, a dash is displayed instead of the workspace name. If a rule is not part of a group of rules, a dash is displayed instead of the group name. If no traffic processing rule has been applied, the default protection policy is applied. The `"default_policy [Default Policy]"` value is displayed.
`av_status`	Results of a web resource scan by the Anti-Virus module. The following values are possible: `Detected` – viruses or other threats were found in the object. The names of detected threats and the action taken on an object by the application are separated by commas. For example, `av-status="Detected", threats="EICAR-Test-File/Block"`. `ScanError/Timeout` – the scan ended with an error because the maximum scan duration was exceeded. `ScanError/InternalError` – the scan ended with an internal error. `ScanError/BasesNotLoaded` – the scan ended with an error because the Anti-Virus module databases were not loaded. `IncompleteScan/MaxNestingLevelReached` – a scan was not performed because the nesting level of the scanned archive exceeds the maximum allowed nesting level. `IncompleteScan/EncryptedArchive` – a scan was not performed because the object is encrypted. `Disinfected` – threats were detected, and all threats were disinfected. `NotDetected` – the object was scanned, no threats were detected. `NotScanned/AccessRuleSettings` – protection rules were not applied to the object in accordance with the action defined in the access rule. `NotScanned/BypassRuleSettings` – the object was not scanned because a bypass rule was applied to it. `NotScanned/ProtectionRuleSettings` – the object was not scanned in accordance with the action defined in the protection rule. `NotScanned/ApplicationSettings` – the object was not scanned in accordance with the defined application settings.
`ap_status`	Results of a web resource scan by the Anti-Phishing module. The following values are possible: `Detected (local bases)` – the link was recognized as a phishing link based on records in the local databases of the application. `Detected (KSN)` – the link was recognized as a phishing link based on a KSN reputation check. `Detected (heuristics)` – the link was recognized as a phishing link based on heuristic analysis data. `ScanError/Timeout` – the scan ended with an error because the maximum scan duration was exceeded. `ScanError/InternalError` – the scan ended with an internal error. `ScanError/BasesNotLoaded` – the scan ended with an error because the Anti-Phishing module databases were not loaded. `NotDetected` – the object was scanned, no threats were detected. `NotScanned/AccessRuleSettings` – protection rules were not applied to the object in accordance with the action defined in the access rule. `NotScanned/BypassRuleSettings` – the object was not scanned because a bypass rule was applied to it. `NotScanned/ProtectionRuleSettings` – the object was not scanned in accordance with the action defined in the protection rule. `NotScanned/ApplicationSettings` – the object was not scanned in accordance with the defined application settings.
`mlf-status`	Results of scanning links for malicious objects. The following values are possible: `Detected (local bases)` – the link was deemed malicious based on records in the local anti-virus databases. `Detected (KSN)` – the link was deemed malicious based on a KSN reputation check. `ScanError/Timeout` – the scan ended with an error because the maximum scan duration was exceeded. `ScanError/InternalError` – the scan ended with an internal error. `ScanError/BasesNotLoaded` – the scan ended with an error because the Anti-Phishing module databases were not loaded. `NotDetected` – the link was scanned, and no threats were detected. `NotScanned/AccessRuleSettings` – protection rules were not applied to the object in accordance with the action defined in the access rule. `NotScanned/BypassRuleSettings` – the object was not scanned because a bypass rule was applied to it. `NotScanned/ProtectionRuleSettings` – the object was not scanned in accordance with the action defined in the protection rule. `NotScanned/ApplicationSettings` – the object was not scanned in accordance with the defined application settings.
`encrypted`	Information about encryption of the scanned object. The following values are possible: `Detected` – threats were detected. `ScanError/Timeout` – the scan ended with an error because the maximum scan duration was exceeded. `ScanError/InternalError` – the scan ended with an internal error. `ScanError/BasesNotLoaded` – the scan ended with an error because the Anti-Virus module databases were not loaded. `NotDetected` – the link was scanned, and no threats were detected. `NotScanned/ApplicationSettings` – the object was not scanned in accordance with the defined application settings. `NotScanned/AccessRuleSettings` – protection rules were not applied to the object in accordance with the action defined in the access rule. `NotScanned/BypassRuleSettings` – the object was not scanned because a bypass rule was applied to it. `NotScanned/ProtectionRuleSettings` – the object was not scanned in accordance with the action defined in the protection rule. `NotScanned/ApplicationSettings` – the object was not scanned in accordance with the defined application settings.
`macros`	Information about the presence of macros in the scanned object. The following values are possible: `Detected` – macros were detected. `ScanError/Timeout` – the scan ended with an error because the maximum scan duration was exceeded. `ScanError/InternalError` – the scan ended with an internal error. `ScanError/BasesNotLoaded` – the scan ended with an error because the Anti-Virus module databases were not loaded. `NotDetected` – the object was scanned, and no macros were detected. `NotScanned/AccessRuleSettings` – protection rules were not applied to the object in accordance with the action defined in the access rule. `NotScanned/BypassRuleSettings` – the object was not scanned because a bypass rule was applied to it. `NotScanned/ProtectionRuleSettings` – the object was not scanned in accordance with the action defined in the protection rule. `NotScanned/ApplicationSettings` – the object was not scanned in accordance with the defined application settings.
`kata-alert`	Result of scanning a file contained in an HTTP message or a constituent part (for multipart objects) to check if they match objects detected by KATA. The following values are possible: `NotDetected` – the URL was scanned, and no threats were detected. `Detected` – a match with an object in the KATA cache was detected. The object ID, match criterion, and technology are indicated. For example, `kata-alert="Detected/124567/Md5/Yara"`. `NotScanned/AccessRuleSettings` – a scan was not performed because the protection rule is not applied in accordance with the action defined in the access rule. `NotScanned/BypassRuleSettings` – a scan was not performed because the file was skipped without scanning based on a bypass rule. `NotScanned/ProtectionRuleSettings` – a scan was not performed because the Skip scanning action is defined for Objects detected by KATA objects in the protection rule. `NotScanned/ApplicationSettings` – a scan was not performed because the mode for receiving objects detected by KATA or KATA integration is disabled in accordance with the application settings. `ScanError/InternalError` – the scan ended with an error.

Page top