Firewall log fields

Applies To: Forefront Threat Management Gateway (TMG)

The following table lists the fields that you can include in each of the Forefront TMG log files. Note that, in Forefront TMG log format, if a field is disabled, it will appear in the log with a hyphen (-). In World Wide Web Consortium (W3C) log file format, the field will not appear. The Bit number column refers to the position in the Forefront TMG file format.

Bit number	Field name (log viewer)	Field name (SQL Server log format and SQL Server Express log format)	Field name (W3C format)	Description
0	Server Name	servername	computer	The name of the Forefront TMG computer assigned in the operating system settings.
1	Log Date	logTime	date	The date on which the logged event occurred. In the SQL Server and SQL Server Express formats, both the date and the local time are included in the single logTime field.
2	Log Time	logTime	time	The time when the logged event occurred. In the W3C extended file format this time is in Coordinated Universal Time (UTC). In all other formats, this is the local time. In the SQL Server and SQL Server Express formats both the date and the time are included in the single logTime field.
3	Transport	protocol	IP Protocol	The transport protocol used for the connection. Common values are TCP and UDP.
4	Client IP and Port	SourceIP SourcePort	source	The IP address of the requesting client and the source port used. In SQL Server and SQL Server Express formats, there are separate SourceIP and SourcePort fields to allow individual querying. For ICMP packets, the port field indicates the ICMP type.
5	Destination IP and Port	DestinationIP Destination Port	destination	The network IP address and the port number on the target computer that provides service to the current connection. The port number is used by the client application initiating the request. In SQL Server and SQL Server Express formats, there are separate DestinationIP and DestinationPort fields to allow individual querying. For ICMP packets, the port field indicates the ICMP code.
6	Original Client IP	OriginalClientIP	original client IP	The original IP address of the requesting client.
7	Source Network	SourceNetwork	source network	The network from which the request originated.
8	Destination Network	DestinationNetwork	destination network	The network to which the request was sent.
9	Action	Action	action	The action performed by the firewall for the current session or connection. The possible values are defined in the FpcAction enumerated type.
10	Result Code	Resultcode	status	A Windows error code or a Forefront TMG error code in HRESULT format.
11	Rule	Rule	rule	The rule that either allowed or denied access to the request, as follows: If an outgoing request was allowed, this field reflects the access rule that allowed the request. If the request was denied, this field reflects the access rule that blocked the request. If an incoming request was allowed, this field reflects the Web publishing server or publishing rule that allowed the request. If the request was denied, this field reflects the Web publishing server or publishing rule that denied the request. If the incoming or outgoing request was denied for a reason other than policy rules, (for example due to an intrusion attempt or exceeding a flood resiliency threshold) the field is empty and the Result Code field indicates the reason.
12	Protocol	ApplicationProtocol	application protocol	The name of the application protocol used for the connection as defined in the collection of protocol definitions.
13	Bidirectional	Bidirectional	bidirectional	A value from the FpcBidirection enumerated type that indicates whether the connection was bidirectional.
14	Bytes Sent	bytessent	bytes sent	The total number of bytes sent from the client to the destination host during the current connection. A hyphen (-) or a zero (0) in this field indicates that this information was not provided by the destination host or that no bytes were sent to the destination host.
15	Bytes Sent Delta	bytessentDelta	bytes sent intermediate	The number of bytes sent from the client to the destination host since the previous log entry for the current connection. A hyphen (-) or a zero (0) in this field indicates that this information was not provided by the destination host or that no bytes were sent to the destination host.
16	Bytes Received	bytesrecvd	bytes received	The total number of bytes sent from the remote computer and received by the client during the current connection. A hyphen (-) or a zero (0) in this field indicates that this information was not provided by the remote computer or that no bytes were received from the remote computer.
