Event Definitions

Events Events Events

All event data is stored in the Database Schema in a relational database. As Untangle and applications process traffic they create Event objects that add and modify content in the database. Each event has it's own class/object with certain fields that modify the database in a certain way.

The list below shows the classes used in the event logging and the attributes of each event object. These can be used to add alerts in Reports or for other event handling within Untangle.

HostTableEvent

<section begin='HostTableEvent' />

These events are created by the base system and inserted to the host_table_updates table when the host table is modified.

Attribute Name	Type	Description
address	InetAddress	The address
class	Class	The class name
key	String	The key
timeStamp	Timestamp	The timestamp
value	String	The value

<section end='HostTableEvent' />

DeviceTableEvent

<section begin='DeviceTableEvent' />

These events are created by the base system and inserted to the device_table_updates table when the device list is modified.

Attribute Name	Type	Description
class	Class	The class name
device	DeviceTableEntry	The Device
key	String	The key
macAddress	String	The MAC address
timeStamp	Timestamp	The timestamp
value	String	The value

<section end='DeviceTableEvent' />

PenaltyBoxEvent

<section begin='PenaltyBoxEvent' />

These events are created by the Bandwidth Control and inserted to the penaltybox table.

Attribute Name	Type	Description
action	int	The action
address	InetAddress	The address
class	Class	The class name
entryTime	Timestamp	The entry time
exitTime	Timestamp	The exit time
timeStamp	Timestamp	The timestamp

<section end='PenaltyBoxEvent' />

SessionStatsEvent

<section begin='SessionStatsEvent' />

These events are created by the base system and update the sessions table when a session ends with the updated stats.

Attribute Name	Type	Description
c2pBytes	long	The number of bytes sent from the client to Untangle
class	Class	The class name
endTime	long	The end time/date
p2cBytes	long	The number of bytes sent to the client from Untangle
p2sBytes	long	The number of bytes sent to the server from Untangle
s2pBytes	long	The number of bytes sent from the server to Untangle
sessionId	Long	The session ID
timeStamp	Timestamp	The timestamp

<section end='SessionStatsEvent' />

SessionEvent

<section begin='SessionEvent' />

These events are created by the base system and update the sessions table each time a session is created.

Attribute Name	Type	Description
cClientAddr	InetAddress	The client-side (pre-NAT) client address
cClientPort	Integer	The client-side (pre-NAT) client port
cServerAddr	InetAddress	The client-side (pre-NAT) server address
cServerPort	Integer	The client-side (pre-NAT) server port
sClientAddr	InetAddress	The server-side (post-NAT) client address
sClientPort	Integer	The server-side (post-NAT) client port
sServerAddr	InetAddress	The server-side (post-NAT) server address
sServerPort	Integer	The server-side (post-NAT) server port
bypassed	boolean	True if bypassed, false otherwise
class	Class	The class name
clientCountry	String	The client country
clientIntf	Integer	The client interface ID
clientLatitude	Double	The client latitude
clientLongitude	Double	The client longitude
entitled	boolean	The entitled status
filterPrefix	String	The filter prefix if blocked by the filter rules
hostname	String	The hostname
icmpType	Short	The ICMP type
localAddr	InetAddress	The local host address
policyId	Integer	The policy ID
policyRuleId	Integer	The policy rule ID
protocol	Short	The protocol
protocolName	String	The protocol name
remoteAddr	InetAddress	The remote host address
serverCountry	String	The server country
serverIntf	Integer	The server interface ID
serverLatitude	Double	The server latitude
serverLongitude	Double	The server longitude
sessionId	Long	The session ID
timeStamp	Timestamp	The timestamp
username	String	The username

<section end='SessionEvent' />

SessionMinuteEvent

<section begin='SessionMinuteEvent' />

These events are created by the base system and update the session_minutes table each minute a session exists.

Attribute Name	Type	Description
c2sBytes	long	The number of bytes sent from the client to the server
class	Class	The class name
s2cBytes	long	The number of bytes sent from the server to the client
sessionId	long	The session ID
timeStamp	Timestamp	The timestamp

<section end='SessionMinuteEvent' />

SessionNatEvent

<section begin='SessionNatEvent' />

These events are created by the base system and update the sessions table each time a session is NATd with the post-NAT information.

