When Sending Session Logs from SSL Visibility to a Remote Syslog Server, What do the Fields Mean?

Products

• SSL Visibility Appliance Software

Issue/Introduction

What do the field mappings when sending logs to a Remote Syslog server equate to.
 

Resolution

When sending Session Logs from the SSL Visibility appliance to a remote syslog server, the format is as follows.

Dec 15 11:09:55 SSLV3800 ssldata[3934]: [A:81000064] 1450195794 10.2.3.4:49307 -> 10.5.6.7:443 TLS1.0 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA www.google.com rule:6 resign Success(0x0)
 

Field	Description
Dec 15 11:09:55	System time
SSLV3800	Hostname
ssldata[3934]:	Process[Process ID]
[A:81000064]	[Segment:SSLV Flow ID]
1450195794	Display Time (Unix Timestamp)
10.2.3.4:49307	SrcIP:SrcPort
10.5.6.7:443	DstIP:DstPort
TLS1.0	SSL/TLS Version
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA	Cipher Suite
www.google.com	Domain Name
rule:6	Rule Match Index
resign	Action
Success(0x0)	Message/Error(Hex Value)

Two additional fields; matched category and certificate fingerprint have also been added. 

Example syslog entry:

Sep 14 12:22:19 sslv-hostname Sep 14 12:22:19 hostname ssldata[4256]: [A:86161d82] 1473870139 10.2.3.4:4824 -> 10.5.6.7:443 TLS1.2 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 www.gambling.com Gambling cert fp: xx:xx:xx:xx:xx:xx:xx:50:3f:dd: xx:xx:xx:xx:xx:xx:xx:xx:11 rule:1 cut Success(0x0)

Matched category is 'Gambling'.
Certificate fingerprint is 'cert fp: xx:xx:xx:xx:xx:xx:xx:50:3f:dd: xx:xx:xx:xx:xx:xx:xx:xx:11'