Wavecrest Computing — Internet Filtering and Reporting Products
Blue Coat ProxySG
Cyfin Reporter is 100 percent compatible with Blue Coat appliances. Cyfin reads Blue Coat logfiles wherever they're stored, and processes the data into a variety of useful reports.
Cyfin is installed on a server and not the Blue Coat appliance
Logfile Setup
To ensure compatibility, please consider the following:
- Logfile Format. Cyfin supports logfile formats Squid, Common, and W3C. Make sure your appliance is configured to one of these formats. Please note also that regardless of format, Cyfin requires certain logfile fields as a minimum. By default, logfile formats Squid and Common automatically contain all the required fields. On the other hand, W3C most likely will not contain all the required fields. In this case you may need to add one or more fields.
- FTP Arrangements. If your logfiles are currently being FTP'd, please determine the destination server/directory. If you plan to install Cyfin on that server where Blue Coat logfiles reside, no further action is needed. If not, use your Blue Coat Management Console to configure your logs to be scheduled for FTP transfer to the server Cyfin is installed on. Note: The Cyfin default directory for Blue Coat logfiles is C:\Bluecoat\logs, but it can be easily changed.
NOTE: Wavecrest highly recommends using the Squid logfile format if possible. The W3C format routinely changes, and thus support of that format can be intermittent.
Configuration Notes
Follow these simple instructions.
- Installation. Install Cyfin on the previously identified server (see diagram above)
- Cyfin Logfile Configuration. Configure the following settings under Logfiles -> Setup in your Cyfin browser interface:
- Type of proxy/firewall (Blue Coat SGOS 3 & 4, or Blue Coat SGOS 2).
- Logfile location. This is the directory to which the logs are FTP'd. The Cyfin default directory is C:\Bluecoat\logs, but you can easily change it.
- Validate logfiles. The logfile configuration process will automatically validate your logfiles. Now you are ready to run reports.
Required Logfile Fields
Squid Log Format CacheOS and SGOS 2.x and 3.x required logfile fields:
- Header Record: NO
- Character Delimiter: SPACE
- Positions:
- User Name = 8
- IP Address = 3
- Date = 1
- Time = contained in date
- Protocol = 6 (CONNECT is for ssl)
- Url = 7
- Result Code = 4
- Size = 5
- Date/Time Formats:
- Milliseconds Format Only
Common Log Format CacheOS and SGOS 2.x and 3.x required logfile fields:
- Header Record: NO
- Character Delimiter: SPACE
- Positions:
- User Name = 3
- IP Address = 1
- Date = 4
- Time = contained in date
- Url = 7
- Result Code = 8
- Size = 9
- Date/Time Formats:
- [D/M/YYYY:HH:MM:SS
- [DD/MM/YYYY:HH:MM:SS
- [D/MM/YYYY:HH:MM:SS
- [DD/M/YYYY:HH:MM:SS
W3C Log Format CacheOS and SGOS 2.x required logfile fields:
- date
- time
- c-ip
- cs-method
- cs-host
- cs-uri-stem
- sc-status
- cs-username
- sc-bytes
W3C Log Format SGOS 3 & 4 required logfile fields:
- date
- time
- c-ip
- cs-method
- cs-uri-stem
- sc-status
- cs-username
- sc-bytes