Welcome to ISAserver.org

Session Monitoring

Users viewing this topic: none

Logged in as: Guest

Printable Version

All Forums >> [ISA 2006 Misc.] >> ISA 2006 Programming >> Session Monitoring

Page: [1]

Message

<< Older Topic Newer Topic >>

Session Monitoring - 29.Feb.2008 8:40:45 AM

david_reindorf

Posts: 6
Joined: 23.Dec.2007
Status: offline

I can get the session and the client IP with the code at the bottom.
What I still need is to know what url the client is requesting in this session.

In FPCSessionsMonitorEntry is no such information.
But there is a SessionID. I guess I need to give this ID to somewhere to get
info about this.

FPCSessionsMonitors monitors = isaArray.SessionsMonitors;
FPCSessionsMonitor proxyMonitor = monitors.SessionsMonitorWebProxy;

while (true){
   proxyMonitor.ExecuteQuery(new FPCFilterExpressions(), 10000);
   foreach (FPCSessionsMonitorEntry session in proxyMonitor){
       Console.WriteLine(session.ClientIP);
   }
   proxyMonitor.EndQuery();
}

Post #: 1

Featured Links*

RE: Session Monitoring - 1.May2008 8:20:53 PM

fixitchris

Posts: 124
Joined: 23.May2007
Status: offline

Any update on this?

(in reply to david_reindorf)

Post #: 2

RE: Session Monitoring - 2.May2008 5:39:07 AM

david_reindorf

Posts: 6
Joined: 23.Dec.2007
Status: offline

No. Still no clue.

(in reply to fixitchris)

Post #: 3

RE: Session Monitoring - 2.May2008 10:39:25 AM

fixitchris

Posts: 124
Joined: 23.May2007
Status: offline

It looks like a SESSION is a session between the client and ISA. It has nothing to do with proxy connections from ISA to destination (eg. google.com). You have to use the log viewer to see the live log content.

quote:

Public Sub Monitor()
   'Logs

   Dim Log As FPCLogContent = Me.mIsaArray.LogViewer.LogContentOnline
   Dim logEntry As FPCLogEntry
   Dim LogFilter As FPCFilterExpressions = New FPCFilterExpressions
LogFilter.FilterType = FpcFilterType.fpcLogViewerFilter
Log.ExecuteQuery(LogFilter, 10000)
   For Each logEntry In Log
      'Debug.WriteLine(logEntry.LogTime & vbTab & logEntry.ClientIP & vbTab & logEntry.ClientUserName & vbTab & logEntry.DestHost & vbTab & logEntry.Rule & vbTab & logEntry.URL)

      If (logEntry.service = FpcLogServiceType.fpcLogServiceProxy Or _
    logEntry.service = FpcLogServiceType.fpcLogServiceReverseProxy) Then

       Debug.WriteLine(logEntry.LogTime & vbTab & logEntry.ClientIP & vbTab & logEntry.DestHost & vbTab & logEntry.Operation & vbTab & logEntry.FWAction)
         If logEntry.ClientIP = "172.16.4.242" Then

          KillSession(logEntry.ClientIP)
         End If

     End If

   Next

Log.EndQuery()

End Sub

< Message edited by fixitchris -- 2.May2008 10:53:58 AM >

(in reply to david_reindorf)

Post #: 4

RE: Session Monitoring - 2.May2008 10:45:52 AM

fixitchris

Posts: 124
Joined: 23.May2007
Status: offline

Here is the code to kill a session.
Here is what I found out:
1. DisconnectSession only works on the SessionsMonitorFirewall and not SessionsMonitorWebProxy,
2. ExecuteQuery runs fine 1st time, but it chokes 2nd time around after DisconnectSession is called.
3. IPAddressFilter sometimes chokes.
4. Interop sucks.

If you can figure out what the problem is , let me know.

quote:

Private Sub KillSession(ByVal IPadd As String)
'Sessions
Debug.WriteLine("fwmon startquery")
Dim monitors As FPCSessionsMonitors = Me.mIsaArray.SessionsMonitors
'Dim proxyMonitor As FPCSessionsMonitor = monitors.SessionsMonitorWebProxy
Dim firewallMonitor As FPCSessionsMonitor = monitors.SessionsMonitorFirewall
Dim session As FPCSessionsMonitorEntry
Dim filter As New FPCFilterExpressions
filter.FilterType = FpcFilterType.fpcSessionsFilter
'filter.AddIPAddressFilter(FpcFilterCriteria.fpcFilterByClientIP, FpcFilterCondition.fpcEqual, IPadd)
'filter.AddStringFilter(FpcFilterCriteria.fpcFilterByClientIP, FpcFilterCondition.fpcEqual, IPadd)

'proxyMonitor.ExecuteQuery(filter, 10000)
firewallMonitor.ExecuteQuery(filter, 5000)
'session = proxyMonitor.Item(1)
'proxyMonitor.DisconnectSession(session.ServerName, session.SessionID)
For Each session In firewallMonitor 'proxyMonitor
'Debug.WriteLine(session.ClientIP)
If session.ClientIP = IPadd And _
session.Event = FpcSessionMonitorEvent.fpcSessionFound Then
'session.SessionType = FpcSessionType.fpcProxySession And _
firewallMonitor.DisconnectSession(session.ServerName, session.SessionID)
Debug.WriteLine(session.SessionID & " killed.")
End If
Next
firewallMonitor.EndQuery()
firewallMonitor = Nothing
Debug.WriteLine("fwmon endquery")
'proxyMonitor.EndQuery()
End Sub