Skip to content

Bluecoat ProxySG

Description

Constructor: Bluecoat

Product: Proxy Secure Gateway

Log type(s): PRX, SYS

Theoretical injector performance

18567 EPS

Log sample

Type PRX:

1
2017-02-10 12:34:56 1.2.3.4 DENIED 0 - 1486121632 440 0 1.0 0 http blugro2relay.groove.microsoft.com http://blugro2relay.groove.microsoft.com/2.0/blugro2relay.groove.microsoft.com/b523s8fvpp7ampixcy6wxp8zsn9nj5dbyqcddci,ConnType=LongLived 80 /2.0/blugro2relay.groove.microsoft.com/b523s8fvpp7ampixcy6wxp8zsn9nj5dbyqcddci,ConnType=LongLived  Unknown POST POST - 1.170.1.1 - -
1
2017-02-10 12:34:56 1.2.3.4 OBSERVED 0 TUNNELED 1486121314 126 51 - - ssl translate.googleapis.com ssl://translate.googleapis.com:443/ 443 /  1.1.47.33 56307 8080 - - - ICAP_NOT_SCANNED - Direct unknown - - 1.1.208.234 - -

Type SYS:

1
ProxySG: 420000 Logout[Bluecoat]ERR:Could not send Logout message(0) SEVERE_ERROR admin.cpp 713
1
ProxySG: 2C0006 Snapshot debug-stats has fetched /sysinfo-stats(0) NORMAL_EVENT snapshot_worker.cpp 236
1
ProxySG: 420001 Successfully connected to primary authentication agent for realm Bluecoat at 1.1.69.26:16101(0) NORMAL_EVENT admin.cpp 429

Parsing strategy

  • First, we check the log type (e.g SYS or PRX) using grok. If the log starts with ProxySG: its type is SYS. Else it PRX.
  • If the log type is SYS: Grok patterns are used.
  • If the log type is PRX: a CSV operator is used. If, the log is malformed (some fields are missing, log too long, etc) an exception is raised. Then, all fields containing the value are dropped.
  • Finally, a binding is made to respect the normalisation.