Attribute Name	Type	Description
sClientAddr	InetAddress	The server-side (post-NAT) client address
sClientPort	Integer	The server-side (post-NAT) client port
sServerAddr	InetAddress	The server-side (post-NAT) server address
sServerPort	Integer	The server-side (post-NAT) server port
class	Class	The class name
serverIntf	Integer	The server interface ID
timeStamp	Timestamp	The timestamp

<section end='SessionNatEvent' />

QuotaEvent

<section begin='QuotaEvent' />

These events are created by the Bandwidth Control and inserted or update the quotas table when quotas are given or exceeded.

Attribute Name	Type	Description
action	int	The action (1=Quota Given, 2=Quota Exceeded)
address	InetAddress	The address
class	Class	The class name
quotaSize	long	The quota size
reason	String	The reason
timeStamp	Timestamp	The timestamp

<section end='QuotaEvent' />

SettingsChangesEvent

<section begin='SettingsChangesEvent' />

These events are created by the base system and inserted to the settings_changes table when settings are changed.

Attribute Name	Type	Description
class	Class	The class name
hostname	String	The hostname
settingsFile	String	The settings file
timeStamp	Timestamp	The timestamp
username	String	The username

<section end='SettingsChangesEvent' />

LogEvent

<section begin='LogEvent' />

These base class for all events.

Attribute Name	Type	Description
class	Class	The class name
timeStamp	Timestamp	The timestamp

<section end='LogEvent' />

InterfaceStatEvent

<section begin='InterfaceStatEvent' />

These events are created by the base system and inserted to the interface_stat_events table periodically with interface stats.

Attribute Name	Type	Description
class	Class	The class name
interfaceId	int	The interface ID
rxRate	double	The RX rate in byte/s
timeStamp	Timestamp	The timestamp
txRate	double	The TX rate in byte/s

<section end='InterfaceStatEvent' />

SystemStatEvent

<section begin='SystemStatEvent' />

These events are created by the base system and inserted to the server_events table periodically.

Attribute Name	Type	Description
activeHosts	int	The active host count
class	Class	The class name
cpuSystem	float	The system CPU utilization
cpuUser	float	The user CPU utilization
diskFree	long	The amount of disk free
diskFreePercent	float	The percentage of disk free
diskTotal	long	The total size of the disk
diskUsed	long	The amount of disk used
diskUsedPercent	float	The percentage of disk used
load1	float	The 1-minute CPU load
load15	float	The 15-minute CPU load
load5	float	The 5-minute CPU load
memBuffers	long	The amount of memory used by buffers
memCache	long	The amount of memory used by cache
memFree	long	The amount of free memory
memFreePercent	float	The percentage of total memory that is free
memTotal	long	The total amount of memory
memUsed	long	The amount of used memory
memUsedPercent	float	The percentage of total memory that is used
swapFree	long	The amount of free swap
swapFreePercent	float	The percentage of total swap that is free
swapTotal	long	The total size of swap
swapUsed	long	The amount of used swap
swapUsedPercent	float	The percentage of total swap that is used
timeStamp	Timestamp	The timestamp

<section end='SystemStatEvent' />

TunnelStatusEvent

<section begin='TunnelStatusEvent' />

These events are created by IPsec VPN and inserted to the ipsec_tunnel_stats table periodically.

Attribute Name	Type	Description
class	Class	The class name
inBytes	long	The number of bytes received from this tunnel
outBytes	long	The number of bytes sent in this tunnel
timeStamp	Timestamp	The timestamp
tunnelName	String	The name of this tunnel

<section end='TunnelStatusEvent' />

VirtualUserEvent

<section begin='VirtualUserEvent' />

These events are created by IPsec VPN and inserted to the ipsec_user_events table when a user event occurs.

Attribute Name	Type	Description
class	Class	The class name
clientAddress	InetAddress	The client address
clientProtocol	String	The client protocol
clientUsername	String	The client username
elapsedTime	String	The elapsed time
eventId	Long	The event ID
netInterface	String	The net interface
netProcess	String	The net process
netRXbytes	Long	The number of RX (received) bytes
netTXbytes	Long	The number of TX (transmitted) bytes
timeStamp	Timestamp	The timestamp

<section end='VirtualUserEvent' />

AlertEvent

<section begin='AlertEvent' />

These events are created by Reports and inserted to the alerts table when an alert fires.

