VMWare Content Gateway Events | LogRhythm Documentation

Vendor Documentation

https://docs.vmware.com/en/Unified-Access-Gateway/3.10/com.vmware.uag-310-deploy-config.doc/GUID-76785536-56DF-48B6-A471-F3C60C3A587F.html

Rule Name	Rule Type	Common Event	Classification
VMWare Content Gateway Events	Base Rule	General Audit Message	Other Audit

Device Key in Log Message	LogRhythm Schema	Data Type	Schema Description
timestamp	N/A	N/A	Indicates the time at which the event was generated and logged in the syslog server.
UAG Hostname	N/A	N/A	Hostname or IP of the Unified Access Gateway appliance.
appname	N/A	N/A	Application that generates the event. Note: Depending on the log file, the values of this field are as follows: UAG-AUDIT, UAG-ADMIN, and UAG-ESMANAGER.
thread id	N/A	N/A	ID of the thread in which the event gets generated.
session id	<session>	Number	Unique identifier of the session.
log message	<vendorinfo> <responsecode> <url>	Text/String Number Text/String	Provides a summary about what has occurred in the event.