Skip to content

Commit 170b012

Browse files
v-ccolinv-ccolin
authored
Merge pull request #218711 from jaesoni/clientip-appgw-logs
Updating clientIP description
2 parents 6e51a57 + 615f053 commit 170b012

File tree

1 file changed

+47
-46
lines changed

1 file changed

+47
-46
lines changed

‎articles/application-gateway/application-gateway-diagnostics.md

Lines changed: 47 additions & 46 deletions
Original file line numberDiff line numberDiff line change
@@ -155,57 +155,12 @@ Azure generates the activity log by default. The logs are preserved for 90 days
155155
156156
The access log is generated only if you've enabled it on each Application Gateway instance, as detailed in the preceding steps. The data is stored in the storage account that you specified when you enabled the logging. Each access of Application Gateway is logged in JSON format as shown below.
157157
158-
#### For Application Gateway Standard and WAF SKU (v1)
159-
160-
|Value |Description |
161-
|---------|---------|
162-
|instanceId | Application Gateway instance that served the request. |
163-
|clientIP | Originating IP for the request. |
164-
|clientPort | Originating port for the request. |
165-
|httpMethod | HTTP method used by the request. |
166-
|requestUri | URI of the received request. |
167-
|RequestQuery | **Server-Routed**: Backend pool instance that was sent the request.</br>**X-AzureApplicationGateway-LOG-ID**: Correlation ID used for the request. It can be used to troubleshoot traffic issues on the backend servers. </br>**SERVER-STATUS**: HTTP response code that Application Gateway received from the back end. |
168-
|UserAgent | User agent from the HTTP request header. |
169-
|httpStatus | HTTP status code returned to the client from Application Gateway. |
170-
|httpVersion | HTTP version of the request. |
171-
|receivedBytes | Size of packet received, in bytes. |
172-
|sentBytes| Size of packet sent, in bytes.|
173-
|timeTaken| Length of time (in milliseconds) that it takes for a request to be processed and its response to be sent. This is calculated as the interval from the time when Application Gateway receives the first byte of an HTTP request to the time when the response send operation finishes. It's important to note that the Time-Taken field usually includes the time that the request and response packets are traveling over the network. |
174-
|sslEnabled| Whether communication to the backend pools used TLS/SSL. Valid values are on and off.|
175-
|host| The hostname with which the request has been sent to the backend server. If backend hostname is being overridden, this name will reflect that.|
176-
|originalHost| The hostname with which the request was received by the Application Gateway from the client.|
177-
178-
```json
179-
{
180-
"resourceId": "/SUBSCRIPTIONS/{subscriptionId}/RESOURCEGROUPS/PEERINGTEST/PROVIDERS/MICROSOFT.NETWORK/APPLICATIONGATEWAYS/{applicationGatewayName}",
181-
"operationName": "ApplicationGatewayAccess",
182-
"time": "2017-04-26T19:27:38Z",
183-
"category": "ApplicationGatewayAccessLog",
184-
"properties": {
185-
"instanceId": "ApplicationGatewayRole_IN_0",
186-
"clientIP": "191.96.249.97",
187-
"clientPort": 46886,
188-
"httpMethod": "GET",
189-
"requestUri": "/phpmyadmin/scripts/setup.php",
190-
"requestQuery": "X-AzureApplicationGateway-CACHE-HIT=0&SERVER-ROUTED=10.4.0.4&X-AzureApplicationGateway-LOG-ID=874f1f0f-6807-41c9-b7bc-f3cfa74aa0b1&SERVER-STATUS=404",
191-
"userAgent": "-",
192-
"httpStatus": 404,
193-
"httpVersion": "HTTP/1.0",
194-
"receivedBytes": 65,
195-
"sentBytes": 553,
196-
"timeTaken": 205,
197-
"sslEnabled": "off",
198-
"host": "www.contoso.com",
199-
"originalHost": "www.contoso.com"
200-
}
201-
}
202-
```
203158
#### For Application Gateway and WAF v2 SKU
204159
205160
|Value |Description |
206161
|---------|---------|
207162
|instanceId | Application Gateway instance that served the request. |
208-
|clientIP | Originating IP for the request. |
163+