Attribute Name	Type	Description
cause	LogEvent	The cause
class	Class	The class name
description	String	The description
json	JSONObject	The JSON string
summaryText	String	The summary text
timeStamp	Timestamp	The timestamp

<section end='AlertEvent' />

ConfigurationBackupEvent

<section begin='ConfigurationBackupEvent' />

These events are created by Configuration Backup and inserted to the configuratio_backup_events table when a backup occurs.

Attribute Name	Type	Description
class	Class	The class name
destination	String	The destination
detail	String	The details
success	boolean	True if successful, false otherwise
timeStamp	Timestamp	The timestamp

<section end='ConfigurationBackupEvent' />

WebCacheEvent

<section begin='WebCacheEvent' />

These events are created by Web Cache and inserted to the web_cache_stats table periodically.

Attribute Name	Type	Description
bypassCount	long	The number of bypasses
class	Class	The class name
hitBytes	long	The number of bytes worth of hits
hitCount	long	The number of hits
missBytes	long	The number of bytes worth of misses
missCount	long	The number of misses
policyId	Long	The policy ID
systemCount	long	The number of system bypasses
timeStamp	Timestamp	The timestamp

<section end='WebCacheEvent' />

PrioritizeEvent

<section begin='PrioritizeEvent' />

These events are created by the Bandwidth Control and update the session table when a session is prioritized.

Attribute Name	Type	Description
class	Class	The class name
priority	int	The priority
ruleId	int	The rule ID
sessionEvent	SessionEvent	The session event
timeStamp	Timestamp	The timestamp

<section end='PrioritizeEvent' />

HttpResponseEvent

<section begin='HttpResponseEvent' />

These events are created by HTTP subsystem and update the http_events table when a web response happens.

Attribute Name	Type	Description
class	Class	The class name
contentLength	long	The content length
contentType	String	The content type
httpRequestEvent	HttpRequestEvent	The corresponding HTTP request event
requestLine	RequestLine	The request line
timeStamp	Timestamp	The timestamp

<section end='HttpResponseEvent' />

HttpRequestEvent

<section begin='HttpRequestEvent' />

These events are created by HTTP subsystem and inserted to the http_events table when a web request happens.

Attribute Name	Type	Description
class	Class	The class name
contentLength	long	The content length
domain	String	The domain
host	String	The host
method	HttpMethod	The HTTP method
referer	String	The referer
requestId	Long	The request ID
requestUri	URI	The request URI
sessionEvent	SessionEvent	The session event
timeStamp	Timestamp	The timestamp

<section end='HttpRequestEvent' />

ApplicationControlLiteEvent

<section begin='ApplicationControlLiteEvent' />

These events are created by Application Control Lite and update the sessions table when application control lite identifies a session.

Attribute Name	Type	Description
blocked	boolean	True if blocked, false otherwise
class	Class	The class name
protocol	String	The protocol
sessionId	Long	The session ID
timeStamp	Timestamp	The timestamp

<section end='ApplicationControlLiteEvent' />

FirewallEvent

<section begin='FirewallEvent' />

These events are created by Firewall and update the sessions table when a firewall rule matches a session.

Attribute Name	Type	Description
blocked	boolean	True if blocked, false otherwise
class	Class	The class name
flagged	boolean	True if flagged, false otherwise
ruleId	long	The rule ID
sessionId	Long	The session ID
timeStamp	Timestamp	The timestamp

<section end='FirewallEvent' />

WebFilterQueryEvent

<section begin='WebFilterQueryEvent' />

These events are created by Web Filter and inserted to the http_query_events table when web filter processes a search engine search.

Attribute Name	Type	Description
class	Class	The class name
contentLength	long	The content length
host	String	The host
method	HttpMethod	The method
nodeName	String	The name of the application
requestId	Long	The request ID
requestUri	URI	The request URI
sessionEvent	SessionEvent	The session event
term	String	The search term/phrase
timeStamp	Timestamp	The timestamp

<section end='WebFilterQueryEvent' />

WebFilterEvent

<section begin='WebFilterEvent' />

These events are created by Web Filter and update the http_events table when web filter processes a web request.

