Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 2 replies
  • Subscribers 2 subscribers
  • Views 651 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Include client port number in syslog for reverse proxy?

hkelley
I'm trying to use the UTM reverse proxy logs in a SIEM tool but I don't have the source port (from UTM to the real web server) in the syslog output, only srcip.

Can this field be added?  It would help  


12 13 2014 10:48:17 10.99.11.50  2014:12:13-15:48:17 sophosutm-01 reverseproxy: id='0299' srcip='99.128.61.87' localip='10.99.11.101' size='185' user='john.doe' host='99.128.61.87' method='POST' statuscode='302' reason='-' extra='-' exceptions='SkipURLHardening, SkipFormHardening, SkipFormHardeningMissingToken' time='6182429' url='/_xyz_login' server='soph.xyz.com' referer='soph.xyz.com/.../;httponly;secure'


Having this would help me associate a proxy request like the one above with an IIS log like the one below. 


#Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) cs(Referer) sc-status sc-substatus sc-win32-status time-taken c-port x-forwarded-for

2014-12-13 15:48:19 10.126.11.125 GET /UserPortal/App_Themes/Default/Images/PN_app_back.gif - 443 - 10.99.11.50 Mozilla/5.0+(Linux;+Android+4.4.2;+HTC+One_M8+Build/KOT49H)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/39.0.2171.93+Mobile+Safari/537.36 soph.xyz.com/.../ 200 0 0 0 48162 99.128.61.87


This thread was automatically locked due to age.