Forefront Edge Security - Monitoring, Logging, Reporting Forum

How to exclude my PC (ip / hostname) from ISA 2006 Reports

Tue, 17 Nov 2009 09:44:16 Z

Dear Techies,

we recently installed ISA 2006 in our environment, all the users are accessing internet through ISA server, everything is going fine, IT manager is asking for webusage reports, In the web report I am the top user, I usually download lot of stuff from rapidshare, how can I exclude my ip and rapidshare from the reports.

Thanks in advance for your valuable replies.

Regards,

Phani Kumar .B

Re TMG 2010 Logging always shows destination port as 0 - no protocol information - and not a lot else - either a serious error or just my install

Sun, 15 Nov 2009 20:12:06 Z

I have TMG 2010 installed on a R2 server 2008 it seems to function fine i.e. have exchange edge installed and TMG exchange and this all seems to work however when I try to examine the logs they show pretty much as blank as you can see from below.

It never shows which port - the protocol - client ip - rule name etc these just show as blank.

WPAD and 2000+ Clients

Fri, 30 Oct 2009 14:20:04 Z

We have a small issue where we have multiple sites all using their own ISA server for internet access. This year we are replacing all the ISA servers with new servers. WPAD is configured in DHCP and working very well. The problem we are running into is when we switch the name in DHCP to the new server the clients do not get the new WPAD setting with the new server. The workstations are caching the servername. We can see it in the registry..... I've looked up on the internet and this seems to be a major issue with people. The manual process that is well documented work great but is a no go to expect our end users to do the task.

What I'm wondering if anyone has an automated way to doing this or even a different way?

Thanks

Setting up Proxy for Work/Mobile Users

Wed, 30 Sep 2009 18:41:43 Z

Good Day Everyone,

I have ISA 2006 and all we want to use for right now is web monitoring. We want to use reporting to keep a list of all the web sites visited in the company. I am able to do that right now.

My question is how do you use proxy for users who connect both at work and at home? If i setup WPAD for the office how do i make sure they can still surf the web at home? Is this even the best way to accomplish this?

Thanks in Advance for any help you can give

Monitor Internet Usage of VPN Users

Sat, 25 Jul 2009 19:18:25 Z

Hi Guys,

My requirements are to monitor ALL internet usage in my company. Employees also log onto the company network by using vpns. For the duration of the vpn connection company's internet gateway also acts as vpn users' default gateway. I m looking for a solution to monitor the internet traffic for local as well as vpn users, along with details like the duration of the vpn connection, when the connection was created & destroyed, as well as amount of bandwidth consumed by a particular user.

Is it possible to achieve this with ISA 2004/2006?

Regards,
wakh

Can we run a report on a specific user

Fri, 11 Sep 2009 17:28:33 Z

- I am testing beta version right now and new to FFsecurity. Can someone guide me how to
Can we run a report on a specific user, perticularly visiting of his websites, type of protocol he used (80,21) etc?

If I create a webaccess rule to permit but log all access to a particular site/group, can we run a report on that

TMG MBE cannot Generate Reports

Thu, 06 Aug 2009 15:50:06 Z

6.0.6417.100 MBE

Generating Report results, in The operation Failed.

Error: 0x80131040

Aldditional clue (Array no an object) this error reported only once, then the error above repeats endlessly.

Reports folder empty - error when opening report

Tue, 11 Aug 2009 15:18:01 Z

Hello,

Any report that is generated, when tried to open it, we recieve the error show in the below image

can anyone help me please ?

Random IP Addresses in ISA Server 06 logs - other than vpn private IP's and host IP's

Thu, 13 Aug 2009 18:19:28 Z

ISA Server 2006
Users connect through VPN and get assigned a 10.10.10.x IP address.

Looking through the logs, under "C_IP" (IP of requesting client) I see some IP addresses of the host (for updates and such, makes sense) and some private IP addresses of clients connecting through the VPN (10.10.10.x) but then I also see some random IP addresses. WHAT ARE THESE??

A whois does not give me much information at all... It shows they are are using HTTP to access websites... and they are being provided the service by my host IP address.

