icon-zpa.svg
Secure Private Access (ZPA)

About App Connector Status Log Fields

The Log Streaming Service can send ZPA App Connector Status log information to any third-party log analytics tool. By default, theApp Connector Status log type includes the fields listed in the following table for each log template (i.e., CSV, JSON, TSV). While configuring your log receiver, you can edit the default log stream content to capture only specific fields, and create a Custom log template. For example, you can add the ConnectionLogType field as a custom log field to distinguish between AppProtection and event logs. The expected values for this field are event_log and inspection_log. The supported log field format specification must be included (i.e., %[OPT]s, %[OPT]j, %[OPT]J, %[OPT]d, %[OPT]x, %[OPT]f, %[OPT]o).

  • {"LogTimestamp": "Wed Jul 3 05:17:22 2019","Customer": "Safe March","SessionID": "8A64Qwj9zCkfYDGJVoUZ","SessionType": "ZPN_ASSISTANT_BROKER_CONTROL","SessionStatus": "ZPN_STATUS_AUTHENTICATED","Version": "19.20.3","Platform": "el7","ZEN": "US-NY-8179","Connector": "Seattle App Connector 1","ConnectorGroup": "Azure App Connectors","PrivateIP": "10.0.0.4","PublicIP": "52.224.237.221","Latitude": 47.000000,"Longitude": -122.000000,"CountryCode": "","TimestampAuthentication": "2019-06-27T05:05:23.348Z","TimestampUnAuthentication": "","CPUUtilization": 1,"MemUtilization": 20,"ServiceCount": 2,"InterfaceDefRoute": "eth0","DefRouteGW": "10.0.0.1","PrimaryDNSResolver": "168.63.129.16","HostStartTime": "1513229995","ConnectorStartTime": "1555920005","NumOfInterfaces": 2,"BytesRxInterface": 319831966346,"PacketsRxInterface": 1617569938,"ErrorsRxInterface": 0,"DiscardsRxInterface": 0,"BytesTxInterface": 192958782635,"PacketsTxInterface": 1797471190,"ErrorsTxInterface": 0,"DiscardsTxInterface": 0,"TotalBytesRx": 10902554,"TotalBytesTx": 48931771, "MicroTenantID": "145257480799129312"}
    Close

The following table includes descriptions and supported field format specifications for each field within the template. To learn more about the format specifications listed for each field, including examples, see Log Field Format Specifications.

FieldDescriptionSupported Field Format Specifications
LogTimestampTimestamp when the log was generated
  • %[OPT]s
  • %[OPT]j
  • %[OPT]J
CustomerThe customer name
  • %[OPT]s
  • %[OPT]j
  • %[OPT]J
  • %[OPT]o
SessionIDThe TLS session ID
  • %[OPT]s
  • %[OPT]j
  • %[OPT]J
  • %[OPT]o
SessionType

The type of session. The expected value for this field is:

ZPN_ASSISTANT_BROKER_CONTROL: Session from App Connector towards closest ZPA Public Service Edge for management

  • %[OPT]s
  • %[OPT]j
  • %[OPT]J
  • %[OPT]o
SessionStatus

The status of the session. The expected values for this field are:

