Troubleshooting guide

1-1

Cisco Wide Area Application Services Configuration Guide

OL-26579-01

APPENDIX

Transaction Log Format

You can use the transaction logging feature to log individual TCP transactions for a WAAS device. For

information on configuring transaction logging, see the “Configuring Transaction Logging” section on

page 1-53.

TFO transaction logs are kept on the local disk in the directory /local1/logs/tfo.

There are several kinds of transaction log messages that have different templates, as follows

• Optimized Flow Start message:

Time_Stamp :Conn_ID :Src_IP :Src_Port :Dst_IP :Dst_Port :OT :Log_type :Conn_type :Peer_ID

:App_map_name :App_name :App_classifier_name :Flag_directed_mode :TFO_cfgd_policy

:TFO_drvd_policy :TFO_peer_policy :TFO_neg_policy :TFO_applied_policy :TFO_reject_reason

:AO_cfgd_policy :AO_drvd_policy :AO_neg_policy :AO_reject_reason :SSL_reject_reason :DSCP

:Link_rtt

• Optimized Flow End Message:

Time_Stamp :Conn_ID :Src_IP :Src_Port :Dst_IP :Dst_Port :OT :Log_type :Conn_type

:AO_neg_policy :Original_bytes_read :Original_bytes_written :Optimized_bytes_read

:Optimized_bytes_written

• Pass Through Flow Message:

Time_Stamp :Src_IP :Src_Port :Dst_IP :Dst_Port :BP :Bypass_Reason :TFO_cfgd_policy

:TFO_drvd_policy :TFO_peer_policy :TFO_reject_reason :AO_cfgd_policy :AO_drvd_policy

:AO_reject_reason

• Optimized Flow TFO End Message:

Time_Stamp :Conn_ID :Src_IP :Src_Port :Dst_IP :Dst_Port :SODRE :END :Original_bytes_read

:Original_bytes_written :Optimized_bytes_read :Optimized_bytes_written :Conn_close_state

• System Restart Message:

Time_Stamp :0 :0 :0 :0 :0 :RESTART

Table 1-1 describes the fields found in the transaction log messages.

Ta b l e 1- 1 Tr a n s a c t i o n L o g Field Descriptions

Field Description

Time_Stamp Time stamp indicating when the log message was generated.

Conn_ID A unique identifier for the connection.

Src_IP, Src_Port Source IP address and port number for the connection.