Attribute Name	Type	Description
blocked	Boolean	True if blocked, false otherwise
category	String	The category
class	Class	The class name
flagged	Boolean	True if flagged, false otherwise
nodeName	String	The name of the application
reason	Reason	The reason
timeStamp	Timestamp	The timestamp

<section end='WebFilterEvent' />

ApplicationControlLogEvent

<section begin='ApplicationControlLogEvent' />

These events are created by Application Control and update the sessions table when application control identifies a session.

Attribute Name	Type	Description
application	String	The application
blocked	boolean	True if blocked, false otherwise
category	String	The category
class	Class	The class name
confidence	Integer	The confidence (0-100)
detail	String	The details
flagged	boolean	True if flagged, false otherwise
protochain	String	The protochain
ruleId	Integer	The rule ID
sessionEvent	SessionEvent	The session event
state	Integer	The state
timeStamp	Timestamp	The timestamp

<section end='ApplicationControlLogEvent' />

SslInspectorLogEvent

<section begin='SslInspectorLogEvent' />

These events are created by SSL Inspector and update the sessions table when a session is processed by SSL Inspector.

Attribute Name	Type	Description
class	Class	The class name
detail	String	The details
ruleId	Integer	The rule ID
sessionEvent	SessionEvent	The session event
status	String	The status
timeStamp	Timestamp	The timestamp

<section end='SslInspectorLogEvent' />

SpamSmtpTarpitEvent

<section begin='SpamSmtpTarpitEvent' />

These events are created by Spam Blocker and inserted to the smtp_tarpit_events table when a session is tarpitted.

Attribute Name	Type	Description
iPAddr	InetAddress	The IP address
class	Class	The class name
hostname	String	The hostname
sessionEvent	SessionEvent	The session event
sessionId	Long	The session ID
timeStamp	Timestamp	The timestamp
vendorName	String	The application name

<section end='SpamSmtpTarpitEvent' />

SpamLogEvent

<section begin='SpamLogEvent' />

These events are created by Spam Blocker and update the mail_msgs table when an email is scanned.

Attribute Name	Type	Description
action	SpamMessageAction	The action
class	Class	The class name
clientAddr	InetAddress	The client address
clientPort	int	The client port
messageId	Long	The message ID
receiver	String	The receiver
score	float	The score
sender	String	The sender
serverAddr	InetAddress	The server address
serverPort	int	The server port
smtpMessageEvent	SmtpMessageEvent	The parent SMTP message event
isSpam	boolean	True if spam, false otherwise
subject	String	The subject
testsString	String	The tests string from the spam engine
timeStamp	Timestamp	The timestamp
vendorName	String	The application name

<section end='SpamLogEvent' />

SpamSmtpTarpitEvent

<section begin='SpamSmtpTarpitEvent' />

These events are created by Spam Blocker and inserted to the smtp_tarpit_events table when a session is tarpitted.

Attribute Name	Type	Description
iPAddr	InetAddress	The IP address
class	Class	The class name
hostname	String	The hostname
sessionEvent	SessionEvent	The session event
sessionId	Long	The session ID
timeStamp	Timestamp	The timestamp
vendorName	String	The application name

<section end='SpamSmtpTarpitEvent' />

SpamLogEvent

<section begin='SpamLogEvent' />

These events are created by Spam Blocker and update the mail_msgs table when an email is scanned.

Attribute Name	Type	Description
action	SpamMessageAction	The action
class	Class	The class name
clientAddr	InetAddress	The client address
clientPort	int	The client port
messageId	Long	The message ID
receiver	String	The receiver
score	float	The score
sender	String	The sender
serverAddr	InetAddress	The server address
serverPort	int	The server port
smtpMessageEvent	SmtpMessageEvent	The parent SMTP message event
isSpam	boolean	True if spam, false otherwise
subject	String	The subject
testsString	String	The tests string from the spam engine
timeStamp	Timestamp	The timestamp
vendorName	String	The application name

<section end='SpamLogEvent' />

CookieEvent

<section begin='CookieEvent' />

These events are created by Ad Blocker and update the http_events table when a cookie is blocked.

