Log files overview

Add the Audit directive

Adding the Audit directive to your config.txt file will command EZproxy to create audit logs when specified events occur and save these files in the EZproxy installation directory. Individual files will be named the year, month, and day that the event occurred (e.g. 20140512.txt). The most common use of the Audit directive to command EZproxy to create audit logs is as follows:

Audit Most

This directive statement will create a log when any of the following events occur:

• A user is denied accessed EZproxy
• A user successfully logs in to EZproxy
• A user has a failed attempt to log in to EZproxy
• An intrusion attempt based on the IntruderIPAttempts or IntruderUserAttempts directive occurs
• General system activities, such as system startup, occur
• An unauthorized user attempts to access the administrative features of EZproxy
• An event resulting from the UsageLimit directive occurs

This is the default configuration in the config.txt file that is downloaded with EZproxy. For more details about further customization of the audit logs, see Audit.

Audit logs can be accessed from the EZproxy admin page at any time. Logs that have been purged as a result of the AuditPurge directive will not be accessible.

Suggested configuration

By retaining the default Audit Most directive statement in your config.txt file, you will have the most commonly assessed security events recorded to your audit logs. To limit the amount of storage space your audit logs take up, the AuditPurge directive is also configured by default to 7 following the Audit statement so EZproxy will delete files after a specified period of time. This will keep only the audit logs for the current day plus the previous week and delete any files older than 7 days. OCLC suggests increasing the AuditPurge time period to 180, so that your config.txt file looks as follows:

Audit Most
AuditPurge 180

This change to the AuditPurge directive will cause EZproxy to retain the audit file for the current day plus the audit files of the previous 180 days, and delete any file older than 180 days. Retaining audit files for longer periods of time will provide you with a larger pool of information for review if you should need to access it. You can increase or decrease the purge number as you see fit to save disc space or ensure that you have the data you need should reporting requests or a security breach require you to reference it. When determining how long to set your AuditPurge, consult with your IT department to ensure that your retention schedule complies with institutional policies for security and reporting purposes.

Ezproxy.log

EZproxy will automatically generate EZproxy logs and save them in a file named ezproxy.log in the directory where EZproxy is installed. The default command used to format data collected in the EZproxy log is as follows:

LogFormat %h %l %u %t “%r” %s %b

This will generate the following data in your EZproxy log:

132.174.1.1 - - [14 /Mar/2014:09:39:18 -0700] “GET http://www.somedb.com:80/index.html HTTP/1.0” 200 1234

The following table breaks down this line of data:

 Note: If EZproxy is not able to collect the data denoted by a particular field, it will insert a dash for the missing information.

For more details about these and additional fields that can be used to further customize this directive, see LogFormat.

Suggested configuration

The default configuration in the standalone EZproxy config.txt file will provide you with monthly log files that contain data about all data transfers and requests sent through your instance of EZproxy. Depending on use levels, you might want to configure EZproxy to maintain daily instead of monthly log files so you can more quickly identify the location of the information you may need by date. This suggested configuration does not contain any LogFilters, but you may also want to consider whether the inclusion of filters to limit the volume of data collected would make your EZproxy logs more manageable and provide more focused information. See LogFilter for more details about this option. The following configuration will change your EZproxy logs to daily files instead of monthly:

LogFormat %h %l %u %t "%r" %s %b
LogFile -strftime ezp%Y%m%d.log

messages.txt

EZproxy will automatically generate messages.txt logs and save them in files of the same name in the EZproxy installation directory. While there are fewer dedicated directives to customize the information recorded in messages.txt, many directives used to set maximum limits will record information to messages.txt when these limits are reached. A list of the directives that record this type of information can be found in the Related Directives tab, and clicking the link will provide you with additional information.

The data contained in the messages.txt file, will look similar to the following when you start or restart your instance of EZproxy, if you have no errors:

2018-01-12 12:41:07 EZproxy 5.7.42 GA [SOURCE:5.7.41_SOURCE] [Windows] [2017-06-26T19:46:13Z]
2018-01-12 12:41:07 For further information or updates, visit http://www.oclc.org/ezproxy/ or contact ezproxy@oclc.org.
2018-01-12 12:41:07 MaxVirtualHost (MV) changed from 200 to 1000
2018-01-12 12:41:07 Server name localhost
2018-01-12 12:41:07 The use of a server name with no periods will cause some databases to fail.
2018-01-12 12:41:07 Server http URL http://localhost:2048
2018-01-12 12:41:07 Proxy by port
2018-01-12 12:41:07 SSL is not configured so https proxying will not be available
2018-01-12 12:41:07 To configure EZproxy as a service that runs in the background and
2018-01-12 12:41:07 starts when this system is booted, press CTRL/C and issue the commands:
2018-01-12 12:41:07      C:\ezproxy\ezproxy.exe -si
2018-01-12 12:41:07      net start EZproxy
2018-01-12 12:41:07 You may not see any additional messages, but EZproxy is running.
2018-01-12 12:41:07 If you press CTRL/C or close this window, EZproxy will stop running.
2018-01-12 12:41:07 Thank you for your purchase of this licensed copy of EZproxy.
2018-01-12 12:41:07 EZproxy was last able to validate the license on 2018-01-12 12:41:07.
2018-01-12 12:45:53 Guardian starting EZproxy

Much of the data in messages.txt is written in a message format to convey to you details about or problems with your config.txt or user.txt that may prevent your EZproxy from working. If you have made changes to configurations in either of these files, but EZproxy is not behaving as expected, messages.txt is a good place to check to determine if any of those changes were entered incorrectly and caused the error.

Suggested configuration

As with the other log file configurations, OCLC suggests that you rename the messages.txt files to rotate daily so your information is retained in logs named with the date. This will make it easier to identify the location of information you might need by date. Enter the following line as the first line of your messages.txt file to create messages logs named with the year, month, and day on which they are created:

MessagesFile -strftime messages-%Y-%m-%d.txt

Spu.log

Adding the LogSPU directive to your config.txt file will provide you with data to determine which starting point URL’s remote users have accessed. Adding additional configuration fields, the same used in LogFormat, allows you to refine the information recorded along with each starting point URL and include data such as date and time accessed and user group.

There is no default for LogSPU in the config.txt file you download with EZproxy, so you must determine which information you would like to gather in this log before you add it to your config.txt file. You can customize your spu.log using the same fields accepted by the LogFormat directive.

Suggested configuration

OCLC suggests, and implements for Hosted EZproxy sites, the following LogSPU configuration:

LogSPU -strftime spu%Y%m%d.log %{%Y/%m/%d:%H:%M:%S}t %h %u %{ezproxy-spuaccess}i %v %U

This configuration will provide you with the following information:

This will provide information to help you determine which resources are accessed most frequently and by whom. While this information can be useful for making collection decisions, we suggest that you also configure your ezproxy.log to record additional data that could be valuable in assessing your remote patrons’ use of proxied resources because the spu.log will contain only information about the user’s first access to a resource, not what additional information they access while at that URL.