Multiple log rewrite directives for the same field show unexpected behaviour


<< Back to Knowledge Search

Solution

Overview

For whichever reason, you want to rewrite the same log field multiple times in multiple proxy layers. You observe however that, contrary to how policy evaluation takes place, only the first rewrite is performed - subsequent rewrites are ignored.

Cause
Resolution

This is by design. Only the first (matching) rewrite will be performed. If you must perform multiple (identical in terms of the action) rewrites you should do them all on a single layer, starting with the most restrictive condition and ending in the least restrictive condition.

This is best practice not only for performance reasons but also to prevent log.rewrite rules from interfering with policy decisions.

Workaround
Additional Information
Bug Number
InQuira Doc IdKB5129
Attachment

Article Feedback

Hide Properties
First Published      10/01/2014
Last Modified      10/01/2014
Last Published      10/01/2014
Article Audience
Product      ProxySG
Topic      Access Logging, Installation / Configuration, Log Processing, Policy Management, Reporting
Article Number      000012332
Summary     
Was this helpful?
Comments:
 
Previous MonthNext Month
SunMonTueWedThuFriSat