Attribute Name	Type	Description
class	Class	The class name
identification	String	The identification string
requestId	Long	The request ID
sessionEvent	SessionEvent	The session event
timeStamp	Timestamp	The timestamp

<section end='CookieEvent' />

AdBlockerEvent

<section begin='AdBlockerEvent' />

These events are created by Ad Blocker and update the http_events table when an ad is blocked.

Attribute Name	Type	Description
action	Action	The action
class	Class	The class name
reason	String	The reason
requestId	Long	The request ID
timeStamp	Timestamp	The timestamp

<section end='AdBlockerEvent' />

IntrusionPreventionLogEvent

<section begin='IntrusionPreventionLogEvent' />

These events are created by Intrusion Prevention and inserted to the intrusion_prevention_events table when a rule matches.

Attribute Name	Type	Description
blocked	short	1 if blocked, 0 otherwise
category	String	The category
class	Class	The class name
classificationId	long	The classification ID
classtype	String	The classtype
dportIcode	int	The dportIcode
eventId	long	The event ID
eventMicrosecond	long	The event microsecond
eventSecond	long	The event second
eventType	long	The event type
generatorId	long	The generator ID
impact	short	The impact
impactFlag	short	The impact flag
ipDestination	InetAddress	The IP address destination
ipSource	InetAddress	The IP address source
mplsLabel	long	The mplsLabel
msg	String	The msg
padding	int	The padding
priorityId	long	The priority ID
protocol	short	The protocol
sensorId	long	The sensor ID
signatureId	long	The signature ID
signatureRevision	long	The signature revision
sportItype	int	The sportItype
timeStamp	Timestamp	The timestamp
vlanId	int	The VLAN Id

<section end='IntrusionPreventionLogEvent' />

WanFailoverTestEvent

<section begin='WanFailoverTestEvent' />

These events are created by WAN Failover and inserted to the wan_failover_test_events table when a test is run.

Attribute Name	Type	Description
class	Class	The class name
description	String	The description
interfaceId	int	The interface ID
name	String	The test name
osName	String	The O/S interface name
success	Boolean	True if successful, false otherwise
timeStamp	Timestamp	The timestamp

<section end='WanFailoverTestEvent' />

WanFailoverEvent

<section begin='WanFailoverEvent' />

These events are created by WAN Failover and inserted to the wan_failover_action_events table when WAN Failover takes an action.

Attribute Name	Type	Description
action	WanFailoverEvent$Action	The action
class	Class	The class name
interfaceId	int	The interface ID
name	String	The name
osName	String	The O/S interface name
timeStamp	Timestamp	The timestamp

<section end='WanFailoverEvent' />

CaptivePortalUserEvent

<section begin='CaptivePortalUserEvent' />

These events are created by Captive Portal and inserted to the captive_portal_user_events table when Captive Portal user takes an action.

Attribute Name	Type	Description
authenticationType	CaptivePortalSettings$AuthenticationType	The authentication type
authenticationTypeValue	String	The authentication type as a string
class	Class	The class name
clientAddr	InetAddress	The client address
event	CaptivePortalUserEvent$EventType	The event (LOGIN, FAILED, TIMEOUT, INACTIVE, USER_LOGOUT, ADMIN_LOGOUT)
eventValue	String	The event value as a string (LOGIN, FAILED, TIMEOUT, INACTIVE, USER_LOGOUT, ADMIN_LOGOUT)
loginName	String	The login name
policyId	Integer	The policy ID
timeStamp	Timestamp	The timestamp

<section end='CaptivePortalUserEvent' />

CaptureRuleEvent

<section begin='CaptureRuleEvent' />

These events are created by Captive Portal and update the sessions table when Captive Portal processes a session.

Attribute Name	Type	Description
captured	boolean	True if captured, false otherwise
class	Class	The class name
ruleId	Integer	The rule ID
sessionEvent	SessionEvent	The session event
timeStamp	Timestamp	The timestamp

<section end='CaptureRuleEvent' />

VirusSmtpEvent

<section begin='VirusSmtpEvent' />

These events are created by Virus Blocker and update the mail_msgs table when Virus Blocker scans an email.

