action

status of the session. Uses following definition: - Deny = blocked by firewall policy. - Start = session start log (special option to enable logging at start of a session). This means firewall allowed. - All Others = allowed by Firewall Policy and the status indicates how it was closed.

string

agent

string

ap

string

app

Application name

string

appact

The security action from app control

string

appcat

Application category

string

appid

Application ID

uint32

applist

Application Control profile (name)

string

apprisk

Application Risk Level

string

apsn

string

authserver

string

centralnatid

Central NAT ID

uint32

channel

uint32

comment

string

countapp

Number of App Ctrl logs associated with the session

uint32

countav

Number of AV logs associated with the session

uint32

countcifs

uint32

countdlp

Number of the DLP logs associated with the session

uint32

countdns

uint32

countemail

Number of the email logs associated with the session

uint32

countff

uint32

countips

Number of the IPS logs associated with the session

uint32

countssh

uint32

countssl

uint32

countwaf

uint32

countweb

Number of the Web Filter logs associated with the session

uint32

craction

Action performed by Client Reputation

uint32

crlevel

string

crscore

Client Reputation score

uint32

date

Date

string

devid

Device serial number

string

devtype

Device type

string

dstauthserver

string

dstcountry

Country name for the destination IP

string

dstdevtype

string

dstfamily

string

dstgroup

string

dsthwvendor

string

dsthwversion

string

dstinetsvc

string

dstintf

Destination Interface

string

dstintfrole

string

dstip

Destination IP Address

ip

dstmac

string

dstname

The destination name.

string

dstosname

string

dstport

Destination Port

uint16

dstserver

uint8

dstssid

Destination SSID

string

dstswversion

string

dstunauthuser

string

dstunauthusersource

string

dstuser

string

dstuuid

UUID of the Destination IP address

string

duration

Duration of the session

uint32

eventtime

uint64

fctuid

string

group

User group name

string

identifier

uint16

lanin

LAN incoming traffic in bytes

uint64

lanout

LAN outgoing traffic in bytes

uint64

level

Log Level

string

logid

Log ID

string

masterdstmac

string

mastersrcmac

The master MAC address for a host that has multiple network interfaces

string

msg

Log message

string

osname

Name of the device's OS

string

policyid

Firewall Policy ID

uint32

policyname

string

policytype

string

poluuid

UUID of the Firewall Policy

string

proto

protocol number

uint8

radioband

string

rcvdbyte

Received Bytes

uint64

rcvddelta

uint64

rcvdpkt

Received Packets

uint32

sentbyte

Sent Bytes

uint64

sentdelta

uint64

sentpkt

Sent Packets

uint32

service

Name of service

string

sessionid

Session ID

uint32

shaperdroprcvdbyte

Received bytes dropped by shaper

uint32

shaperdropsentbyte

Sent bytes dropped by shaper

uint32

shaperperipdropbyte

Dropped bytes per IP by shaper

uint32

shaperperipname

Traffic shaper name (per IP)

string

shaperrcvdname

Traffic shaper name for received traffic

string

shapersentname

Traffic shaper name for sent traffic

string

shapingpolicyid

uint32

srccountry

Country name for Source IP

string

srcdomain

string

srcfamily

string

srchwvendor

string

srchwversion

string

srcinetsvc

string

srcintf

Source interface name

string

srcintfrole

string

srcip

Source IP address

ip

srcmac

MAC address associated with the Source IP

string

srcname

Source name

string

srcport

Source port number

uint16

srcserver

uint8

srcssid

Source SSID

string

srcswversion

string

srcuuid

UUID of the Source IP Address

string

sslaction

string

subtype

Subtype of the traffic

string

time

Time

string

trandisp

NAT translation type

string

tranip

NAT destination IP

ip

tranport

NAT Destination Port

uint16

transip

NAT Source IP

ip

transport

NAT Source Port

uint16

type

Log type

string

tz

string

unauthuser

Unauthenticated user name

string

unauthusersource

The method used to detect unauthenticated user name

string

url

string

user

User name

string

utmaction

Security action performed by UTM

string

vd

Virtual domain name

string

vpn

The name of the VPN tunnel

string

vpntype

The type of the VPN tunnel

string

vrf

uint8

vwlid

uint32

vwlname

string

vwlquality

string

vwlservice

string

vwpvlanid

uint32

wanin

WAN incoming traffic in bytes

uint64

wanoptapptype

WAN Optimization Application type

string