Striim 3.9.7 documentation

ZeroContentCheck
Screen_Shot_2016-01-07_at_10.59.41_AM.png

ZeroContentCheck sends an alert when an access log entry's code value is 200 (that is, the HTTP request succeeded) but the size value is 0 (the return had no content).

CREATE CQ FindZeroContent
INSERT INTO ZeroContentStream
SELECT ale
FROM AccessStream ale
WHERE ale.code = 200 AND ale.size = 0;

The alert code is similar to HackerCheck's.

The typeOfActivity string for events written to the UnusualActivity WActionStore is ZeroContent).