How to resolve "W3C header is missing" message in TIBCO LogLogic LMI
Article ID: KB0077491
Updated On:
| Products | Versions |
|---|---|
| TIBCO LogLogic Log Management Intelligence | all versions |
Description
LogLogic LMI may stop accepting Blue Coat access log messages with the following error: W3C header is missing from the first 512 bytes of the stream.
Issue/Introduction
This article explains what can cause the error "W3C header is missing" with Blue Coat access logs.
Resolution
Check the log format in the Blue Coat Proxy SG appliance is set to W3C ELFF with the default format:
date time time-taken c-ip sc-status s-action sc-bytes cs-bytes cs-method cs-uri-scheme cs-host cs-uri-stem cs-username s-hierarchy s-supplier-name rs(Content-Type) cs(User-Agent) sc-filter-result sc-filter-category x-virus-id s-ip s-sitename
The multiple-valued header policy should be set to "Log Last Header." This will enable the LogLogic LMI appliance to successfully process the Blue Coat logs.
Feedback
Yes
No
Powered by
