Show TOC

Setting Up Logging for Inbound RequestsLocate this document in the navigation structure

Context

To get an overview of the load on the ICM and SAP Web Dispatcher, a log file can be created to log access from the Intranet and Internet. Logging of inbound requests is configured with parameter iicm/HTTP/logging_<xx>. The profile parameter has the following syntax:

icm/HTTP/logging_<xx> =  PREFIX=<URL prefix>, LOGFILE=<log file name> [, LOGFORMAT=<format>][, FILTER=<filter>][, MAXSIZEKB=<size in KBytes>] [,
      SWITCHTF=<options>][, FILEWRAP=on][, FLUSH=TRUE|FALSE][, ACTIVE=TRUE|FALSE]

Procedure

  1. Enter a URL prefix for which the log handler is to be called.
    For example, "/"
  2. Enter a name for the log file. The name must be different to the name of the log file for outbound requests. The same log file cannot be used for both inbound and outbound requests. The ICM or SAP Web Dispatcher checks at each restart whether the file specified as the log file exists. If a file with this name exists, it will write in this file. If no file with this name exists, a new file is automatically created with this name. Operating system specifications must be considered when assigning a name. For example, in Windows colons are not permitted in file names. You can add another timestamp to the file name. The options below are available for specifying the log file.

    %d

    Day of the month (1-31)

    %m

    Month (1-12)

    %y

    Year, in the format YYYY

    %h

    Hour (0-23)

    %t

    Minute (0-59)

    %s

    Second (0-59)

    %%

    % character

    Example

    Set LOGFILE as follows to define the file name, a date, and a time:

    LOGFILE=access_log-%d-%m-%y_%h:%t:%s

    This creates a log file with the name:

    access_log-15-10-2007_16:51:53
    Example

    Set LOGFILE as follows if you want a log file to be written for each month.

    LOGFILE=access_log-%y-%m

    This creates a log file with the name:

    access_log-2007-10

The following steps are optional.

  1. Select or define with LOGFORMAT a log format in which entries are written to the log file.
  2. With FILTER enter a filter. The attribute filter has the following syntax: FILTER= {name}type[={value}] [ ; {name}type[={value}] ] .... There are also predefined filters: SAPSMD. with the form {X Correlation ID}i If this predefined filter is set, only those requests that contain the header field X-CorrelationId are logged. The filter is independent of the selected log file format. Specification of a value is optional. If no value is specified, the existence of the field is checked. By preceeeding the name or value of the field with an \, the characters '=', '}', and '\' can be escaped. The attribute filter has the following syntax:
    The filter property specifies that an HTTP request is logged only when a certain header field (for example, an HTTP header field) is in the request or response. A filter can contain the following fields:
    • {name}i[={value}]

      Filter for a request header field, e.g. {X-Correlation-ID}i.

    • {name}o[={value}]

      Filter on a response header field.

    • {name}c[={value}]

      Filter on a request cookie.

    • {name}F[i][={value}]

      Filter on a request form field, e.g.. {color}F={green} or {color}Fi={green} .

    • {name}E[i][={value}]

      Filter on a request semicolon field.

    Note Names of header fields and cookie fields are not case-sensitive. Names of form fields and semicolon fields are case-sensitive, except if an i is specified after the type. The "i" means that the case of the field name is relevant for this filter.
    Example

    The FILTER attribute can, for instance, have the following value:

    FILTER={color}F={green};{color}F={yellow};{size}F

    The HTTP request is then logged if the request contains a form field, color that has the value green or yellow, or if it contains a form field size with any value.

  3. With MAXSIZEKB you can select the maximum size of the log file in kilobytes.
    If this size is exceeded, the current file is closed and a new one (with a new name) is opened. The new file name is unique (this is achieved by specifying time and date fields, see above), or else is made unique by adding _xx to the end (where xx is a number increasing from 0).
    Note If FILEWRAP=on was selected, no new file is opened.
  4. With SWICTHTF you can configure that a new log file is created at the times specified.

    Hour

    A new log file is opened every hour.

    Day

    A new log file is opened every day.

    Month

    A new log file is opened every month.

  5. With FILEWRAP you can configure whether the old log file is overwritten or a new one created.

    If you set FILEWRAP=on, every time a new file is opened (because time or size is exceeded), the existing log file is reset and overwritten. Therefore, there is always only one log file with the current log data.

    If you omit this option, the old log file is not overwritten, and a new one is created.

    Example

    PREFIX=/, LOGFILE=dev_http_access_log, SWITCHTF=day, FILEWRAP=on

  6. With FLUSH you specify whether each HTTP log entry is written directly to the file system, or not. Possible values are TRUE and FALSE. The default value is FALSE, except for LOGFORMAT=SAPSMD and LOGFORMAT=SAPSMD2.
    This option can cause a reduction in performance on slow file systems.
  7. You can specify whether the preceding job must complete successfully or not. Set ACTIVE to TRUE to activate the log handler, or to FALSE to deactivate it. The default value is TRUE.
    Caution The log handler uses the log file to serialize itself, which makes it a bottleneck. It is therefore not usually activated.

Results

For security reasons the following information is hidden (replaced with points) from the logging procedure:

Parts of the URL

;jsessionid

URI parameters in round brackets if they contain the context ID

?...sap-contextid=...

;sap-contextid=

Header fields (case insensitive)

Authorization

sap-password

SAP-R3Auth (RFC logon via HTTP)

Proxy authorization

MYSAPSSO2 (inheritance of the identity via HTTP channel)

Cookies (case sensitive)

sap-contextid

jsessionid

Form fields (case insensitive)

sap-contextid

sap-password

An entry in the log file will then look like:

Example 10.18.200.78 - - [25/May/2004:18:06:57 +0200] "GET /sap(..................)/public/icman/test;jsessionid=...../umu.html?sap-user=saphttp&sap-password=....&test=111 HTTP/1.1" 404 2144