No one else should be connecting other than the host connections and the vpn users with the private IPs, so where are these coming from????

THANKS.

how to monitor users

Sun, 02 Mar 2008 16:12:44 Z

hi all

i want to monitor what each user open in the internet inside my company

i have isa2004

the reports of isa just giv me the top users,top website

but i want the sites viewed by each user

could you give me an idea

thank you

Changing (Modify) ISA w3c Logs

Wed, 05 Aug 2009 06:27:23 Z

Please help, to remove records about some users from isa logs. It is necessary to remove records of user activity during 2 months, from two isa servers.
Recommend to me some tools for this job.

Monitor all Internet usage

Tue, 07 Jul 2009 04:57:01 Z

Hi all,

I am looking at some way of setting up ISA server to be an Internet proxy server.
My experiences with it so far are far from spectacular.

Is there a way to set up the ISA Server 2006 to allow ALL traffic (I mean ALL) traffic and just log it.
At this stage we do not want to block anything, just log it and report it by username.

Is this possible?

I had it set up on a single network adapter computer to start with, and can understand that this would not work very efficiently.

I then set it up on a computer with two network cards, but still it is not working well.
The internet slows down far too much and the ISA server is still blocking stuff. I don't want it blocking anything.
I want a monitor, not a blocker.

Is ISA Server 2006 suitable for this?

If so, can anyone give some detailed instructions for how to configure it?

If not, can anyone recommend a better solution?

ISA Server 2006 Report generation

Mon, 16 Apr 2007 18:06:38 Z

About 3 weeks ago, I uninstalled a problematic ISA 2004 Std. and installed ISA 2006 Std. Now with 2006, I noticed that the scheduled weekly report is not running. When I manually started a report, it just reports Generating... It has been generating a report for about a week now. Is there a way to stop the generating report with out stopping services? Does anyone have any ideas about the source or a solution to this problem?

ISA 2004 Monthly report has no data.

Tue, 17 Apr 2007 01:50:09 Z

Hi,

my monthly report for march 2007 in isa 2004 has no data in it. The folder for the report is created as expected but there is no data in it. eg folder name is "Monthly Report_(dd.mm.200x-dd.mm.200x)".

There hasnt been any network changes or changes to any devices.

Things I have tried so far as a test to resolve the issue:

1. ran a monthly report manually - unsuccessful

2. ran march monthly report again - unsuccessful

3. ran weekly and daily reports maunally - success

4. checked folder security settings, accounts used to run reports - all ok.

5. ran previous to march report again - success

6. checked status of sql db connection and reporting services - ok

7. checked hard drive space. - sufficient.

A really descriptive error (not!) in a windows pop up appears when i try to view the march monthly report :

"ISA server error : The operation failed, error 0x80004005. unspecified error. "

Any assistance will be greatly appreciated.

cheers

Richard

Forefront Server Security Reporting

Sat, 11 Jul 2009 02:40:25 Z

Hi All,

We have deployed Forefront Server Security on Exchange 2007 Edge Transport Server long back , recently some changes were done by my colleague , which he can't recall now.

The problem is , I can't see the statistics of Messages and Attachments which I used to monitor weekly once.

How to get those Messages & Attachments Statistics ( report - Incidents - Statistics ) ??? as I need to make monthly report.

Thanks in Advanced.

Regards, Amjad

Monitoring and reports

Tue, 30 Jun 2009 13:50:23 Z

Hi

This is my situation:

I have ISA Server 2006 sitting between my network and the internet. The network (internal) users connect through ISA server for Web, FTP, Mail, etc. I want a way to "split" the bandwidth usage reports into Web and Mail. The mailserver we connect to is a a Hosted Exchange server that is located at our ISP.

Please can someone point me in the right direction?

SMTP AUTH problem with Exchange Server

Mon, 15 Jun 2009 23:38:12 Z

I have using Exchange Server for 2 years, mail is routed by ISP smarthost SMTP plaintext authentication, suddently last thursday, the server refuse to make SMTP AUTH, I thought password has been changed, I checked the password and it's ok. I reviewed the logs in SMTPVC, I found the SMTP connector does not make SMTP AUTH. I restablished the exchange configuration with the SBS2003 server administration tool, and SMTP connector continue without SMTP AUTH.