  • ZPN_STATUS_AUTHENTICATED: App Connector successfully authenticated in ZPA
  • ZPN_STATUS_AUTH_FAILED: App Connector failed to authenticate in ZPA
  • ZPN_STATUS_DISCONNECTED: App Connector disconnected from a ZPA Service Edge
  • %[OPT]s
  • %[OPT]j
  • %[OPT]J
  • %[OPT]o
VersionThe App Connector package version
  • %[OPT]s
  • %[OPT]j
  • %[OPT]J
  • %[OPT]o
PlatformThe host platform
  • %[OPT]s
  • %[OPT]j
  • %[OPT]J
  • %[OPT]o
ZENThe ZPA Public Service Edge that was selected for the connection
  • %[OPT]s
  • %[OPT]j
  • %[OPT]J
  • %[OPT]o
ConnectorThe App Connector name
  • %[OPT]s
  • %[OPT]j
  • %[OPT]J
  • %[OPT]o
ConnectorGroupThe App Connector group name
  • %[OPT]s
  • %[OPT]j
  • %[OPT]J
  • %[OPT]o
PrivateIPThe private IP address of the App Connector
  • %[OPT]s
  • %[OPT]j
  • %[OPT]J
  • %[OPT]o
PublicIPThe public IP address of the App Connector
  • %[OPT]s
  • %[OPT]j
  • %[OPT]J
  • %[OPT]o
LatitudeThe latitude coordinate of the App Connector location
  • %[OPT]f
  • %[OPT]o
LongitudeThe longitude coordinate of the App Connector location
  • %[OPT]f
  • %[OPT]o
CountryCodeThe country code
  • %[OPT]s
  • %[OPT]j
  • %[OPT]J
  • %[OPT]o
TimestampAuthenticationTimestamp in microseconds when the App Connector was authenticated
  • %[OPT]s
  • %[OPT]j
  • %[OPT]J
TimestampUnAuthenticationTimestamp in microseconds when the App Connector was unauthenticated
  • %[OPT]s
  • %[OPT]j
  • %[OPT]J
CPUUtilizationThe CPU utilization in %
  • %[OPT]d
  • %[OPT]x
  • %[OPT]f
  • %[OPT]o
MemUtilizationThe memory utilization in %
  • %[OPT]d
  • %[OPT]x
  • %[OPT]f
  • %[OPT]o
ServiceCountThe number of services (combinations of domains/IP addresses and TCP/UDP ports) being monitored by the App Connector
  • %[OPT]d
  • %[OPT]x
  • %[OPT]f
  • %[OPT]o
InterfaceDefRouteThe name of the interface to default route
  • %[OPT]s
  • %[OPT]j
  • %[OPT]J
  • %[OPT]o
DefRouteGWThe IP address of the gateway to default route
  • %[OPT]s
  • %[OPT]j
  • %[OPT]J
  • %[OPT]o
PrimaryDNSResolverThe IP address of the primary DNS resolver
  • %[OPT]s
  • %[OPT]j
  • %[OPT]J
  • %[OPT]o
HostStartTimeTime in seconds at which host was started
  • %[OPT]s
  • %[OPT]j
  • %[OPT]J
  • %[OPT]o
ConnectorStartTimeTime in seconds at which the App Connector was started
  • %[OPT]s
  • %[OPT]j
  • %[OPT]J
  • %[OPT]o
NumOfInterfacesThe number of interfaces on the App Connector host
  • %[OPT]d
  • %[OPT]x
  • %[OPT]f
  • %[OPT]o
BytesRxInterfaceThe bytes received on the interface
  • %[OPT]d
  • %[OPT]x
  • %[OPT]f
  • %[OPT]o
PacketsRxInterfaceThe packets received on the interface
  • %[OPT]d
  • %[OPT]x
  • %[OPT]f
  • %[OPT]o
ErrorsRxInterfaceThe errors received on the interface
  • %[OPT]d
  • %[OPT]x
  • %[OPT]f
  • %[OPT]o
DiscardsRxInterfaceThe discards received on the interface
  • %[OPT]d
  • %[OPT]x
  • %[OPT]f
  • %[OPT]o
BytesTxInterfaceThe bytes transmitted on the interface
  • %[OPT]d
  • %[OPT]x
  • %[OPT]f
  • %[OPT]o
PacketsTxInterfaceThe packets transmitted on the interface
  • %[OPT]d
  • %[OPT]x
  • %[OPT]f
  • %[OPT]o
ErrorsTxInterfaceThe errors transmitted on the interface
  • %[OPT]d
  • %[OPT]x
  • %[OPT]f
  • %[OPT]o
DiscardsTxInterfaceThe discards transmitted on the interface
  • %[OPT]d
  • %[OPT]x
  • %[OPT]f
  • %[OPT]o
TotalBytesRxThe total bytes received
  • %[OPT]d
  • %[OPT]x
  • %[OPT]f
  • %[OPT]o
TotalBytesTxThe total bytes transmitted
  • %[OPT]d
  • %[OPT]x
  • %[OPT]f
  • %[OPT]o
MicroTenantIDThe Microtenant ID of the App Connector
  • %[OPT]s
  • %[OPT]j
Related Articles
About the Log Streaming ServiceConfiguring a Log ReceiverAbout User Activity Log FieldsAbout User Status Log FieldsAbout App Connector Metrics Log FieldsAbout App Connector Status Log FieldsAbout Private Service Edge Metrics Log FieldsAbout Private Service Edge Status Log FieldsAbout Audit Log FieldsAbout Browser Access Log FieldsAbout AppProtection Log FieldsUnderstanding Private Cloud Controller Metrics Log FieldsUnderstanding Private Cloud Controller Status Log FieldsUnderstanding the Log Stream Content Format