<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE lire:dlf-schema PUBLIC
  "-//LogReport.ORG//DTD Lire DLF Schema Markup Language V1.0//EN"
  "http://www.logreport.org/LDSML/1.0/ldsml.dtd">
<lire:dlf-schema superservice="proxy" timestamp="time"
 xmlns:lire="http://www.logreport.org/LDSML/">

 <!-- $Id: proxy.xml,v 1.13 2002/08/15 21:08:49 vanbaal Exp $ -->

 <lire:title>DLF Schema for Proxy superservice</lire:title>
 <lire:description>
  <para>This DLF file is adequate to represent most common
   informations about web proxy events. It has the same information
   as found in most proxy-like servers log files.

 <!-- as discussed in 
   Date: Wed, 9 Jan 2002 16:58:24 -0500
   From: "Francis J. Lacoste" XXX
   To: development XXX
   Subject: PROPOSAL: schema for proxy superservice
   Message-ID: <20020109215824.GX566@Contre.COM>
 -->
  </para>
  <para>This schema is adequate for proxy servers beyond web proxys
   servers. It can be used for socks and other types of
   connection-level proxies. 
  </para>

  <para>The DLF schema was designed by studying the WebTrends Enhanced
   Log Format, squid log files and thinking about SOCKS type of server.
  </para>
 </lire:description>

 <lire:field name="time" type="timestamp">
  <lire:description>
   <para>The time at which the request was initiated.</para>
  </lire:description>
 </lire:field>

 <lire:field name="client_ip" type="ip">
  <lire:description>
   <para>The IP address of the client.</para>
  </lire:description>
 </lire:field>

 <lire:field name="client_host" type="hostname">
  <lire:description>
   <para>The hostname of the client.
   </para>
  </lire:description>
 </lire:field>

 <lire:field name="user" type="string">
  <lire:description>
   <para>If the client was authenticated, this field should contains
   the authenticated username.</para>
  </lire:description>
 </lire:field>

 <lire:field name="duration" type="duration">
  <lire:description>
   <para>The time taken by the connection.</para>
  </lire:description>
 </lire:field>

 <lire:field name="cache_result" type="string">
  <lire:description>
   <para>Result code for the cache TCP_MISS, TCP_HIT, etc.  List is available
    on Squid page, and in squid_access2dlf(1). All DLF converter should map
    their native value to the squid's one which is very complete and
    exhaustive. 
   </para>
  </lire:description>
 </lire:field>

 <lire:field name="req_result" type="int" default="-">
  <lire:description>
   <para>HTTP result of the request. e.g. 200 or 404.</para>
  </lire:description>
 </lire:field>

 <lire:field name="protocol" type="string">
  <lire:description>
   <para>The protocol of the proxied request: ftp, http, https, telnet, etc.</para>
  </lire:description>
 </lire:field>

 <lire:field name="transport" type="string">
  <lire:description>
   <para>The protocol used between the client and the proxy server.
    This is probably TCP, but can be UDP in some case (like SOCKS or ICP).
   </para>
  </lire:description>
 </lire:field>

 <lire:field name="dst_ip" type="ip">
  <lire:description>
   <para>The ip address of the destination.</para>
  </lire:description>
 </lire:field>

 <lire:field name="dst_host" type="hostname">
  <lire:description>
   <para>The hostname of the destination. In the case of web proxy,
    that will be the website</para>
  </lire:description>
 </lire:field>

 <lire:field name="dst_port" type="port">
  <lire:description>
   <para>Port of the destination used in IP session</para>
  </lire:description>
 </lire:field>

 <lire:field name="operation" type="string">
  <lire:description>
   <para>This field should only be defined in the case of web proxy
    requests. This should contains the HTTP method requested like
    <literal>GET</literal> or <literal>POST</literal>.
   </para>
  </lire:description>
 </lire:field>

 <lire:field name="requested_url" type="url">
  <lire:description>
   <para>This field should only be defined in the case of web proxy
   request. It should contains the URL requested on the remote server.</para>
  </lire:description>
 </lire:field>

 <!-- <lire:field name="bytes" type="bytes" default="0"> has the same effect
   as: -->
 <lire:field name="bytes" type="bytes">
  <lire:description>
   <para>The number of bytes transferred from proxy server to the
   client</para>
  </lire:description>
 </lire:field>

 <lire:field name="type" type="string">
  <lire:description>
   <para>This field should only be defined for web proxy servers, it
   should contains the MIME type of the HTTP request's result (e.g.
   text/html or image/jpeg).</para>
  </lire:description>
 </lire:field>

 <lire:field name="rule" type="string">
  <lire:description>
   <para>This field contains the configuration rule's name that was
    used to accept or deny to request.
   </para>
  </lire:description>
 </lire:field>

 <lire:field name="useragent" type="string">
  <lire:description>
   <para>The useragent used by the client. E.g. 'Mozilla/4.0
(compatible; MSIE 5.0; Win32)' or 'Outlook Express/5.0 (MSIE 5.0;
Windows 98; DigExt)'</para>
  </lire:description>
 </lire:field>

 <lire:field name="result_src_code" type="string">
  <lire:description>
   <para>Code qualifying the next two fields. (i.e. NONE, DIRECT,
    PARENT_HIT, etc.) All DLF converter should map their native value
    to the squid's one which is very complete and exhaustive.

<!-- This and all following result_ fields are used in the case of
    cache. The result src is from where the object was fetched (local
    cache, parent cache, peer cache, original host, etc.) -->

</para>
  </lire:description>
 </lire:field>

 <lire:field name="result_src_ip" type="ip">
  <lire:description>
   <para>The IP address of the server which handled the request, i.e.
     destination or other cache</para>
  </lire:description>
 </lire:field>

 <lire:field name="result_src_host" type="hostname">
  <lire:description>
   <para>The hostname of the server that handled the request and gave the
     result.</para>
  </lire:description>
 </lire:field>

 <lire:field name="result_src_port" type="port">
  <lire:description>
   <para>Port on referring host used in IP session.</para>
  </lire:description>
 </lire:field>

 <lire:field name="cat_action" type="string" default="-">
  <lire:description>
   <para>This field contains either the value
    <constant>block</constant> or <constant>pass</constant>. It is
    used when access control is based on content filtering.
   </para>
  </lire:description>
 </lire:field>

 <lire:field name="cat_site" type="string">
  <lire:description>
   <para>If the proxy server is doing content analysis, this field
    should contains the category for the requested website.
   </para>
  </lire:description>
 </lire:field>

 <lire:field name="catlevel_site" type="int" default="-">
  <lire:description>
   <para>Level can be 1 or 2. 1 meaning "no no" categories. 2 meaning
    "family fun" categories. This was taken from the WELF specification.
   </para>
  </lire:description>
 </lire:field>

 <lire:field name="cat_page" type="string">
  <lire:description>
   <para>Like <structfield>cat_site</structfield>, but for the actual
    page.</para>
  </lire:description>
 </lire:field>

 <lire:field name="catlevel_page" type="int" default="-">
  <lire:description>
   <para>Like <structfield>catlevel_site</structfield>, but for the
    actual page.</para>
  </lire:description>
 </lire:field>

</lire:dlf-schema>