|clientIP | IP of the immediate client of Application Gateway. If another proxy fronts your application gateway, this displays the IP of that fronting proxy. |
209164
|httpMethod | HTTP method used by the request. |
210165
|requestUri | URI of the received request. |
211166
|UserAgent | User agent from the HTTP request header. |
@@ -273,6 +228,52 @@ The access log is generated only if you've enabled it on each Application Gatewa
273228
> [!Note]
274229
>Access logs with clientIP value 127.0.0.1 originate from an internal security process running on the application gateway instances. You can safely ignore these log entries.
275230
231+
#### For Application Gateway Standard and WAF SKU (v1)
232+
233+
|Value |Description |
234+
|---------|---------|
235+
|instanceId | Application Gateway instance that served the request. |
236+
|clientIP | Originating IP for the request. |
237+
|clientPort | Originating port for the request. |
238+
|httpMethod | HTTP method used by the request. |
239+
|requestUri | URI of the received request. |
240+
|RequestQuery | **Server-Routed**: Backend pool instance that was sent the request.</br>**X-AzureApplicationGateway-LOG-ID**: Correlation ID used for the request. It can be used to troubleshoot traffic issues on the backend servers. </br>**SERVER-STATUS**: HTTP response code that Application Gateway received from the back end. |
241+
|UserAgent | User agent from the HTTP request header. |
242+
|httpStatus | HTTP status code returned to the client from Application Gateway. |
243+
|httpVersion | HTTP version of the request. |
244+
|receivedBytes | Size of packet received, in bytes. |
245+
|sentBytes| Size of packet sent, in bytes.|
246+
|timeTaken| Length of time (in milliseconds) that it takes for a request to be processed and its response to be sent. This is calculated as the interval from the time when Application Gateway receives the first byte of an HTTP request to the time when the response send operation finishes. It's important to note that the Time-Taken field usually includes the time that the request and response packets are traveling over the network. |
247+
|sslEnabled| Whether communication to the backend pools used TLS/SSL. Valid values are on and off.|
248+
|host| The hostname with which the request has been sent to the backend server. If backend hostname is being overridden, this name will reflect that.|
249+
|originalHost| The hostname with which the request was received by the Application Gateway from the client.|
250+
251+
```json
252+
{
253+
"resourceId": "/SUBSCRIPTIONS/{subscriptionId}/RESOURCEGROUPS/PEERINGTEST/PROVIDERS/MICROSOFT.NETWORK/APPLICATIONGATEWAYS/{applicationGatewayName}",
254+
"operationName": "ApplicationGatewayAccess",
255+
"time": "2017-04-26T19:27:38Z",
256+
"category": "ApplicationGatewayAccessLog",
257+
"properties": {
258+
"instanceId": "ApplicationGatewayRole_IN_0",
259+
"clientIP": "191.96.249.97",
260+
"clientPort": 46886,
261+
"httpMethod": "GET",
262+
"requestUri": "/phpmyadmin/scripts/setup.php",
263+
"requestQuery": "X-AzureApplicationGateway-CACHE-HIT=0&SERVER-ROUTED=10.4.0.4&X-AzureApplicationGateway-LOG-ID=874f1f0f-6807-41c9-b7bc-f3cfa74aa0b1&SERVER-STATUS=404",
264+
"userAgent": "-",
265+
"httpStatus": 404,
266+
"httpVersion": "HTTP/1.0",
267+
"receivedBytes": 65,
268+
"sentBytes": 553,
269+
"timeTaken": 205,
270+
"sslEnabled": "off",
271+
"host": "www.contoso.com",
272+
"originalHost": "www.contoso.com"
273+
}
274+
}
275+
```
276+
276277
### Performance log
277278

278279
The performance log is generated only if you have enabled it on each Application Gateway instance, as detailed in the preceding steps. The data is stored in the storage account that you specified when you enabled the logging. The performance log data is generated in 1-minute intervals. It is available only for the v1 SKU. For the v2 SKU, use [Metrics](application-gateway-metrics.md) for performance data. The following data is logged:

0 commit comments

Comments
 (0)