Viewing the Archived Log File Details Using the CLI

Use the CLI commands in this section to view details about traffic from the SSL flows that matches or does not match a particular attribute in the archived log file. Viewing archived log details on SSL flows can help you to identify previous trends or patterns in SSL interception traffic. For a description of each log field generated by the SSL Session Log module on the ADD Product Series appliance, see Viewing the Connection Event Logs.

To view the archived log file details:

Log in to the appliance CLI and go to enable mode.
```
hostname > enable
```
View the archived traffic details about SSL flows that matched a particular attribute in the archived log file.
```
hostname # show session-logger ssl archive matching <value>
```
where <value> can be a particular date and time, domain name, client IP address and port, server IP address and port, cipher suite, server name identification (SNI) sent by the client or server, and action that was taken on the SSL flow.
View the archived traffic details about SSL flows that did not match a particular attribute in the archived log file.
```
hostname # show session-logger ssl archive not matching <value>
```
where <value> can be a particular date and time, domain name, client IP address and port, server IP address and port, cipher suite, SNI sent by the client or server, and action that was taken on the SSL flow.

Examples

This example displays partial output about SSL flow traffic that matched a domain name in the archived log file.

hostname # show session-logger ssl archive matching microsoft.com
........
  Oct 12 18:13:38 192.168.69.157 52818 40.79.85.125 443 cs_bytes:N/A cs_tls_version:TLSv1.2
rs_tls_version:TLSv1.2 cs_cipher_suite:ECDHE-RSA-AES256-GCM-SHA384 rs_cipher_suite:ECDHE-RSA-AES256-SHA
rs_cert_common_name:*.big.telemetry.microsoft.com action:(ssl-1,whitelisted-0,block-0)
s_site_name:watson.telemetry.microsoft.com error:N/A
  Oct 12 18:13:39 192.168.69.157 52819 40.79.85.125 443 cs_bytes:N/A cs_tls_version:TLSv1.2
rs_tls_version:TLSv1.2 cs_cipher_suite:ECDHE-RSA-AES256-GCM-SHA384 rs_cipher_suite:ECDHE-RSA-AES256-SHA
rs_cert_common_name:*.big.telemetry.microsoft.com action:(ssl-1,whitelisted-0,block-0)
s_site_name:watson.telemetry.microsoft.com error:N/A
  Oct 12 18:15:45 192.168.69.157 52836 64.4.54.253 443 cs_bytes:N/A cs_tls_version:TLSv1.2
rs_tls_version:TLSv1.2 cs_cipher_suite:ECDHE-RSA-AES256-GCM-SHA384 rs_cipher_suite:ECDHE-RSA-AES256-SHA
rs_cert_common_name:settings-win.data.microsoft.com action:(ssl-1,whitelisted-0,block-0)
s_site_name:settings-win.data.microsoft.com error:N/A
  Oct 12 18:15:46 192.168.69.157 52837 64.4.54.253 443 cs_bytes:N/A cs_tls_version:TLSv1.2
rs_tls_version:TLSv1.2 cs_cipher_suite:ECDHE-RSA-AES256-GCM-SHA384 rs_cipher_suite:ECDHE-RSA-AES256-SHA
rs_cert_common_name:settings-win.data.microsoft.com action:(ssl-1,whitelisted-0,block-0)
s_site_name:settings-win.data.microsoft.com error:N/A
  Oct 12 18:15:46 192.168.69.157 52838 64.4.54.253 443 cs_bytes:N/A cs_tls_version:TLSv1.2
rs_tls_version:TLSv1.2 cs_cipher_suite:ECDHE-RSA-AES256-GCM-SHA384 rs_cipher_suite:ECDHE-RSA-AES256-SHA
rs_cert_common_name:settings-win.data.microsoft.com action:(ssl-1,whitelisted-0,block-0)
s_site_name:settings-win.data.microsoft.com error:N/A
........

This example displays partial output about SSL flow traffic that does not match the client port number in the archived log file.

hostname # show session-logger ssl archive not matching 53754
........
  Oct 12 20:05:21 192.168.69.157 53748 54.209.82.95 443 cs_bytes:N/A cs_tls_version:N/A rs_tls_version:N/A cs_cipher_suite:N/A rs_cipher_suite:N/A rs_cert_common_name:N/A action:(ssl-1,whitelisted-0,block-0) s_site_name:N/A
error:(error -Protocol error 71,ssl_error -sslv3 alert handshake failure 336151568)
  Oct 12 20:05:00 192.168.69.157 53747 10.35.30.248 443 cs_bytes:N/A cs_tls_version:N/A rs_tls_version:N/A cs_cipher_suite:N/A rs_cipher_suite:N/A rs_cert_common_name:N/A action:(ssl-1,whitelisted-0,block-0) s_site_name:bitlocker.fireeye.com error:N/A
  Oct 12 20:05:30 192.168.69.157 53749 10.35.30.248 443 cs_bytes:N/A cs_tls_version:N/A rs_tls_version:N/A cs_cipher_suite:N/A rs_cipher_suite:N/A rs_cert_common_name:N/A action:(ssl-1,whitelisted-0,block-0) s_site_name:bitlocker.fireeye.com error:N/A
  Oct 12 20:06:22 192.168.69.157 53751 54.209.82.95 443 cs_bytes:N/A cs_tls_version:N/A rs_tls_version:N/A cs_cipher_suite:N/A rs_cipher_suite:N/A rs_cert_common_name:N/A action:(ssl-1,whitelisted-0,block-0) s_site_name:N/A error:(error -Protocol error 71,ssl_error -sslv3 alert handshake failure 336151568)
  Oct 12 20:07:22 192.168.69.157 53753 54.209.82.95 443 cs_bytes:N/A cs_tls_version:N/A rs_tls_version:N/A cs_cipher_suite:N/A rs_cipher_suite:N/A rs_cert_common_name:N/A action:(ssl-1,whitelisted-0,block-0) s_site_name:N/A error:(error -Protocol error 71,ssl_error -sslv3 alert handshake failure 336151568)
........