Internet Gatekeeper information logs

The information in this article applies to F-Secure Internet Gatekeeper version 5.x and later.

Note: Bracketed strings indicate fields that vary from message to message. Brackets ('<' and '>') are not actually printed as part of messages; they are included below for clarity only.

Table 1. Messages at service startup
Message	Description
DEBUG [<Location>] ### START ###(argv=[<Proxy commandline>],ver=[<Version>])	A message which indicates the start of a service. The message is displayed when a service is started.
DEBUG [<Location>] main: entering daemon mode. (daemon pid=<Process id>)	A message which indicates that daemon mode is used. The message is displayed when a service is started.
DEBUG [<Location>] Starting to accept connection on each proxy process.	A message which indicates the start of a proxy process. The message is displayed when a service is started.

Table 2. Messages at service stoppage
Message	Description
DEBUG [<Location>] ### STOP ### (ver=[<Version>])	A message which indicates the end of a service. The message is displayed when a service is stopped.
DEBUG [<Location>] signal_handler(sig=15[SIGTERM], errno=0, code=0[SI_USER], status=0[], pid=<Process Id>, uid=0)/cur_pid=<Process Id>	A message which indicates that the SIGTERM signal of a proxy process has been received. The message is displayed when a service is stopped.

Table 3. Messages while the service is active
Message	Description
DEBUG [<Location>] Client closed connection. Client maybe canceled the session. URL=[<URL>], elapsed=<Time>ms	Is displayed when a client closes a connection before the normal protocol process finishes. The message may appear when a client cancels a session. <Time> represents the elapsed time since the monitoring session started.
DEBUG [<Location>] recv=<Error message>(<Error code>) Client closed connection. Client maybe canceled the session. URL=[<URL>], elapsed=<Time>ms	Is displayed when a client closes a connection before the normal protocol process finishes. The message may appear when a client cancels a session. <Time> represents the elapsed time since the monitoring session started.
DEBUG [<Location>] select=<Error message>(<Error code>)select(s=<Id>): Server closed connection during transaction. There may be a timeout on the server because of no traffic. (elapsed time=<Time>ms)	Is displayed when a server closes a connection before the normal protocol process finishes. This message may appear when a session timeout occurs on the server side. <Time> represents the elapsed time since the monitoring session started.
DEBUG [<Location>] sendfile canceled: n=<Return code>, written=<Bytes written>, filelen=<File length> writesize=<Count> errno=<Error code>(<Error string>)	Is displayed when a file transfer to a client or server is canceled. <Return code> represents the response code of the sendfile system call. <Bytes written> represents the size of the sent file. <File length> represents the file size. <Count> represents the data size being transferred.
DEBUG [<Location>] CONNECT(<Host>:<Port>)/hostname lookup: <Error String>	A reverse lookup error occurred when trying to get the address <Host>.
DEBUG [<Location>] sendfile canceled: ret=<Return code>, tmpfile_offset=<Offset>, bytes=<File size> errno=<Error code>(<Error string>)	The product uses trickle functions when relaying to clients. This message is displayed when file relays are canceled. <Return code> represents the response code of the sendfile system call. <Offset> represents the number of bytes before the transfer. <File size> represents the file size.
DEBUG [<Location>] fread=<Error string>(<Error code>) file uploading is interrupted by client.	Is displayed when a file upload that uses the HTTP service (from a client to the product) is canceled.
DEBUG [<Location>] From: <Client Host>:<Client Port>(<Mail From>) To: <Server Host>:<Server Port>(<Mail Rcpt>) Message-Id: <Id> Infected: <Code> VirusName: <Name>	Using the SMTP service, a mail that contains "From: Client address: From Client port (sender address)", "To: Server address: To server port (Recipient address), "Message-Id: Message ID" is sent. The scan results are "Infected: Scan results (detection found when not 0)" and "Virusname: Virus name".
DEBUG [<Location>] ERROR Reply(DATAEND): url=[<Rcpt>] buf=[<Reply>]	The mail server returned the error code <Reply>. This happened when the mail server was sending a mail to <Rcpt> with the DATA command by using the SMTP service.
DEBUG [<Location>] Access Denied from [<Address>:<Hostname>]	Access was denied because access restrictions are enabled and the corresponding server was not found in the list of connections.
DEBUG [<Location>] Access Denied to [<Address>:<Hostname>]	Access was denied because access restrictions are enabled and the corresponding server was not found in the list of connections.
DEBUG [<Location>] read extra CRLF for POST method	When sending data with the POST method in Internet Explorer, an unneeded CRLF is normally added. This message appears when the unneeded CRLF code is removed. The product can work properly even if this message appears.
DEBUG [<Location>] ERROR Reply(<SMTP command>) url=[<URL>] buf=[<Reply>]	Is displayed when an error response is returned against the command sent to the SMTP server using the SMTP service. A response message is included in buff-xxx. The command name (DATAEND represents the body of the mail sent) is indicated in parenthesis.