Reviewing Connection stat entries from WebPrevent_Operation log

Products

• Data Loss Prevention Network Monitor and Prevent for Email and Web

Issue/Introduction

You would like to understand what does the below Connection stat mean:

05/Jan/25:23:35:01:492+0100 [INFO] (ICAP_CONNECTION.1203) Connection stat: REQMOD=0, RESPMOD=0, OPTIONS=0, OTHERS=0.

Environment

16.X

Cause

The connection stat logger for ICAP's request dispatcher logs the number of REQMODs, RESPMODs, OPTIONSs, and LOG methods active, as well as UNDECIDED (pending connections that do not translate to a specific request). The resulting log entries are the poolstatus messages, which are logged asynchronously and based on the dispatching of connections. They have the same format except for adding the UNDECIDED and LOG counts together and calling it "OTHERS".

A specific method count is incremented when the ICAP method is detected by reading the data, and decremented after its responded to. UNDECIDED count is incremented when an ICAP connection is made, and decremented when a request method is determined. When a connection stat log request is triggered, it logs the aggregate number of current REQMOD/RESPMOD/OTHERS connections. The log entries are written asynchronously by the request dispatcher, which runs periodically, and are not created real-time as new connections are received and processed by the NPW. So the occurrence of the log entries depends on when the dispatcher/scheduler is run/checked.

Resolution

• REQMOD - number of active request connections determined as REQMOD during logging the event.
• RESPMOD - number of active response connections determined as RESPMOD during logging the event.
• OTHERS - number of UNDECIDED (including RESPMOD and/or REQMOD) and connections during logging the event.

Additional Information

Throttling occurs when the total (active) connection count (sum of all the types + the undecideds) is greater than the maximum number of connections configured. OTHERS count exceeding the number of requests + backlog means that a detection server is receiving more connections than it is configured to receive, which could cause server overloading.