• RSS
  • Twitter
  • FaceBook

Welcome to ISAserver.org

Forums | Register | Login | My Profile | Inbox | RSS RSS icon | My Subscription | My Forums | Address Book | Member List | Search | FAQ | Ticket List | Log Out

Session Monitoring

Users viewing this topic: none

Logged in as: Guest
  Printable Version
All Forums >> [ISA 2006 Misc.] >> ISA 2006 Programming >> Session Monitoring Page: [1]
Login
Message << Older Topic   Newer Topic >>
Session Monitoring - 29.Feb.2008 8:40:45 AM   
david_reindorf

 

Posts: 6
Joined: 23.Dec.2007
Status: offline
I can get the session and the client IP with the code at the bottom.
What I still need is to know what url the client is requesting in this session.

In FPCSessionsMonitorEntry is no such information.
But there is a SessionID. I guess I need to give this ID to somewhere to get
info about this.

FPCSessionsMonitors monitors = isaArray.SessionsMonitors;
FPCSessionsMonitor proxyMonitor = monitors.SessionsMonitorWebProxy;

while (true){
   proxyMonitor.ExecuteQuery(new FPCFilterExpressions(), 10000);
   foreach (FPCSessionsMonitorEntry session in proxyMonitor){
       Console.WriteLine(session.ClientIP);
   }
   proxyMonitor.EndQuery();
}
Post #: 1
RE: Session Monitoring - 1.May2008 8:20:53 PM   
fixitchris

 

Posts: 148
Joined: 23.May2007
Status: offline
Any update on this?

(in reply to david_reindorf)
Post #: 2
RE: Session Monitoring - 2.May2008 5:39:07 AM   
david_reindorf

 

Posts: 6
Joined: 23.Dec.2007
Status: offline
No. Still no clue.

(in reply to fixitchris)
Post #: 3
RE: Session Monitoring - 2.May2008 10:39:25 AM   
fixitchris

 

Posts: 148
Joined: 23.May2007
Status: offline
It looks like a SESSION is a session between the client and ISA.  It has nothing to do with proxy connections from ISA to destination (eg. google.com).  You have to use the log viewer to see the live log content.
 

quote:



Public
Sub Monitor()
   'Logs

   Dim Log As FPCLogContent = Me.mIsaArray.LogViewer.LogContentOnline
   Dim logEntry As FPCLogEntry
   Dim LogFilter As FPCFilterExpressions = New FPCFilterExpressions
LogFilter.FilterType = FpcFilterType.fpcLogViewerFilter
Log.ExecuteQuery(LogFilter, 10000)
   For Each logEntry In Log
      'Debug.WriteLine(logEntry.LogTime & vbTab & logEntry.ClientIP & vbTab & logEntry.ClientUserName & vbTab & logEntry.DestHost & vbTab & logEntry.Rule & vbTab & logEntry.URL)

      If (logEntry.service = FpcLogServiceType.fpcLogServiceProxy Or _
    logEntry.service = FpcLogServiceType.fpcLogServiceReverseProxy)
Then

       Debug.WriteLine(logEntry.LogTime & vbTab & logEntry.ClientIP & vbTab & logEntry.DestHost & vbTab & logEntry.Operation & vbTab & logEntry.FWAction)
         If logEntry.ClientIP = "172.16.4.242" Then

          KillSession(logEntry.ClientIP)
         End If

     End If

   Next

Log.EndQuery()

End Sub







< Message edited by fixitchris -- 2.May2008 10:53:58 AM >

(in reply to david_reindorf)
Post #: 4
RE: Session Monitoring - 2.May2008 10:45:52 AM   
fixitchris

 

Posts: 148
Joined: 23.May2007
Status: offline
Here is the code to kill a session.
Here is what I found out:
1.  DisconnectSession only works on the SessionsMonitorFirewall and not SessionsMonitorWebProxy,
2.  ExecuteQuery runs fine 1st time, but it chokes 2nd time around after DisconnectSession is called.
3.   IPAddressFilter sometimes chokes.
4.   Interop sucks.
 
If you can figure out what the problem is , let me know.
 


quote:

Private Sub KillSession(ByVal IPadd As String)
'Sessions
Debug.WriteLine("fwmon startquery")
Dim monitors As FPCSessionsMonitors = Me.mIsaArray.SessionsMonitors
'Dim proxyMonitor As FPCSessionsMonitor = monitors.SessionsMonitorWebProxy
Dim firewallMonitor As FPCSessionsMonitor = monitors.SessionsMonitorFirewall
Dim session As FPCSessionsMonitorEntry
Dim filter As New FPCFilterExpressions
filter.FilterType = FpcFilterType.fpcSessionsFilter
'filter.AddIPAddressFilter(FpcFilterCriteria.fpcFilterByClientIP, FpcFilterCondition.fpcEqual, IPadd)
'filter.AddStringFilter(FpcFilterCriteria.fpcFilterByClientIP, FpcFilterCondition.fpcEqual, IPadd)

'proxyMonitor.ExecuteQuery(filter, 10000)
firewallMonitor.ExecuteQuery(filter, 5000)
'session = proxyMonitor.Item(1)
'proxyMonitor.DisconnectSession(session.ServerName, session.SessionID)
For Each session In firewallMonitor 'proxyMonitor
'Debug.WriteLine(session.ClientIP)
If session.ClientIP = IPadd And _
session.Event = FpcSessionMonitorEvent.fpcSessionFound
Then
'session.SessionType = FpcSessionType.fpcProxySession And _
firewallMonitor.DisconnectSession(session.ServerName, session.SessionID)
Debug.WriteLine(session.SessionID &
" killed.")
End If
Next
firewallMonitor.EndQuery()
firewallMonitor =
Nothing
Debug.WriteLine("fwmon endquery")
'proxyMonitor.EndQuery()
End Sub



< Message edited by fixitchris -- 2.May2008 10:48:47 AM >

(in reply to fixitchris)
Post #: 5
RE: Session Monitoring - 2.May2008 10:52:51 PM   
fixitchris

 

Posts: 148
Joined: 23.May2007
Status: offline
Check http://sync-io.net/Files/isa_monitor_Binary.zip
 
 
 
 
 

(in reply to fixitchris)
Post #: 6
RE: Session Monitoring - 12.Jul.2011 7:47:05 AM   
sadegh_top

 

Posts: 2
Joined: 3.Oct.2010
Status: offline
u can use FPLLogEntry::Get_Url()

(in reply to fixitchris)
Post #: 7
RE: Session Monitoring - 12.Jul.2011 7:51:08 AM   
sadegh_top

 

Posts: 2
Joined: 3.Oct.2010
Status: offline
i m writing C++ code and all the samples here is VB
my i ask you , in your code is any LEAK MEMORY in your do while
it happen in C++ and i dont know how to fix it

(in reply to sadegh_top)
Post #: 8

Page:   [1] << Older Topic    Newer Topic >>
All Forums >> [ISA 2006 Misc.] >> ISA 2006 Programming >> Session Monitoring Page: [1]
Jump to:

New Messages No New Messages
Hot Topic w/ New Messages Hot Topic w/o New Messages
Locked w/ New Messages Locked w/o New Messages
 Post New Thread
 Reply to Message
 Post New Poll
 Submit Vote
 Delete My Own Post
 Delete My Own Thread
 Rate Posts