Ironport WSA Log Fields

[JHerbst]

Good Afternoon,

Based on the Ironport WSA documentation for fields cs-bytes & sc-bytes, which is upload/download? I'm finding conflicting information.

%q	cs-bytes	Request size (headers + body).
%s	sc-bytes	Response size (header + body).

Cheers,

James

[Ken Stieers · Accepted solution]

Request is what the WSA sends, e.g. upload = %q
Response is what it gets back, e.g. download = %s

[JHerbst]

Thank you @Ken Stieers !