Welcome to ISAserver.org

Log application names accessing the internet

Users viewing this topic: none

Logged in as: Guest

Printable Version

All Forums >> [ISA 2006 Firewall] >> Logging and Reporting >> Log application names accessing the internet

Page: [1]

Message

<< Older Topic Newer Topic >>

Log application names accessing the internet - 12.Feb.2008 6:05:11 AM

awdhil

Posts: 1
Joined: 12.Feb.2008
Status: offline

I am not a network admin. So I might not be making much sense but I need this information to be provided for a project, and my infrastructure/proxy team says they cannot provide this info as ISA does not allow it...

What I require is....

A list of my business applications that access the internet through a given proxy/firewall. We are setting up a malware perimeter defence and need to give some sites trusted status. And we believe our business apps can be trusted. :-)

I cannot ask each of the divisions to give me this info as they themselves would not know... How would they know which appln goes through which proxy/firewall?

I am sure we can log which apps access the internet over a period of time and generate a report from the ISA log itself. But the proxy team thinks otherwise....

On further talks these guys gave me the firewall report, and these r the headers...

Fields: c-ip
cs-username
c-agent
date
time

s-computername
r-host
r-ip
r-port
time-taken

cs-bytes
sc-bytes
cs-protocol
cs-transport

s-operation

sc-status
s-cache-info
rule#1
rule#2
sessionid
connectionid

There is also a column with no header... some values are GHBN (i believe Get Host By Name)

Please let me know whether this can be done or not, and if it can how they need to do it... Detailed expln would be helpful....

Thanks & Regards
Awdhil
Project Manager - Delivery