The only relevant issue was the Exchange Security update sp2 kb931832, instaled at the end of the last month. The server is SBS2003 sp1 R2 premium edition.

Details of the system:

Nombre del sistema operativo Microsoft(R) Windows(R) Server 2003 para Small Business Server
Versión 5.2.3790 Service Pack 1 Compilación 3790
Descripción adicional del sistema operativo No disponible
Fabricante del sistema operativo Microsoft Corporation
Nombre del sistema SBSRV
Fabricante del sistema Dell Inc.
Modelo del sistema PowerEdge SC440
Tipo de sistema X86-based PC
Procesador x86 Family 6 Model 15 Stepping 6 GenuineIntel ~2128 MHz
Procesador x86 Family 6 Model 15 Stepping 6 GenuineIntel ~2128 MHz
BIOS Versión/Fecha Dell Inc. 1.1.0, 27/09/2006
Versión de SMBIOS 2.3
Directorio de Windows C:\WINDOWS
Directorio del sistema C:\WINDOWS\system32
Dispostivo de inicio \Device\HarddiskVolume2
Configuración regional México
Capa de abstracción de hardware Versión = "5.2.3790.1830 (srv03_sp1_rtm.050324-1447)"
Nombre de usuario STARGDL\Administrador
Zona horaria Hora de verano central (México)
Memoria física total 2,046.00 MB
Memoria física disponible 124.63 MB
Memoria virtual total 3.85 GB
Memoria virtual disponible 1.79 GB
Espacio de archivo de paginación 2.00 GB
Archivo de paginación C:\pagefile.sys

I am grateful for any help.

Lorenzo Massimi

Attempted Attack - Can't Determine Method

Sat, 19 Jan 2008 15:37:47 Z

I have recently upgraded to SBS R2 with ISA Server 2004 and have noticed several failed login attempts in the security log. However, despite my exhausted efforts over the past several days, I can not determine what the perpetrator is using/doing to initiate the attacks. I have included my system info and excerpts from the security log below. Any help will be very much appreciated.

System Info:

OS Name Microsoft(R) Windows(R) Server 2003 for Small Business Server
Version 5.2.3790 Service Pack 2 Build 3790
Other OS Description Not Available
OS Manufacturer Microsoft Corporation
System Name SERVER02
System Domain WEBPULP
System Manufacturer Dell Computer Corp.
System Model PowerEdge 350
System Type X86-based PC

Security Log Excerpt:

1/16/2008 10:20:18 PM Security Failure Audit Logon/Logoff 529 NT AUTHORITY\SYSTEM SERVER02 "Logon Failure:
  Reason:  Unknown user name or bad password
  User Name: sales
  Domain:
  Logon Type: 3
  Logon Process: Advapi
  Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
  Workstation Name: SERVER02
  Caller User Name: SERVER02$
  Caller Domain: WEBPULP
  Caller Logon ID: (0x0,0x3E7)
  Caller Process ID: 1908
  Transited Services: -
  Source Network Address: -
  Source Port: -
"
1/16/2008 10:19:52 PM Security Failure Audit Logon/Logoff 529 NT AUTHORITY\SYSTEM SERVER02 "Logon Failure:
  Reason:  Unknown user name or bad password
  User Name: info
  Domain:
  Logon Type: 3
  Logon Process: Advapi
  Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
  Workstation Name: SERVER02
  Caller User Name: SERVER02$
  Caller Domain: WEBPULP
  Caller Logon ID: (0x0,0x3E7)
  Caller Process ID: 1908
  Transited Services: -
  Source Network Address: -
  Source Port: -
"
1/16/2008 10:19:34 PM Security Failure Audit Logon/Logoff 529 NT AUTHORITY\SYSTEM SERVER02 "Logon Failure:
  Reason:  Unknown user name or bad password
  User Name: backup
  Domain:
  Logon Type: 3
  Logon Process: Advapi
  Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
  Workstation Name: SERVER02
  Caller User Name: SERVER02$
  Caller Domain: WEBPULP
  Caller Logon ID: (0x0,0x3E7)
  Caller Process ID: 1908
  Transited Services: -
  Source Network Address: -
  Source Port: -
"
1/16/2008 10:19:10 PM Security Failure Audit Logon/Logoff 529 NT AUTHORITY\SYSTEM SERVER02 "Logon Failure:
  Reason:  Unknown user name or bad password
  User Name: pwrchute
  Domain:
  Logon Type: 3
  Logon Process: Advapi
  Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
  Workstation Name: SERVER02
  Caller User Name: SERVER02$
  Caller Domain: WEBPULP
  Caller Logon ID: (0x0,0x3E7)
  Caller Process ID: 1908
  Transited Services: -
  Source Network Address: -
  Source Port: -
"
1/16/2008 10:18:00 PM Security Failure Audit Logon/Logoff 529 NT AUTHORITY\SYSTEM SERVER02 "Logon Failure:
  Reason:  Unknown user name or bad password
  User Name: access
  Domain:
  Logon Type: 3
  Logon Process: Advapi
  Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
  Workstation Name: SERVER02
  Caller User Name: SERVER02$
  Caller Domain: WEBPULP
  Caller Logon ID: (0x0,0x3E7)
  Caller Process ID: 1908
  Transited Services: -
  Source Network Address: -
  Source Port: -
"

