Web application monitoring

The following set of tables can help you monitor different aspects of the web application itself. This may be useful in case you want to have a general overview of the web application’s normal development, extract specific information or identify abnormal situations that might require corrective measures.

Please note that the format of the fields in these tables may vary due to code changes.

1 siem.logtrust.web.activity
2 siem.logtrust.web.navigation
3 siem.logtrust.web.info
4 siem.logtrust.web.error
5 siem.logtrust.web.notification
6 siem.logtrust.collector.counter

siem.logtrust.web.activity

In this table, you can find detailed information about everything that happened in the current domain. You can see below the most relevant fields included in this table along with a brief explanation.

Field	Data type	Description

Field	Data type	Description
level	`str`	Level of importance or urgency of the event INFO → Messages for both end-users and system administrators to indicate the progress of the application WARN → Potentially harmful situations to end-users or system administrators ERROR → Events of great importance that threaten the normal development of the application
domain	`str`	Domain in which the action takes place
userid	`str`	ID associated with the user
username	`str`	User who performed the action
sessionid	`str`	Session in which the action is framed
correlationid	`str`	Unique identifier of the request
srcHost, srcPort	`str, int`	IP address and port from which the connection to Devo is requested
serverHost, serverPort	`str, int`	Server address and port through which the connection to Devo is established
type	`str`	Nature of the task performed
method	`str`	Data transfer method used
url, headers, params	`str`	URL, headers, and parameters of the request
referer	`str`	HTTP header field that identifies the address of the web page requested
userAgent	`str`	Web browser used to access Devo
locale	`str`	Language-variant combination employed by the user
contentLength, responseLength	`int`	Number of data bytes contained in the request from the source and the response from the server
responseTime	`int`	Total amount of time (in milliseconds) it takes to respond to the request
result, resourceInfo, errorInfo	`str`	Result of the request, and info related to the resource and possible errors in the request
country, region, city	`str`	Geographic location of the source connection established by the user
isp, org	`str`	Internet provider

siem.logtrust.web.navigation

In this table, you can find specific information about user activity. It contains a data structure similar to the siem.logtrust.web.activity with the difference that it includes only activity triggered by users and excludes platform and server response. You can see below the most relevant fields included in this table along with a brief explanation.

Field	Data type	Description

Field	Data type	Description
domain	`str`	Domain in which the action takes place
userid	`str`	ID associated with the user
sessionid	`str`	Session in which the action is framed
userEmail	`str`	Email address employed by the user to register and log in
serverHost, serverPort	`str, int`	Server address and port through which the connection to Devo is established
srcHost, srcPort	`str, int`	IP address and port from which the connection to Devo is requested
userAgent	`str`	Web browser used to access Devo
referer	`str`	HTTP header field that identifies the address of the web page requested
url	`str`	URL of the request
origin	`str`	Origin part of the URL
section	`str`	Area of the web application the user accessed
action	`str`	Task performed
type	`str`	Request type
message	`str`	Message in the request
country, region, city	`str`	Geographic location of the source connection established by the user
isp, org	`str`	Internet provider

siem.logtrust.web.info

In this table, you can find information about the development of the web application. It can be used to analyze the different events that take place on the platform to have an overview of the global situation. You can see below the most relevant fields included in this table along with a brief explanation.

Field	Data type	Description

Field	Data type	Description
level	`str`	Level of importance or urgency of the event INFO → Messages for both end-users and system administrators to indicate the progress of the application WARN → Potentially harmful situations to end-users or system administrators ERROR → Events of great importance that threaten the normal development of the application
domain	`str`	Domain in which the event occurred
userid	`str`	ID associated with the user
sessionid	`str`	Session in which the action is framed
message	`str`	Full text describing the nature and content of the error

siem.logtrust.web.error

In this table, you can find information about the errors that occurred in the web application. It can be used to analyze common errors to possibly identify the cause. It is very similar to the siem.logtrust.web.info table with the difference that it includes only events that contain errors and excludes the rest of the levels. You can see below the most relevant fields included in this table along with a brief explanation.

Field	Data type	Description

Field	Data type	Description
level	`str`	Level of importance or urgency of the event (in this case only ERROR)
domain	`str`	Domain in which the error occurred
userid	`str`	ID associated with the user
sessionid	`str`	Session in which the action is framed
message	`str`	Full text describing the nature and content of the error

siem.logtrust.web.notification

In this table, you can find information about the notifications that occurred in the web application. You can see below the most relevant fields included in this table along with a brief explanation.

Field	Data type	Description

Field	Data type	Description
level	`str`	Level of importance or urgency of the notification INFO → Messages for both end-users and system administrators to indicate the progress of the application WARN → Potentially harmful situations to end-users or system administrators ERROR → Events of great importance that threaten the normal development of the application
domain	`str`	Domain in which the notification occurred
userName	`str`	ID associated with the user that caused the notification
sessionId	`str`	ID of the session in which the action is framed
domainId	`str`	ID of the domain
userId	`str`	ID of the user
notificationId	`str`	ID of the notification
text	`str`	Text of the notification
creationDate	`str`	Date when the notification occured
notificationType	`str`	Type of notification

siem.logtrust.collector.counter

Field Name	Data Type
eventdate	`timestamp`
collector	`str`
engine	`str`
kind	`str`
object	`str`
events	`int8`
bytes	`int8`
client	`str`
tag	`str`
layouterror	`layouterror`
raw	`str`
rawSource	`str`
rawTagged	`str`
__trunk	`str`
__containerName	`str`
__containerHash	`boxar(int1)`
__containerOffset	`int8`
_beid	`boxar(int1)`
_seid	`int8`
eventid	`boxar(int1)`