Standard Log Format (L7 TCP)

About the Format

Standard Log Format is the basic log format that contains the TCP connection information and the timing metrics for the L7 TCP vServices. It takes place in the Line Format list in the profile form with the Standard Log Format option.

Unlike the HTTP formats, the TCP format provides information at the connection level instead of the request/response content: the connection times, the data transfer amounts, the connection termination states and the Backend Service information. The TLS information is not present in this format; CEF or TR7 JSON is used for the cipher and the protocol.

Use cases

• TCP proxy access logging.
• Connection performance analysis.
• Backend Service monitoring.
• Troubleshooting and debugging.

Warning

The Standard, Apache Combined and Apache VHost formats produce the same output for TCP.

Supported Features

HTTP vService

L7 TCP vService

WAF Information

SSL Information

Example Log

172.16.101.42:49602 [09/Sep/2026:20:48:51.888] DFE DBE/lbBackends-mrdk4wpm 1/1/6398 4819 cD 1/1/0/0/0 0/0 172.16.102.168:80

Field Descriptions

Connection Information

Field	Example	Description
Client IP	172.16.101.42	The client IP address
Client Port	49602	The client source port
Timestamp	09/Sep/2026:20:48:51.888	The connection time (with millisecond precision, the local time of the device)

Proxy Information

Field	Example	Description
Frontend	DFE	The Frontend identifier
Backend	DBE	The Backend identifier
Server	lbBackends-mrdk4wpm	The Backend Service ID information

Timing Metrics

Field	Example	Unit	Description
Wait Time	1	ms	The waiting time in the queue
Connect Time	1	ms	The time to connect to the Backend Service
Total Time	6398	ms	The total time from the acceptance of the session to its closing

Wait Time and Connect Time are written as -1 when the connection is cut without ever reaching the related phase. This value must be filtered out in the commands that make a duration comparison.

Data Transfer

Field	Example	Description
Bytes	4819	The amount of bytes transferred from the Backend Service to the client. The data uploaded from the client is not included in this number; that information is not present at all in this format.

Connection Termination

Field	Example	Description
Termination State	cD	The connection termination state

The value cD in the example line is read as follows: in the data transfer phase the client remained silent during the client timeout period, and therefore the connection was terminated by TR7. The total time, 6398 ms, is the time from the acceptance of the session to its closing; it is not the timeout value itself. The list of the codes is below.

Connection Counters

Field	Example	Description
Active Connections	1	The number of simultaneous connections across the process (it does not belong only to this vService)
Frontend Connections	1	The number of Frontend connections
Backend Connections	0	The number of Backend connections
Server Connections	0	The number of Backend Service connections
Retries	0	The number of retries

Queue Information

Field	Example	Description
Server Queue	0	The Backend Service queue length at the moment the session was taken out of the queue
Backend Queue	0	The backend queue length at the moment the session was taken out of the queue

Backend Service Address

Field	Example	Description
Server IP	172.16.102.168	The Backend Service IP address
Server Port	80	The Backend Service port

Termination State (%ts)

The termination state is a 2-character code that shows how the connection ended.

The First Character: The Reason for the Termination

Code	Meaning
C	The client cut the connection
S	The server cut or rejected the connection
P	TR7 terminated it (a rule, a limit or a protection)
L	TR7 produced a local response
R	Resource exhaustion
I	An internal error
c	A timeout on the client side
s	A timeout on the server side
D	The session was terminated because the server passed to the DOWN state
U	The session was terminated because the main server became UP while the backup server was being used
K	The session was terminated by the administrator
-	Normal completion

The Second Character: The Phase at the Moment of the Termination

Code	Meaning
Q	The request was in the queue
C	The connection to the server was being made
D	The data transfer was continuing
L	The last data were being transferred to the client
-	Normal completion

Common Combinations

Value	Meaning
--	Normal completion
cD	A client-side timeout in the data phase. It is a usual termination on the long-lived and idle connections.
sD	A server-side timeout in the data phase
CD	The client cut the connection in the data phase
SD	The server cut the connection in the data phase
SC	The Backend Service rejected the connection: the most frequently seen connection error
sC	A timeout while connecting to the Backend Service

Timing Diagram

Client ──────────┬─────────────────────────────────────────┬────── Server
                 │                                         │
                 │◄── Tw ──►│◄── Tc ──►│                   │
                 │  Queue   │ Connect  │                   │
                 │          │          │                   │
                 │◄──────────────── Tt ───────────────────►│
                 │            Total Time                   │

Duration	Start	End
Tw	The session was taken into the queue	A connection slot was opened on the Backend Service
Tc	The connection attempt started	The TCP handshake was completed
Tt	The connection was accepted	Both ends closed

Example Analysis Scenarios

Finding the Slow Connections

The examples assume a raw log line

The commands below assume that the file consists of the raw log lines. If local (default), rfc3164, rfc5424 or priority is selected as the Log Standard in the log profile, a syslog prefix is added to the beginning of every line; the field indexes shift and the JSON lines cannot be parsed. In this case, either the collector must strip the prefix or raw must be selected in the profile.

In the raw line the timing triplet (Tw/Tc/Tt) is the fifth field; the total time is the last part of this triplet.

# The connections longer than 10 seconds
awk '{split($5, t, "/"); if (t[3] > 10000) print}' tcp.log

Backend Error Rate

# Count the Backend Service connection errors (rejection + connection timeout)
awk '$7 ~ /^(SC|sC)$/' tcp.log | wc -l

The IPs That Make the Most Connections

awk '{split($1, a, ":"); print a[1]}' tcp.log | sort | uniq -c | sort -rn | head -10