TR7 JSON Format (L7 TCP)

About the Format

TR7 JSON Format is the most comprehensive log format for the L7 TCP vServices. It takes place in the Line Format list in the profile form with the TR7 JSON Format option. It presents the connection information, the timing metrics and the SSL/TLS details in the structured JSON format.

Unlike the HTTP JSON format, the TCP JSON format provides details at the connection level instead of the request/response content. The WAF information is not supported for TCP.

Use cases

• Detailed connection analysis.
• Elasticsearch/Kibana integration.
• Performance monitoring and optimization.
• SSL/TLS security analysis.

Supported Features

HTTP vService

L7 TCP vService

WAF Information

SSL Information (frontend + backend)

Example Log

{
  "pool": "LOGTEST-T",
  "ident": "tr7",
  "ts": "09/Sep/2026:20:51:45 +0300",
  "time": {
    "tw": "5",
    "tc": "0",
    "tt": "6088"
  },
  "conn": {
    "act": "1",
    "f": "1",
    "b": "0",
    "s": "0"
  },
  "queue": {
    "b": "0",
    "s": "0"
  },
  "tstate": "cD",
  "retries": "0",
  "network": {
    "ci": "172.16.101.42",
    "cp": "50069",
    "fi": "172.16.102.85",
    "fp": "8080",
    "si": "172.16.102.168",
    "sp": "80"
  },
  "ssl": {
    "fAlgKeysize": "128",
    "fCipher": "TLS_AES_128_GCM_SHA256",
    "fProtocol": "TLSv1.3",
    "fNpn": "-",
    "fAlpn": "http/1.1",
    "fKeyAlg": "rsaEncryption",
    "fSigAlg": "RSA-SHA256",
    "fVersion": "3",
    "fNotAfter": "240507115021Z",
    "fNotBefore": "230508115021Z",
    "fClientDn": "/C=TR/ST=ANK/L=ANK/O=TR7/OU=TR7/CN=new.tr7.com",
    "fIssuerDn": "/C=TR/ST=ANK/L=ANK/O=TR7/OU=TR7/CN=new.tr7.com",
    "sAlgKeysize": "-",
    "sCipher": "-",
    "sProtocol": "-",
    "sNpn": "-",
    "sAlpn": "-",
    "sKeyAlg": "-",
    "sSigAlg": "-",
    "sVersion": "-",
    "sNotAfter": "-",
    "sNotBefore": "-",
    "sClientDn": "-",
    "sIssuerDn": "-"
  },
  "ids": {
    "p": "lbPools-mtue68on__lb",
    "b": "DBE",
    "f": "DFE~",
    "s": "lbBackends-mrdk4wpm"
  },
  "bytes": {
    "uploaded": "4914",
    "read": "7552"
  }
}

Field Descriptions

Basic Fields

Field	Example	Description
pool	LOGTEST-T	The vService name
ident	tr7	The log source identifier
ts	09/Sep/2026:20:51:45 +0300	The timestamp (the local time of the device)

time (Timing Metrics)

Field	Unit	Description
tw	ms	Wait Time: the waiting time in the queue
tc	ms	Connect Time: the time to connect to the Backend Service
tt	ms	Total Time: the total connection time

INFO

The missing fields compared to the HTTP format are not only these: in the time object the tq and tr and, at the top level, the username, request, response, resFrom, isWafAttack and wafInfo fields are not present in TCP. In addition, tstate is four characters in HTTP and two characters in TCP (the cookie state is not carried).

conn (Connection Counters)

Field	Description
act	The number of active connections
f	The number of Frontend connections
b	The number of Backend connections
s	The number of Server connections

queue (Queue State)

Field	Description
b	The number of connections in the Backend queue
s	The number of connections in the Server queue

tstate (Connection Termination State)

The 2-character connection termination code:

Value	Meaning
--	Normal completion
cD	A client-side timeout in the data phase
sD	A server-side timeout in the data phase
CD	The client cut the connection in the data phase
SD	The server cut the connection in the data phase

The first character shows the reason for the termination and the second character the phase at the moment of the termination; the full list of the codes is on the Standard (L7 TCP) page.

retries

Field	Description
retries	The number of Backend connection retries

network (Network Information)

Field	Example	Description
ci	172.16.101.42	The client IP address
cp	50069	The client source port
fi	172.16.102.85	The Frontend (vService) IP address
fp	8080	The Frontend port
si	172.16.102.168	The Backend Service IP address
sp	80	The Backend Service port

The ssl Object: Frontend SSL/TLS Information

Field	Example	Description
fAlgKeysize	128	The encryption key size (bits)
fCipher	TLS_AES_128_GCM_SHA256	The cipher suite
fProtocol	TLSv1.3	The TLS protocol version
fNpn	-	The NPN protocol
fAlpn	http/1.1	The ALPN protocol
fKeyAlg	rsaEncryption	The key algorithm
fSigAlg	RSA-SHA256	The signature algorithm
fVersion	3	The certificate version
fNotAfter	240507115021Z	The certificate end date
fNotBefore	230508115021Z	The certificate start date
fClientDn	/C=TR/ST=ANK/L=ANK/O=TR7/OU=TR7/CN=new.tr7.com	The certificate subject DN
fIssuerDn	/C=TR/ST=ANK/L=ANK/O=TR7/OU=TR7/CN=new.tr7.com	The certificate issuer DN

The ssl Object: Backend Service SSL/TLS Information

Field	Description
sAlgKeysize	The key size (bits)
sCipher	The cipher suite
sProtocol	The TLS protocol version
sNpn	The NPN protocol
sAlpn	The ALPN protocol
sKeyAlg	The key algorithm
sSigAlg	The signature algorithm
sVersion	The certificate version
sNotAfter	The certificate end date
sNotBefore	The certificate start date
sClientDn	The certificate subject DN
sIssuerDn	The certificate issuer DN

INFO

When the connection to the Backend Service is made unencrypted, all the s* fields take the value -; the example log above is in this situation.

ids (Identifiers)

Field	Example	Description
p	lbPools-mtue68on__lb	The name of the load balancing container: <vService ID>__lb. The raw vService ID is this value with its __lb suffix dropped.
b	DBE	The Backend identifier
f	DFE~	The Frontend identifier. The ~ sign at the end shows that the connection was terminated with TLS; on an unencrypted frontend it is written as DFE.
s	lbBackends-mrdk4wpm	The Backend Service ID

bytes (Data Transfer)

Field	Example	Description
uploaded	4914	The bytes received from the client
read	7552	The bytes sent to the client

Use Example: Performance Analysis

Finding the Slow Connections

The examples assume a raw log line

The commands below assume that the file consists of the raw log lines. If local (default), rfc3164, rfc5424 or priority is selected as the Log Standard in the log profile, a syslog prefix is added to the beginning of every line; the field indexes shift and the JSON lines cannot be parsed. In this case, either the collector must strip the prefix or raw must be selected in the profile.

# Total time > 5 seconds
cat tcp.log | jq 'select((.time.tt | tonumber) > 5000)'

Connection Error Rate

# Count the terminations that are not normal
cat tcp.log | jq -r '.tstate' | grep -v "^--$" | wc -l

INFO

cD (the client remained idle and hit the timeout) is a usual termination on the long-lived connections and it looks like an error in this count. For the real connection errors, the SC and sC codes must also be filtered.

Backend Service Distribution

# The number of connections on a Backend Service basis
cat tcp.log | jq -r '.network.si' | sort | uniq -c | sort -rn

SSL Protocol Distribution

# The TLS versions used
cat tcp.log | jq -r '.ssl.fProtocol' | sort | uniq -c