The log entries created (without syslog header) are similar to the following:
some-web-module[123456]: web 192.11.13.5 778 login 0 s backup now
some-web-module[123456]: web 192.11.13.5 778 login 0 s backup now | acp xln | uncheck
some-web-module[123456]: web 192.11.13.5 778 login 0 s backup now | security files | check
some-web-module[123456]: web 192.11.13.5 778 login 0 s backup now | ftp | check
some-web-module[123456]: web 192.11.13.5 778 login 0 s backup now | user name | backupoperator
some-web-module[123456]: web 192.11.13.5 778 login 0 s backup now | password | *
some-web-module[123456]: web 192.11.13.5 778 login 0 s backup now | hostname | dataserver
some-web-module[123456]: web 192.11.13.5 778 login 0 s backup now | directory | /cm
some-web-module[123456]: web 192.11.13.5 778 login 0 s backup now | button | start backup
Only the first event is logged unless the user clicked the Start Backup button. Field changes are not logged unless the page is actually submitted. The field name Avaya Call Processing (ACP) Translations is abbreviated to try to make the log entry as short as possible, yet still recognizable.