The Forefront TMG Web proxy includes a pointer to the HTTP_FILTER_LOG structure in the notification that it sends to Web filters when it is ready to write information to a log file. If your filter should be notified for this event, it must register to receive SF_NOTIFY_LOG notifications. For more information about the types of event notifications that are sent to Web filters, see Event Notifications.


typedef struct _HTTP_FILTER_LOG {
const CHAR* pszClientHostName;
const CHAR* pszClientUserName;
const CHAR* pszServerName;
const CHAR* pszOperation;
const CHAR* pszTarget;
const CHAR* pszParameters;
DWORD dwHttpStatus;
DWORD dwWin32Status;
DWORD dwBytesSent;
DWORD dwBytesRecvd;
DWORD msTimeForProcessing; } HTTP_FILTER_LOG,



The client's host name or IP address.


Null-terminated string that specifies the client's user name if authenticated, or "anonymous" otherwise.


Null-terminated string that specifies the name of the server to which the client is connected.


Null-terminated string that specifies the HTTP method.


Null-terminated string that specifies the target of the HTTP command.


Null-terminated string that specifies the parameters passed to the HTTP command. This member is used to store the information that is to written in the Filter Information field of a Web proxy log entry.


The HTTP return status.


The Windows error code.


The number of bytes sent from the server to the client.


The number of bytes received by the server from the client.


The time, in milliseconds, required to process the client request.


When the Web proxy is about to log information to the Web proxy log, it sends a notification by calling the HttpFilterProc entry-point function of each Web filter that is registered to receive SF_NOTIFY_LOG event notifications. The pvNotification parameter contains a pointer to an HTTP_FILTER_LOG structure, and the notificationType parameter is set to SF_NOTIFY_LOG.

The strings cannot be changed, but the string pointers can be replaced. If string pointers are changed, the memory they point to must remain valid until the next filter notification. The AllocMem callback function in the HTTP_FILTER_CONTEXT structure can be used to ensure this.

The strings specified in the pszClientHostName, pszClientUserName, pszServerName, pszOperation, pszTarget, and pszParameters members are formatted with UCS Transformation Format 8 (UTF-8) encoding.

For more information about how a Web filter can write information to the Web proxy log, see Adding Information to the Web Proxy Log.


Server Requires Windows Server 2008.
Version Requires Forefront Threat Management Gateway (TMG).

Declared in Httpfilt.h.

See Also

Notification Structures

Send comments about this topic to Microsoft

Build date: 11/30/2009

© 2008 Microsoft Corporation. All rights reserved.