Response.StatusCode originating from Server or Gateway?

[holger_haas]

Hello Community,

in the logs, "Response.StatusCode" normally contains the HTTP status code that the MWG receives from the webserver.

But in some cases, e.g. authentication failure, it contains an HTTP status code that is returned by the web gateway itself.

How can I determine which origin returned the error code, if I only have the logs at hand (No troubleshooting in WebUI etc.)?

Thank you and best regards,

Holger

[aloksard · Accepted solution]

Hi Holger,

Hope you are doing well.

Say for any URL for which only request cycle was evaluated, say for a site which was blocked on MWG  or authentication request , in this case connection to destination server will not be their and MWG is the only one to set status code in logging

 In this case we have no response from the server, only the response that MWG generated

[07/Nov/2018:17:31:11 +0000] "" 172.19.212.56 403 "GET https://www.youtube.com/watch?v=p6Z1pHKJofQ&pbj=1 HTTP/2.0" "" "-" "" 3684 175 "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36" "" "0" ""

403 response code means request is  blocked by MWG.  

[18/Apr/2012:12:00:42+0000] "" *.*.*.* 407 "CONNECT https://licensing.services.sage.comHTTP/1.1" "" "-" "" 2812 """" "0"

407 means that MWG wants this request authenticated

Logging is a dedicated cycle, it always comes last.  

So basically response.code  can be either generated by MWG or actual destination server when you execute it in the logging cycle.

You can easily see it if you have a virus file. Response code will be 403, while the server would have send 200.

Say for example when a user requested for URL www.google.com, the request cme on MWG , it went through all rules  and is allowed, so in this case a connection will be made form MWG to destination server and a response cycle will be triggered wherein you will see 200 response code from server to MWG if everything was fine at server end.

The Logging Cycle kicks off after the Request, Response and all Embedded cycles have completed -- allowing you to write to log files.

https://community.mcafee.com/t5/Documents/Web-Gateway-Understanding-the-Rule-Engine-and-Optimizing-y...

Regards

Alok Sarda

[holger_haas]

Hello Alok,

thank you for your comprehensive answer. I understand it to mean that there is no way to get the orginial server response code into the logs, because Response.StatusCode contains the "last" value after all cycles (Request, Response, Embedded).

Or is there a way to "cache" the server response code in a user-defined variable and write it additionally to the logs?

Best Regards,

Holger

[aloksard · Accepted solution]

Hi Holgar,

Hope you are doing well.

If you want to make sure to get the status code from the server, then you can try creating  a rule for the same and store it in a user defined property  and check.

Regards

Alok Sarda