17	Bytes Received Delta	bytesrecvdDelta	bytes received intermediate	The number of bytes sent from the remote computer and received by the client since the previous log entry for the current connection. A hyphen (-) or a zero (0) in this field indicates that this information was not provided by the remote computer or that no bytes were received from the remote computer.
18	Processing Time	connectiontime	connection time	The total time, in milliseconds, that was needed by Forefront TMG to process the current connection. It measures the time elapsed from the time when the Forefront TMG computer first received the request to the time when final processing occurred on the Forefront TMG computer—when results were returned to the client and the connection was closed.
19	Processing Time Delta	connectiontimeDelta	connection time intermediate	The time, in milliseconds, that has elapsed since the previous log entry for the current connection.
20	Destination Host Name	DestinationName	destination name	The domain name for the remote computer that provides service to the current connection.
21	Client Username	ClientUserName	username	The account of the user making the request. A question mark (?) next to the user name indicates that the user name was sent but the user was not authenticated by Forefront TMG. If Forefront TMG access control is not being used, Forefront TMG uses Anonymous.
22	Client Agent	ClientAgent	agent	For clients with Forefront TMG Client software installed, this is the name of the application that made the network request. This field is not applicable to SecureNAT client sessions.
23	Session ID	sessionid	session ID	An identifier that identifies a session's connections. For Forefront TMG clients, each process that connects through the Microsoft Firewall service initiates a session. For SecureNAT clients, a single session is opened for all the connections that originate from the same IP address.
24	Connection ID	connectionid	connection ID	An identifier that identifies entries belonging to the same connection. Outbound TCP usually has two entries for each connection: when the connection is established and when the connection is terminated. UDP usually has two entries for each remote address.
25	Network Interface	Interface	interface	The network adapter with which the connection was established on the Forefront TMG computer.
26	Raw IP Header	IPHeader	IP header	The IP header of the current packet. Information is supplied to this field only for packets that are denied passage and are dropped by Forefront TMG.
27	Raw Payload	Payload	protocol payload	The protocol header of the current packet. Information is supplied to this field only for packets that are denied passage and are dropped by Forefront TMG.
28	GMT Log Time	GmtLogTime	GMT Time	The GMT time that corresponds to the local time in the logTime field.
29	NIS Scan Result	ipsScanResult	NIS scan result	The result when NIS scans the traffic or connection (inspected/detected/blocked).
30	NIS Signature	ipsSignature	NIS signature	The NIS signature detected or based on which the traffic was blocked.
31	NAT Address	NATAddress	NAT Address	Public IP address used as a source IP for outbound traffic.
32	Forefront TMG Client FDQN	FwcClientFqdn	fwc-client-fqdn	Gets the FQDN of the client computer for a Forefront TMG Client connection.
33	Forefront TMG Client Application Path	FwcAppPath	fwc-app-path	Gets the full path of the client application for a Forefront TMG Client connection.
34	Firewall Client Application SHA1 Hash	FwcAppSHA1Hash	fwc-app-sha1-hash	Gets the SHA1 hash value that is calculated for the executable file of the client application and used by Forefront TMG Client to request a network connection.
35	Forefront TMG Client Application trust state	FwcAppTrusState	fwc-app-trust-state	Gets a value from the FpcFwcClientApplicationTrustState enumerated type that indicates whether the client application is trusted by the operating system running on the client computer.
36	Forefront TMG Client Application Internal Name	FwcAppInternalName	fwc-app-internal-name	Forefront TMG Client Application Internal Name.
37	Forefront TMG Client Application Product Name	FwcAppProductName	fwc-app-product-name	Gets the product name of the client application.
38	Forefront TMG Client Application Product Version	FwcAppProductVersion	fwc-app-product-version	Gets the product version of the client application.
39	Forefront TMG Client Application File Version	FwcAppFileVersion	fwc-app-file-vrsion	Gets the file version of the client application.
40	Forefront TMG Client Application Original File Name	FwcAppOrgFileName	fwc-app-original-file-name	The original name of the client application.
41	Internal Service Info Log Fields	InternalServiceInfo	internal-service-info	Internal
42	NIS Application Protocol	ipsApplicationProtocol	NIS application protocol	The application protocol in which NIS detected the signature.
43	Forefront TMG Client Version	FwcVersion	fwc-version	The version number of the Forefront TMG Clients