Sign in
 
HomeProductsLibraryLearnDownloadsSupportForums
Microsoft Forefront TechCenter > Forefront Forums > Read Only - Forefront Edge Security - Monitoring, Logging, Reporting > Configure Web Usage Reports to log usernames and urls

Locked Configure Web Usage Reports to log usernames and urls

    •  
      Thursday, May 22, 2008 10:21 AM
       
       
      Sign In to Vote
      0
      Sign In to Vote

      Hi,

       

      I've used ISA for a few years but I've never needed to make use of the report features until now.  The reports that are generated show users as client IP addresses and URL's as target IP addresses rather than showing the username or the URL.  I'm pressuming this is probably because our clients are SecureNAT clients.  I don't particularly want to change the client type can someone tell me how to get ISA Reports to show URLs and usernames.

       

      Thanks

       

      HDZ

         

      Answers

      • Wednesday, October 15, 2008 7:10 PM
        Owner
         
         Answered
        Sign In to Vote
        0
        Sign In to Vote
        Guys,

        Dan and El are correct. an ISA Server has no knowledge about the existance of a SNAT client other than in the context of an IP and port. Since authentication is handled at a much higher layer, there is no authentication mechanism in the layers at with SNAT interacts with ISA hence it cannot authenticate. You cannot have usernames or urls logged for SNAT since SNAT does no authentication and because SNAT resolves the hostnames itself it will only send an IP to the ISA server to fetch the request.

        HTH
        Mohet
           

        All Replies

        • Friday, May 23, 2008 8:11 AM
          Moderator
           
           
          Sign In to Vote
          0
          Sign In to Vote

          Hi,

           

          To get the username of your users , you will need to authenticate them , that is to set them as Web Proxy Clients as an example.

           

          In your case, you dont want to change the client type, so unfortunately, you will not be able to log usernames.

           

          However, regarding the URL instead of IPs, the solution is in th free hostname logger filter that i host on my website , check it here :  Hostname Logger v 1.2 for ISA Server

           

          HTH,

          Tarek

          _____________________________
          Tarek Majdalani
          MVP -- ISA Firewalls
          Website : http://www.elmajdal.net/ISAServer

             
          • Thursday, June 05, 2008 12:55 AM
             
             
            Sign In to Vote
            0
            Sign In to Vote

            Hi ElMajdal,

            I tried your Hostname Logger using SecureNAT but unfortunately still IP address shown on my ISA reports. I followed carefully the instruction. Is there any alternative like third party software to change IP address to computer name or the domain of the IP?

            Regards,

            Jes

               
            • Thursday, June 05, 2008 10:17 AM
              Moderator
               
               
              Sign In to Vote
              0
              Sign In to Vote
              Hi,

              The Filter that is hosted on my website does not log the machine it, but it converts the IP address of the webiste you are visiting to URL ( in the reports )

              so in your reports you set the top visited sites in IPs and not with URL name, here comes my filter and removes these IPs and shows your the URL of the website you are visiting, not the machine you are working from. 

              _____________________________
              Tarek Majdalani
              MVP -- ISA Firewalls
              Website : http://www.elmajdal.net/ISAServer

                 
              • Thursday, October 09, 2008 3:22 AM
                 
                 
                Sign In to Vote
                0
                Sign In to Vote
                Hi HDZ,

                I think you have answered your own question. The only clients that can provide authentication are Web Proxy and Firewall Clients. The SecureNAT client only points it traffic to ISA. There is no authentication. Try reconfiguring your client as a web proxy or firewall client and see if you start getting usernames in the logs.

                Dan Watson
                   
                • Wednesday, October 15, 2008 7:10 PM
                  Owner
                   
                   Answered
                  Sign In to Vote
                  0
                  Sign In to Vote
                  Guys,

                  Dan and El are correct. an ISA Server has no knowledge about the existance of a SNAT client other than in the context of an IP and port. Since authentication is handled at a much higher layer, there is no authentication mechanism in the layers at with SNAT interacts with ISA hence it cannot authenticate. You cannot have usernames or urls logged for SNAT since SNAT does no authentication and because SNAT resolves the hostnames itself it will only send an IP to the ISA server to fetch the request.

                  HTH
                  Mohet