D Traffic Log Attributes

This appendix describes the meaning of each attribute that is displayed when you expand a record in the traffic log Search Results dialog box.

This appendix contains:

• Transaction Status

• Performance

• Context

• Attributes (F5)

Transaction Status

Table D-1 Transaction Status

Attribute	Meaning or Source
SQL Request	SQL statement text, or text that indicates the response from logging in or out (e.g. "CONNECTED, FAILED LOGIN"). "CONNECTED" indicates that there is a connection between the database and database client.
Response Status	This shows whether or not the statement or login was successfully executed by the database.
Response Code	An integer response code as returned from the monitored database. The value and meaning are dependent on the database type. Please refer to your database system documentation for further information.
Response Detailed Status	Response status information as returned from the monitored database. Please refer to your database system documentation for further information.
Response Text	Detailed verbose response message as returned from the monitored database. For errors, this is typically the same as the error message displayed at the client. This information is available only if the Full error message annotation check box is selected (see "Configuring Database Response Monitoring").
Record Type	The type of record that is being displayed ("session" for a login or logout, or "statement" for SQL requests).

Performance

Table D-2 Performance

Attribute	Meaning or Source
Request Time	The time that the SQL request was sent to the database.
Response Time	The time that the database response was generated.
Transaction Time	The time taken to execute the SQL request.

Context

Table D-3 Context

Attribute	Meaning or Source
Traffic Source	The source of the SQL request. For example, "network", "local monitor" or "remote monitor".
DB User Name	Database login name.
DB User Name Origin	Method used to obtain the DB User Name. The possible value is: "generated" (the name "unknown_username" was assumed), "dbquery" (the name was obtained from a database query) or "network" (the name was obtained from the SQL traffic).
DB User Name (raw)	The DB User Name that was used at the time Oracle Database Firewall applied the statement policy. This may be the same as DB User Name (if the name was available from the statement or derived from a previous statement) or "unknown_username".
DB Client Program Name	Name of the software being used to connect to the database.
DB Client Program Name Origin	Method used to obtain the DB Client Program Name. See DB User Name Origin for possible values.
DB Client IP Address	IP address of the database client that originated the SQL request.
DB Client Port	Port of the database client that originated the SQL request.
DB Server IP Address	IP address of the database management system (i.e. the IP address used by database clients to send traffic to the database).
DB Server Port	Port number of the database management system.
Database Type	Name of the database type that the baseline applies to.
OS User Name	Operating system login name.
OS User Name Origin	Method used to obtain the DB Client Program Name. See DB User Name Origin for possible values.

Attributes (F5)

Table D-4 Attributes (F5)

Attribute	Meaning or Source
Authentication Method	Obtained from the BIG-IP ASM "authentication method" defined in the iRule (e.g. "webform").
Cardinal IP Address	The client HTTP request may have been forwarded several times through proxies. The IP address shown in this attribute is the one the Oracle Database Firewall software believes is the most important for client identification.
Management IP Address	Obtained from the BIG-IP ASM "management_ip_address" attribute.
Match Result	This can display: PolicyConfirmed ‒BIG-IP ASM generated an alert, and the associated SQL statement generated a "block" or "warn" in Oracle Database Firewall. NoMatch: ‒The BIG-IP ASM syslog message containing the information displayed in the traffic log record has not been matched with an SQL statement. NoMatchDataMasked ‒The BIG-IP ASM syslog message containing the information displayed in the traffic log record has at least one field containing star ("*") characters, which indicates sensitive data that has been obliterated by BIG-IP ASM. The Oracle Database Firewall software is not able to match syslog messages containing obliterated fields, as configured in BIG-IP ASM. PolicyConflict ‒BIG-IP ASM generated an alert, but the associated SQL statement did not generate a "block" or "warn" in Oracle Database Firewall. WAFBlocked‒ BIG-IP ASM blocked a request. Although a syslog message was generated, the Web application server generated no SQL statements for this request.
Match Tokens	This is for Oracle Database Firewall engineers only. It indicates the tokens that were used to match syslog messages with the SQL statement.
Method (http)	Obtained from the BIG-IP ASM "method" attribute.
Policy Apply Date	Obtained from the BIG-IP ASM "policy_apply_date" attribute.
Policy Name	Obtained from the BIG-IP ASM "policy_name" attribute.
Primary Violation	The BIG-IP ASM violation associated with this statement, which the Oracle Database Firewall software believes is the most important.
Protocol (http)	Obtained from the BIG-IP ASM "protocol" attribute.
Query String (http)	Obtained from the BIG-IP ASM "query_string" attribute.
Referer (http)	This is the name of the referrer, extracted from the header of the HTTP request.
Request (http)	Obtained from the BIG-IP ASM "request" attribute.
Request Blocked	Obtained from the BIG-IP ASM "request_blocked" attribute.
Response Code (http)	Obtained from the BIG-IP ASM "response_code" attribute.
Session Cookies	This provides the user-identification cookies, extracted from the header of the HTTP request.
Support ID	Obtained from the BIG-IP ASM "support_id" attribute. Clicking the link provides details of the violation in BIG-IP ASM. Note: The link does not function if ASM is restarted after monitoring the traffic.
URI (http)	Obtained from the BIG-IP ASM "uri" attribute.
Unit Hostname (http)	Obtained from the BIG-IP ASM "unit_hostname" attribute.
User Agent (http)	Name of user agent, from the header of the HTTP request.
Violations	Obtained from the BIG-IP ASM "violations" attribute.
Web Application Name	Provides the name of the Web application, as obtained from the BIG-IP ASM "web_application_name" attribute.
Web Client IP Address	Displays the IP address of the Web client, as obtained from the BIG-IP ASM "ip" attribute.
Web Host	WAF host name, extracted from the header of the HTTP request.
Web Username	If known, this provides the login username of the user. If the user is not known, but cookies with the specified prefix are provided, this displays "Anonymous_<cookie value>". If the HTTP request in the syslog message contains no cookies with the specified prefix, "Unknown_<auto incrementing number>" is displayed.