Link to home
Start Free TrialLog in
Avatar of pavelmed
pavelmed

asked on

displaying username in websphere access log


There is a Websphrere NCSA access log (Common option) which should have the following layout:
host, rfc931, username, date:time, request, statuscode, bytes

I see a real access log file where the username is not displayed and "-" in displayed instead.

How can I enable displaying the username in the access log?
Avatar of pavelmed
pavelmed

ASKER

So the actual layout looks like this (exxept there are no commas.  I added them here just to separate the fields in this message.
host, -, -, date:time, request, statuscode, bytes.

I need to analyze the access, so basically I need: username, date:time, request.

date:time and request are present in the actual log file, but I need username as well.

Please assist.
Avatar of Gary Patterson, CISSP
Username is only populated in the NCSA log if HTTP Basic User authentication is used.  Since you're getting "-", t probably means that HTTP basic authentication isn't being used.

What WAS version are you using, and what authentication mechanism is in use for this application?

- Gary Patterson
Thank you for your answer.
I am not connected to that server now and I can't check the WAS version, but the authentication is definitely not HTTP basic.  So that's explains the "-" in the log file.

Then the question is: how to get username.
One option would be to enable "combined" mode with cookies which would contain user id.
However I checked a configuration file on that WAS server, and while it has a commented out option (see below), it does not specify cookies.
How should I add cookies to the log?
Is it done just by adding \"%{Cookies}i\" to the LogFormat statement (similar to "Referer")?
Also, if yes, how to refresh WAS settings (after uncommenting the statements, of course)?  
Should the WebSphere be stopped and restarted fro the log file options changes to take effect?
Thank you.

#LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
#CustomLog logs/combined.log combined
ASKER CERTIFIED SOLUTION
Avatar of Gary Patterson, CISSP
Gary Patterson, CISSP
Flag of United States of America image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Sorry for the delay - I could not get a chance to login to the WAS to check how the access log would work.
Today I got the connection, and made the changes inserting cookies into the access.log file - the cookies were inserted, but I can't use them because the info in cookies is encrypted because of SSL transaction, and I can't extract the username from there.

Are there any other ways to force WAS access log to log usernames so that they could be extracted from the access.log file?
how are you trying to view the access.log, are you bringing it into ISA workbench and trying to analyze or are you trying to parse the data?  
Are you running windows or unix?
If you can go to your <websphere>/bin directory and run the versionInfo.bat for win and ./versionInfo.sh for unix.  Let me know if you 6.1 or 7.0  so I know the Access Log filter set to suggest.  There are filter sets you can use:
    * What was requested
    * When it was requested
    * Who requested it
    * The method of the request
    * The type of file that your server sent in response to the request
    * The return code, which indicates whether or not the request was successful
    * The size of the data that was sent
I believe your looking for the "WHO" part.
I am closing this question.  I was unable to get the username from the access.log file because it is not passed to it, the log file only has "-" in place of it,  The authentication is done by another program.
I am running UNIX.

I am assigning points to Gary.  Thanks to all who looked into the question.