Attribute Name	Type	Description
action	String	The action
class	Class	The class name
clean	boolean	True if clean, false otherwise
messageId	Long	The message ID
nodeName	String	The name of the application
timeStamp	Timestamp	The timestamp
virusName	String	The virus name, if not clean

<section end='VirusSmtpEvent' />

VirusFtpEvent

<section begin='VirusFtpEvent' />

These events are created by Virus Blocker and update the ftp_events table when Virus Blocker scans an FTP transfer.

Attribute Name	Type	Description
class	Class	The class name
clean	boolean	True if clean, false otherwise
nodeName	String	The name of the application
sessionEvent	SessionEvent	The session event
timeStamp	Timestamp	The timestamp
uri	String	The URI
virusName	String	The virus name, if not clean

<section end='VirusFtpEvent' />

VirusHttpEvent

<section begin='VirusHttpEvent' />

These events are created by Virus Blocker and update the http_events table when Virus Blocker scans an HTTP transfer.

Attribute Name	Type	Description
class	Class	The class name
clean	boolean	True if clean, false otherwise
nodeName	String	The name of the application
requestId	Long	The request ID
timeStamp	Timestamp	The timestamp
virusName	String	The virus name, if not clean

<section end='VirusHttpEvent' />

OpenVpnEvent

<section begin='OpenVpnEvent' />

These events are created by OpenVPN and update the openvpn_events table when OpenVPN processes a client action.

Attribute Name	Type	Description
address	InetAddress	The address
class	Class	The class name
clientName	String	The client name
poolAddress	InetAddress	The pool address
timeStamp	Timestamp	The timestamp
type	OpenVpnEvent$EventType	The type

<section end='OpenVpnEvent' />

OpenVpnStatusEvent

<section begin='OpenVpnStatusEvent' />

These events are created by OpenVPN and update the openvpn_stats table periodically.

Attribute Name	Type	Description
address	InetAddress	The address
bytesRxDelta	long	The delta number of RX (received) bytes from the previous event
bytesRxTotal	long	The total number of RX (received) bytes
bytesTxDelta	long	The delta number of TX (transmitted) bytes from the previous event
bytesTxTotal	long	The total number of TX (transmitted) bytes
class	Class	The class name
clientName	String	The client name
end	Timestamp	The end
poolAddress	InetAddress	The pool address
port	int	The port
start	Timestamp	The start
timeStamp	Timestamp	The timestamp

<section end='OpenVpnStatusEvent' />

SmtpMessageAddressEvent

<section begin='SmtpMessageAddressEvent' />

These events are created by SMTP subsystem and inserted to the mail_addrs table for each address on each email.

Attribute Name	Type	Description
addr	String	The address
class	Class	The class name
kind	AddressKind	The type for this address (F=From, T=To, C=CC, G=Envelope From, B=Envelope To, X=Unknown)
messageId	Long	The message ID
personal	String	personal
timeStamp	Timestamp	The timestamp

<section end='SmtpMessageAddressEvent' />

SmtpMessageEvent

<section begin='SmtpMessageEvent' />

These events are created by SMTP subsystem and inserted to the mail_msgs table for each email.

Attribute Name	Type	Description
addresses	Set	The addresses
class	Class	The class name
envelopeFromAddress	String	The envelop FROM address
envelopeToAddress	String	The envelope TO address
messageId	Long	The message ID
receiver	String	The receiver
sender	String	The sender
sessionEvent	SessionEvent	The session event
sessionId	Long	The session ID
subject	String	The subject
timeStamp	Timestamp	The timestamp
tmpFile	File	The /tmp file

<section end='SmtpMessageEvent' />

LoginEvent

<section begin='LoginEvent' />

These events are created by Directory Connector and inserted to the directory_connector_login_events table for each login.

Attribute Name	Type	Description
class	Class	The class name
clientAddr	InetAddress	The client address
domain	String	The domain
event	String	The event
loginName	String	The login name
timeStamp	Timestamp	The timestamp

<section end='LoginEvent' />