Unable to find Policy ID Access log

Products

• ProxySG Software - SGOS
• Reporter

Issue/Introduction

Trying to optimize our Policy Rules Set.

While doing that, we are looking for the unused rules at our policy set.

Policy ID's are added to all of the rules. So, the plan is check our logs and find unused rules at Reporter.

After adding the Policy ID information at our log format with this kb.

How to use Policy ID with access logs

After checking the full detail log at reporter, the Policy ID column at Full Log Details isn't seen.

 

Environment

SG/ASG/ISG

Resolution

With policy ID set in policy, the ID will be visible in all policy traces and access logs associated with requests matching the rule. This is very useful for identifying how frequently certain rules are used, and can aid in improving policy.

To view the ID in access logs, include the x-bluecoat-reference-id field in the access log format. 

Additionally, to find which policy rules are being used, on ProxySG, please, utilize the "policy coverage" feature. For requisite guidance on how this feature cab be enabled and also used, references have been made to the Tech. Articles with the URLs below.

Enabling and Disabling Policy Coverage

How can I find which policy rules are being used?

Note: First check to ensure the policy ID is seen in the policy trace, then you can be sure that the policy has got a policy ID linked with it. With this, you should find the policy ID in the access logs, not in Reporter. The referenced article did not make a mention of finding the policy ID in Reports generated from Reporter. It should be found in the policy trace and in the access log.