Reporting

Thu, 30 Apr 2009 14:32:29 Z

Can a back-dated report be generated & printed

ISA 2006 - Event ID: 21248 - Log Deletion Failure

Wed, 23 Jul 2008 20:32:21 Z

I use ISA 2006 SP-1 with SQL 2005 installed on the same machine.

Soon after installing the ISA already started presenting the alert "Log Deletion Failure."

The server has worked well not having any kind of problem, but I can not resolve this alert. I recently had to rebuild the base of the ISA,but the ISA still showing the error.

The ISA is usually written logs inside the base and the HD is over 31GB of disk space free, the file of the database is currently at 2.7 GB.

Searching on the Internet I found various reports that said that the problem was related to the MOM, but I do not use MOM.

Does anyone have any idea of how to solve this problem?

Event Viewer - Log Deletion Failure  

Event Type: Error  

Event Source: Microsoft Firewall  

Event Category: None  

Event ID: 21248  

Date:  18-07-2008  

Time:  12:20:40 PM  

User:  N/A  

Computer: S05  

Description:  

At least one log deletion failed while performing automatic log maintenance. Error code: 0x80070005. Make sure that there is still enough disk space available for logging.

ISA Server Reporting examples

Mon, 27 Apr 2009 08:21:50 Z

Hi,

We're currently looking for a solution to give us an overview of our users' Internet habits as well as bandwidth consumption etc. In other words we want some detailed reports on websites visited, servers/services contacted and the bandwidth involved.

I've heard that ISA Server if used as a proxy can provide this functionality. However I have not been able to find any example reports or screenshots on the web that shows me what's possible. I'd love to see some screenshots or html samples or the reporting functionality of ISA server.

Does anyone know where I can find any of the above ?

Best Regards,

Henrik Hejlesen

How can I view the contents of the cache of Forefront TMG Beta 2 ?

Tue, 21 Apr 2009 09:01:36 Z

Hi,

I'm evaluating the Beta 2 of Forefront TMG. I'm playing with its cache capabilites and have created several Cache Rules that define content from which sites will or wont be cached.

How can I view the contents of the cache, so that I'm sure my rules are working as expected?

Thanks in advance,
Lubo.

reporting a particular user

Sun, 01 Mar 2009 17:41:43 Z

Hey, ISA server reports are somehow useless when it comes to know detail info regarding a specific user ! I need to know what user X has visited, which dates, at what time .

ISA server reports shows you top websites surfed and top users, but there is no relation between the two. does this mean I'm forced to have a third party software that will get these info from the sql files that ISA server generates ?

Web Filter referenced by Server does not exist

Wed, 04 Mar 2009 01:56:55 Z

Whenever I try to backup/export my ISA servers configuration I get:

Web Filter referenced by Server XXX does not exist.

