Welcome to ISAserver.org

MSDE Log Maintenance

Users viewing this topic: none

Logged in as: Guest

Printable Version

All Forums >> [ISA Server 2004 Firewall] >> Logging and Reporting >> MSDE Log Maintenance

Page: [1]

Message

<< Older Topic Newer Topic >>

MSDE Log Maintenance - 29.May2006 3:09:23 AM

textguru

Posts: 223
Joined: 4.May2004
From: Philippines
Status: offline

I have installed ISAS 2004 SP2 on Windows Server 2003 R2 and thinking about managing the logs when it populates a lot of space on the system partition. Can I possibly archive its content so that it will reduce file size?

Post #: 1

Featured Links*

RE: MSDE Log Maintenance - 31.May2006 5:18:26 AM

J.F.

Posts: 42
Joined: 28.Nov.2005
Status: offline

Hello:

You can, but it's easier to do so if you log to text logs instead of to MSDE. The text log files can then be copied off the firewall, compressed, and stored indefinitely. You can compress the data with NTFS compression, zip, or gzip; you can get free Windows gzip/gunzip tools from http://unxutils.sourceforge.net. The W3C logs are easy to import into other databases and easy to search with SQL tools like the free Microsoft Log Parser (http://www.LogParser.com). Finally, logging to text files requires about 10% less CPU overhead than logging to MSDE and you don't have to worry about memory leaks; on the other hand, you lose the ability to do historical queries in the ISA management console.

Hope this helps!

JF

(in reply to textguru)

Post #: 2

RE: MSDE Log Maintenance - 31.May2006 5:26:35 AM

textguru

Posts: 223
Joined: 4.May2004
From: Philippines
Status: offline

thanks for the reply. Does it mean that it is much better to use a text log file instead of database logfile? Actually I am a previous user of ISAS2000 using text logfile for firewall and webproxy logs. but since ISAS2004 have historical queries feature, which is very helpful to search activities of the system.

what does isaserver.org recommends on activity logging?

(in reply to J.F.)

Post #: 3

RE: MSDE Log Maintenance - 1.Jun.2006 6:55:34 PM

J.F.

Posts: 42
Joined: 28.Nov.2005
Status: offline

> Does it mean that it is much better to use a text log file instead of database logfile?

Well, "better" is relative to what you want to accomplish, so, for example, if you really like the historical query GUI, then MSDE logging is better despite the slight performance impact. I personally prefer text logs since they're easier to manipulate with scripts and command-line tools, but it's a very debateable issue.

> what does isaserver.org recommend on activity logging?

I don't work here, I'm just a vagrant -- that's a question for Tom! :-)

(in reply to textguru)

Post #: 4

RE: MSDE Log Maintenance - 2.Jun.2006 1:07:28 AM

Jason Jones

Posts: 2121
Joined: 30.Jul.2002
From: United Kingdom
Status: offline

File logging will give you the best performace of all logging options, but you lose features like searching historical data in the ISA MMC as mentioned by J.F. You can still control max logging size and age though.

MSDE is often the best solution for simplicicity and gives more control of info in the ISA MMC including historic monitoring/reporting. ISA can also automatically manage the size and age of content in the MSDE database. The MSDE instance included with ISA cannot be accessed "off-box" though.

SQL logging tends to be best when you want centralised, "off-box" log storage/reporting and need to use SQL queries of SQL reporting services to look at log content.

This may also help: http://www.microsoft.com/technet/prodtechnol/isa/2004/plan/logging-best-practices.mspx

JJ

< Message edited by Jason Jones -- 2.Jun.2006 1:11:34 AM >

_____________________________

Jason Jones (MVP)

Silversands Limited http://www.silversands.co.uk
My Blog: http://blog.msfirewall.org.uk/

Get our NEW ISA 2006 Book!: http://tinyurl.com/2gpoo8

(in reply to J.F.)

Post #: 5

RE: MSDE Log Maintenance - 2.Jun.2006 3:15:41 AM

textguru

Posts: 223
Joined: 4.May2004
From: Philippines
Status: offline

where do ISAS 2004 store the MSDE log database? I cant find it on the server. I just wanted to know how big is my database now.

(in reply to Jason Jones)

Post #: 6

RE: MSDE Log Maintenance - 2.Jun.2006 11:06:14 AM

Jason Jones

Posts: 2121
Joined: 30.Jul.2002
From: United Kingdom
Status: offline

<Install Drive>:\Server Applications\Microsoft ISA Server\ISALogs

_____________________________

Jason Jones (MVP)

Silversands Limited http://www.silversands.co.uk
My Blog: http://blog.msfirewall.org.uk/

Get our NEW ISA 2006 Book!: http://tinyurl.com/2gpoo8

(in reply to textguru)

Post #: 7

RE: MSDE Log Maintenance - 5.Jun.2006 1:10:23 AM