pdweb.snoop trace of HTTP traffic with WebSEAL

The pdweb.snoop component traces HTTP traffic. This component logs the HTTP headers and the message body for requests and responses. The snoop component traces the entire request and response as it is read off the socket. This trace might contain sensitive information. The pdweb.snoop component has the following subcomponents:

pdweb.snoop.client

Traces data sent between WebSEAL and clients.

pdweb.snoop.jct

Traces data sent between WebSEAL and junctions.

To trace only the message headers, see pdweb.debug trace of HTTP header requests and responses. The following example command starts the trace utility for the pdweb.snoop component at level 9 and directs the output to a file:

pdadmin> server task webseald-instance trace set pdweb.snoop 9 \
file path=snoop.out

The following sample output shows the WebSEAL server that is sending 2137 bytes of data to a client at IP address 10.4.5.12:

----------------------------------------
2012-08-10-19:35:18.541+00:00I----- thread(5) trace.pdweb.snoop.client:1
/home/amweb600/src/pdwebrte/webcore/amw_snoop.cpp:159:
----------------------------------------
Thread 2828; fd 22; local 10.4.5.10:443; remote 10.4.5.12:1250
Sending 2137 bytes
0x0000   4854 5450 2f31 2e31 2034 3033 2046 6f72        HTTP/1.1.403.For
0x0010   6269 6464 656e 0d0a 6461 7465 3a20 5475        bidden..date:.We
0x0020   652c 2032 3820 4f63 7420 3230 3033 2031        d,.10.Aug.2005.1
0x0030   393a 3335 3a31 3820 474d 540d 0a73 6572        9:35:18.GMT..ser
0x0040   7665 723a 2057 6562 5345 414c 2f35 2e31        ver:.WebSEAL/5.1
0x0050   2e30 2e30 2028 4275 696c 6420 3033 3130        .0.0.(Build.0310
0x0060   3230 290d 0a63 6163 6865 2d63 6f6e 7472        20)..cache-contr
0x0070   6f6c 3a20 6e6f 2d63 6163 6865 0d0a 7072        ol:.no-cache..pr
0x0080   6167 6d61 3a20 6e6f 2d63 6163 6865 0d0a        agma:.no-cache..
0x0090   636f 6e74 656e 742d 6c65 6e67 7468 3a20        content-length:.
0x00a0   3139 3038 0d0a 7033 703a 2043 503d 224e        1908..p3p:.CP="N
0x00b0   4f4e 2043 5552 204f 5450 6920 4f55 5220        ON.CUR.OTPi.OUR.
0x00c0   4e4f 5220 554e 4922 0d0a 636f 6e74 656e        NOR.UNI"..conten
...

Parent topic: Trace logging for WebSEAL