The error occured on object XXX of class 'Server in the scope of array XXX.

How can I determine exactly what the problem is so I can get a valid backup?

Thank you in advance for any assistance.

Finding a user session

Tue, 13 Jan 2009 15:07:05 Z

My firewall shows the destination and time of a user visiting a website that attempted to download a compromise to their PC. Before ISA, it would also show their original internal IP address which would allow me to backtrack to who was doing the browsing and allow me to follow up. Now all I get is the IP address of the ISA Server.

So I need some way to run a report that will allow me to find out who (or what PC) visited said site during the time of the attempted compromise. I haven't been able to find this, although I did find one thread that *might* get me what I'm looking for in a kludgy way (a lot of other sessions in the report, go find the one you need). I'd like to be able to build a query using the destination IP and time to narrow things down considerably.

Any suggestions? Thanks!

How to send ISA 2004 web report via email

Wed, 07 Jan 2009 00:53:36 Z

HI All

I have configured ISA 2004 to generate a report everyday and send me via email. I do get email but there is no report attached to it or report in the email.

Report generation wizard has very clear option to "send this report via email" which is configured correctly but still do not send report with email.

SP3 installed

Is there anyway I can send this report to me via email??

Please help

Thanks in advance
Ajay

Error 0c8007013d when trying to copy all results to clipboard

Thu, 13 Mar 2008 09:03:22 Z

All, we are running ISA 2004 SP3 and I am trying to copy all monitoring results to the clipboard for use in further troubleshooting. However, I get an error saying:

A failure occurred. The task was not activated and Error: 0x8007013d.

Details: The system cannot find message text for message number 0x%1 in the message file for %2.

This causes me not to be able to copy to the clipboard.

I have narrowed it down to one entry in the list, whenever I try to copy that I get the error. I cannot see anything special for the entry.

Has anyone come across anything like this before? I have been searching the internet for solutions, but have found none...

ISA 2006 and SQL Logging Error

Thu, 08 May 2008 19:34:43 Z

I am logging my ISA 2006 proxy and firewall log directly to a SQL 2000 server. Every once in awhile the service will stop because of an error:

Event Type:    Error
Event Source:    Microsoft ISA Server Web Proxy
Event Category:    Log
Event ID:    21204
Date:        5/8/2008
Time:        12:59:15 PM
User:        N/A
Computer:    ****
Description:
The ISA Server Web filter failed to log information to SQL Database ISA_Logs. The SQL Error description is: Timeout expired.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 31 0e 04 80               1..€

This seems to happen during high traffic periods. I was wondering if this is occuring when the database files are growing because they have reached their allocated space. Will the expansion of the database file impact the ability to write to the SQL tables contained in this database, causing this problem?

Thanks,

ISA 2004 Logging Filter

Fri, 07 Mar 2008 10:18:01 Z

Hello,

I have created a filter in the logging section of ISA 2004 to show users that have connected to our network from an external source. Is there a way to just view a list of users connecting to the network, as at the moment it is bringing up more information than is needed? I want to see who has connected to the network only.

Any help would be much appreciated.

ISA and SNMP

Fri, 12 Dec 2008 11:52:02 Z

I’m a ISA novice and I was wondering if is possible to monitor ISA services thru SNMP trap.

I tried enabling the standard SNMP service (before install my isa test server), but i was not able to find any details about its OID (no discussion about, no details on the guide…).
Do I need to enable ISA mibs in windows SNMP service before? (How?) or is automatically did and i've just to trap the right OID.

I found some .mib files in the installation cd, I used the oid written inside, but I wasn’t able to get any trap work.

Any help would be appreciated
Thanks,
Matteo

log a specific user

Fri, 26 Sep 2008 13:33:50 Z

Hey everone. I start playing with ISA server and create daily reports, but the report is not showing exactly what sites are being surfed by each user. it only shows the top users and top visited sites. but no relation between both ! any hints please ?

ISA Server cannot connect to the Configuration Storage server

Fri, 26 Sep 2008 08:10:16 Z

Dear All

There is an error occured when I open the ISA Server Management console.

