Nowadays I'm evaluating the Webspy, too. I don't have any problems with the ISA2004 format but there some points that you have to be careful. Do you get any errors when you import the logs into Webspy ?
By me, I'm getting the date format error everytime and I have to dismiss this error before using the logs. And of course before importing the logs, you need to set your ISA box's logging method to w3c format.
I'm using Webspy as well, and made a workaround for this. I like to use the MMC log viewer to do ad-hoc queries in realtime, which is only available if you use MSDE or SQL.
So - I wrote a couple of scripts that connect to the ISA server, dump any new databases to text files, convert the BigINT fields to IP addresses and create a new ".webspy" file that it can read as a native ISA Server format.
I tried to email the scripts to you, but got the following bounce:
The following recipient(s) could not be reached:
firstname.lastname@example.org on 5/9/2005 10:32 AM A configuration error in the e-mail system caused the message to bounce between two servers or to be forwarded between two recipients. Contact your administrator. <mailgate.gfi.com #4.4.6>
the date format error is very common when importing from ISA. you can change this to be in line with your isa from the from properties tab when you start a storage or import data. or just select the checkbox ignore future errors when it pops up and you will not be informed again. It is not a real problem that you should be worried, it will be automatically corrected.
Izzet > we donĘt not currently report on the activity of your firewall so there is no point in loading the firewall log. We can give you all the information you require on users browsing etc from the proxy log file. (There is a new application scheduled for release from us this year that will read firewall logs and many other network devices called network analyser)
From: Rockford, MI
quote:Originally posted by tshinder: Hi Mark,
You bet! If you post it I'll include it in the next newsletter. If you send it to me at email@example.com, I'll post it for download and put it on the front page of the site as a news item.
Tom, was this ever posted? just curious ---
As well, if it wasnt. Mark if your reading can you post to a website or something for dl? At least temporary if Tom hasnt already? I use the MSDE method of logging, and am lookin for a way to analyze the logs in bulk format.
Sorry - haven't checked these forums in a while - Yes, Tom did get a copy of my scripts, and featured it in the May 2005 newsletter.
Minus the screenshot I included on changing MSDE to allow TCP/IP remote connections, here's the post:
Mark Nyquist comes to the rescue of ISA firewall admins everywhere with some great scripts that allow you to bring your ISA firewall's advanced logging information into text format. Let's let Mark explain them to you:
Glad to share - I've certainly gotten a lot of help from your site.
Background: I really like the live filtering features for log viewing that the ISA server MMC console provides. The problem is that most log analysis programs want text file output. So - since I didn't want to choose between good live diagnostic tools or good analytical programs, I wrote the attached scripts to be run nightly: ISADump.vbs and MSDEtoWebSpy.vbs.
Basically, the first script connects to the ISA server, finds all the ISA log databases, checks to see if a dump has already been made, and if not, dumps it as a text file with an .MSDE extension. The second script will go through the previously dumped .MSDE files, check to see if it's already done a conversion, and if not, parses through it to convert the BIGINT numbers to IP addresses, and puts it in a file format that WebSpy's "Microsoft ISA Server" filter can recognize. (This could more than likely be modified to convert to other formats as well.)
Note: MSDE does not allow remote TCP/IP connections by default. You need to run C:\Program Files\Microsoft SQL Server\80\Tools\Binn\SVRNETCN.exe and enable it before you can run these scripts from a remote machine. (Requires a SQL restart)