I wrote on ISA server some store procedure scripts to calculate users (IP) traffic through ISA firewall to internet within a time range. I examed the FirewallLog fields, there are a lot of rows for userIP to ISA port 1745, and rows of source/destination network = localhost, and rows with differnt Result code, as well as different Action codes. etc.
Could some advice me the filters to calculate user's Internet receivedata and sentdata, like Rule="allowed traffic -such as http/https/ftp etc", Action code=?, Result code=? source network=? destination network=?
I just want to see, for example, how much a user downloaded or sent over internet, where it went, with what apps.
I am using ISA 2006. I just ran ISA Management > Monitoring > Reports, Then create a new report for yesterday, and all content to report, but there is nothing in the report: all charts and graphs showed blank. Strange! I could generate a report years ago. Anyway I'd appreciate anyone give me some advices to query the MSDE directly for example, last night 10pm to 11pm, which user is the biggest downloader...etc,