ISA Server cannot connect to the Configuration Storage server.

The ISASTGCTRL service terminated with the following error:

A device attached to the system is not functioning.

How can I resolve this issu.

Thanks.

Mahmood Shah

Configure Web Usage Reports to log usernames and urls

Thu, 22 May 2008 10:21:52 Z

Hi,

I've used ISA for a few years but I've never needed to make use of the report features until now. The reports that are generated show users as client IP addresses and URL's as target IP addresses rather than showing the username or the URL. I'm pressuming this is probably because our clients are SecureNAT clients. I don't particularly want to change the client type can someone tell me how to get ISA Reports to show URLs and usernames.

Thanks

HDZ

Correlate errors

Mon, 18 Aug 2008 08:53:04 Z

Hiya,

I keep getting config errors saying that the ISA Server detected routes through the network adapter External that do not correlate with the network to which this network adapter belongs....

Address range in the error is: 11.255.255.255-11.255.255.255.

It does say that is can be safely ignored, but when I acknowlegde it, it keeps coming back!

Got a site-to-site VPN running, with static assignment using 11.0.x.x, and the error appears both ends.

ISA Server 2004 way to find when rule was created?

Fri, 18 Apr 2008 19:28:11 Z

Hello,

I recently noticed a new rule on my ISA 2004 server firewall policy. Is there a way to go through logs and see what user and when the rule was created and applied?

Thanks for your help

ISA Server 2004 (SBS) - Long running external SecureNAT sessions

Thu, 07 Aug 2008 17:49:48 Z

When I look at the Sessions tab in ISA Server 2004, I often see long running SecureNAT sessions from an external source network. Doing a nslookup on the IP addresses often return Turkey, Russia, China, etc. I have been manually terminating these as I see them. They connection time is often 2-3 days.

Are we under attack?

How can I tell what these connections are being used for?

I don't see them listed in the Exchange SMTP Current Sessions page, so I don't think they are connected to e-mail.

find out how many users connection?

Fri, 16 May 2008 15:52:20 Z

Is there a way for me to find out how many users connect to the ISA server? I ran the report but it only show the Top Ten Users. I would like to find out all the users that connect to the ISA server. Is there a way to gather the information for like the past 4 days?

Thanks

Proxy 2.0 Logs

Fri, 28 Mar 2008 19:55:09 Z

We are still running proxy 2.0 to provide access to the internet at our facility. Is there a way to pass the username to the proxy so that the logs store the connected username instead of anonymous? I do not want to block access to the proxy through a restriction and require authentication. I am not sure if proxy 2.0 will allow this? I thought there was a way to do this through group policy. Any help greatly appreciated with this ancient application.

Thanks,

Seth

ISA2004 enterprise edition monitoring problem

Mon, 10 Mar 2008 09:19:44 Z

Hi,

My enterprise set up consists of two arrays over two sites connected with a VPN. Each array contains two ISAs - there is a CSS at each site too. The problem is as follows:

If I am on the CSS in SiteA, I can see both of SiteA's servers as green. If I drill down to SiteB only one ISA can be connected to and it is always the VPN end-point. The reverse is true, if I am in SiteB and attempt to monitor SiteA, only one server can be contacted.

Monitoring is being performed over the Internal and VPN networks; when I run some log filters it detects the monitoring connection attempt and blocks them as spoofed. I have tried disabling spoof detection; however, I get the same result (?). I guess it's all down routing, but I don't really know what to do...

I notice in the properties on the ISA servers, a monitoring IP can be specified - I am assuming this is my best bet to get it working, however, it seems to make it worse as I loose sight of all of the ISAs (probably need to add a rule / adjust membership of one of the built-in groups - not sure though).

Has anyone achieved this before, is it even supported? Any help / suggestions would be gratefully received.

Thanks!

jpf75

Logging showing IP instead of Client Names

Thu, 14 Feb 2008 06:48:42 Z

Hi

After registering the Hostlogger it still shows IP instead of client name except for 2-3 users.

How can it be ractified

Thanks