Perflow and Subsession Variables

Last authentication result.

Agent category type.

0

(success) or

1

(failure).

Reason for agent failure.

Status of the agent license.

Type of agent license.

Agent state.

Set by the Request Classification agent when the matching path is associated with a server. Also set by the API Server Selection agent.

API traffic user ID.

API traffic user group ID.

API traffic client application ID.

API traffic service tier.

API traffic organization ID.

Set by the API Rate Limiting Enforcement agent if an error occurred.

API proxy error.

API proxy authorization type.

Set by the API Rate Limiting Enforcement agent indicating whether enforcement succeeded.

APM daemon state.

0

(block) or

1

(allow).

Name of the application that is ultimately used.

Name of the application family that is ultimately used.

Comma-separated list of application families.

Comma-separated list of application names.

Name of the application that APM determines is the primary one.

Name of the application family that Access Policy Manager (APM) determines is the primary one. (An application might fit into more than one application family.)

SSL bypass lookup result.

Password from Assign Credentials agent.

Shared password from Assign Credentials agent.

Username from Assign Credentials agent.

Name of branching URL.

0

(http) or

1

(https).

0

(success) or

1

(server failure).

Comma-separated list of categories.

Unique number that identifies a custom category; used internally.

Name of the display category.

Name of the category that is ultimately used.

Name of the URL filter.

Host name retrieved from SSL input.

Integer. Total number of categories in the comma-separated list of categories.

Integer. Total number of custom categories in the comma-separated list of custom categories.

Name of the category that APM determines is the primary one. (A URL might fit into more than one category, such as news and sports.)

Requested URL.

Client information.

Client information header.

Client information metadata header.

Client IP address.

Client port number.

Credential block.

Unique number that identifies a custom category; used internally.

Custom flow.

0

(continue) or

1

(cancel) selected for the Confirm Box action in the subroutine.

Ending redirect captive portal URL.

End-point inspection error code.

End-point inspection result.

Continent based on geolocation of the IP address.

Country code based on geolocation of the IP address.

Country name based on geolocation of the IP address.

Geolocation failure.

Region based on geolocation of the IP address.

IP reputation failure.

IP reputation result.

iRule agent ID.

Layer 7 protocol lookup result.

User error displayed at the top of the logon page.

User error displayed at the top of the logon page.

Last logon.

Saved user credentials block.

Name of mangled URL.

Subroutine subsession.

OAuth scope header name.

OAuth scope header value.

OAuth scope status codes.

OAuth scope status string.

0

(success) or

1

(failure) of On-Demand Certificate authentication in the subroutine.

Originating URI of the On-Demand Certificate in the subroutine.

Policy path.

Policy path count.

http

or

https

. Defaults to https.

Proxy select reuse.

0

(No) or

1

(Yes)

Redirect URL.

Renderer status code.

Where renderer status code is from.

Where renderer status code is going to.

Renderer token.

Renderer URL.

0

(success) or

1

(server failure).

Set by the Request Classification agent.

Pool name assigned.

0

(success) or

1

(server failure).

Response header names.

Response headers number.

Response headers set.

Response header values.

Set by the Response Selection agent.

Validated credentials to save. If

perflow.save.validated.credentials

is activated from Logon page, then the <Validated Credentials Prefix>.username = username used for authentication, and <Validated Credentials Prefix>.password = password used for authentication.

Scratchpad.

Scratchpad flow.

Service path.

0

(Not found) or

1

(found). Session found during service check.

Session ID.

Server IP address.

Server port number.

0

(bypass) or

1

(intercept). SSL Bypass Set and SSL Intercept Set items update this value.

0

(bypass) or

1

(intercept). Specified in the client SSL profile, used when SSL Bypass Set and SSL Intercept Set items not included in per-request policy.

0

(Not found) or

1

(found). SSL check found SSL.

Client SSL cipher name.

Client SSL cipher version.

Server SSL cipher name.

Server SSL cipher version.

Server SSL certificate response control.

Server SSL certificate status.

Single sign on configuration name.

Subroutine gating expression.

0

(validated) or

1

(invalidated) subroutine.

Subroutine loop countbown.

Name of the subroutine.

Name of the subroutine out terminal.

Subroutine skip agent flag.

Subsession ID.

Subsession length.

Subsession lookup.

Subsession state.

Subsession state lookup.

Secure Web Gateway consumer license.

Secure Web Gateway limited consumer license.

3

(confirm),

2

(block) or

1

(allow).

User name.

Number of iterations remaining on a subroutine loop.

User's domain from AD for the last login.

$attr_name is a value that represents the user’s attributes received from the Active Directory. For example, displayName, distinguishedName, givenName, memberOf, name, objectGUID, primaryGroup, pwdLastSet, sAMAccountName, userAccountControl, and userPrincipalName.

0

(success) or

1

(failure) of Active Directory authentication in the subroutine.

Displays the error message for the last login.

Result of the Active Directory query.

0

(failure) or

1

(success)

Set by the API Authentication agent. Set to either

basic

or

bearer

based on the authentication header in the request.

Stores full response payload, when

response-action

is set to

save

. When

response-action

is set to

parse

, response body is parsed as JSON and all leaf values are stored as subsession variables under

subsession.http_connector.body

prefix.

Set to

0

, if HTTP connector is able to receive and parse (if needed) HTTP response.

Variables store response headers. For example, subsession.http_connector.header.Set-Cookie

Contains the HTTP status code of response when received.

0

(success) or

1

(failure) of LDAP authentication in the subroutine.

Displays the error message for the last login.

Displays extended error message from the last login. This can be used to obtain extended information from some endpoints such as user account expiration status from a Windows Global Catalog.

Password for the last login.

Result of the LDAP query.

0

(failure) or

1

(success)

Number of matches to query

User name for the last login.

Last authentication type

Output by the Okta MFA agent and displays the factor name (okta_totp, okta_push, or yubico_otp) upon successful Okta authentication.

Output by the Okta MFA agent and displays 1 upon successful Okta authentication or enrollment.

Timeout including the current time (Unix format)

Timeout time in seconds of OTP

Generated value of OTP

Output after OTP Verify agent reads the OTP token value and compares the current time with the expiry time and produces a result.

Displays the OTP verify error message.

Indicates how the user was authenticated: Radius, local or remote.

RADIUS accounting status on whether it is the start or end of accounting.

RADIUS accounting NAS-IP address

RADIUS accounting NAS-IPv6 address

RADIUS accounting NAS port

RADIUS accounting result on whether the START message is sent to the accounting server.

RADIUS accounting server

RADIUS accounting service type.

Time when the last START message was sent to the RADIUS Accounting agent.

RADIUS attribute filter ID

RADIUS attribute framed compression.

RADIUS attribute framed MTU.

RADIUS attribute framed protocol.

RADIUS attribute service type.

Displays the error message for the last login.

0

(success) or

1

(failure) of RADIUS authentication in the subroutine.