Session Monitoring (Full Version)

All Forums >> [ISA 2006 Misc.] >> ISA 2006 Programming



Message


david_reindorf -> Session Monitoring (29.Feb.2008 8:40:45 AM)

I can get the session and the client IP with the code at the bottom.
What I still need is to know what url the client is requesting in this session.

In FPCSessionsMonitorEntry is no such information.
But there is a SessionID. I guess I need to give this ID to somewhere to get
info about this.

FPCSessionsMonitors monitors = isaArray.SessionsMonitors;
FPCSessionsMonitor proxyMonitor = monitors.SessionsMonitorWebProxy;

while (true){
   proxyMonitor.ExecuteQuery(new FPCFilterExpressions(), 10000);
   foreach (FPCSessionsMonitorEntry session in proxyMonitor){
       Console.WriteLine(session.ClientIP);
   }
   proxyMonitor.EndQuery();
}




fixitchris -> RE: Session Monitoring (1.May2008 8:20:53 PM)

Any update on this?




david_reindorf -> RE: Session Monitoring (2.May2008 5:39:07 AM)

No. Still no clue.




fixitchris -> RE: Session Monitoring (2.May2008 10:39:25 AM)

It looks like a SESSION is a session between the client and ISA.  It has nothing to do with proxy connections from ISA to destination (eg. google.com).  You have to use the log viewer to see the live log content.
 

quote:



Public
Sub Monitor()
   'Logs

   Dim Log As FPCLogContent = Me.mIsaArray.LogViewer.LogContentOnline
   Dim logEntry As FPCLogEntry
   Dim LogFilter As FPCFilterExpressions = New FPCFilterExpressions
LogFilter.FilterType = FpcFilterType.fpcLogViewerFilter
Log.ExecuteQuery(LogFilter, 10000)
   For Each logEntry In Log
      'Debug.WriteLine(logEntry.LogTime & vbTab & logEntry.ClientIP & vbTab & logEntry.ClientUserName & vbTab & logEntry.DestHost & vbTab & logEntry.Rule & vbTab & logEntry.URL)

      If (logEntry.service = FpcLogServiceType.fpcLogServiceProxy Or _
    logEntry.service = FpcLogServiceType.fpcLogServiceReverseProxy)
Then

       Debug.WriteLine(logEntry.LogTime & vbTab & logEntry.ClientIP & vbTab & logEntry.DestHost & vbTab & logEntry.Operation & vbTab & logEntry.FWAction)
         If logEntry.ClientIP = "172.16.4.242" Then

          KillSession(logEntry.ClientIP)
         End If

     End If

   Next

Log.EndQuery()

End Sub









fixitchris -> RE: Session Monitoring (2.May2008 10:45:52 AM)

Here is the code to kill a session.
Here is what I found out:
1.  DisconnectSession only works on the SessionsMonitorFirewall and not SessionsMonitorWebProxy,
2.  ExecuteQuery runs fine 1st time, but it chokes 2nd time around after DisconnectSession is called.
3.   IPAddressFilter sometimes chokes.
4.   Interop sucks.
 
If you can figure out what the problem is , let me know.
 


quote:

Private Sub KillSession(ByVal IPadd As String)
'Sessions
Debug.WriteLine("fwmon startquery")
Dim monitors As FPCSessionsMonitors = Me.mIsaArray.SessionsMonitors
'Dim proxyMonitor As FPCSessionsMonitor = monitors.SessionsMonitorWebProxy
Dim firewallMonitor As FPCSessionsMonitor = monitors.SessionsMonitorFirewall
Dim session As FPCSessionsMonitorEntry
Dim filter As New FPCFilterExpressions
filter.FilterType = FpcFilterType.fpcSessionsFilter
'filter.AddIPAddressFilter(FpcFilterCriteria.fpcFilterByClientIP, FpcFilterCondition.fpcEqual, IPadd)
'filter.AddStringFilter(FpcFilterCriteria.fpcFilterByClientIP, FpcFilterCondition.fpcEqual, IPadd)

'proxyMonitor.ExecuteQuery(filter, 10000)
firewallMonitor.ExecuteQuery(filter, 5000)
'session = proxyMonitor.Item(1)
'proxyMonitor.DisconnectSession(session.ServerName, session.SessionID)
For Each session In firewallMonitor 'proxyMonitor
'Debug.WriteLine(session.ClientIP)
If session.ClientIP = IPadd And _
session.Event = FpcSessionMonitorEvent.fpcSessionFound
Then
'session.SessionType = FpcSessionType.fpcProxySession And _
firewallMonitor.DisconnectSession(session.ServerName, session.SessionID)
Debug.WriteLine(session.SessionID &
" killed.")
End If
Next
firewallMonitor.EndQuery()
firewallMonitor =
Nothing
Debug.WriteLine("fwmon endquery")
'proxyMonitor.EndQuery()
End Sub





fixitchris -> RE: Session Monitoring (2.May2008 10:52:51 PM)

Check http://sync-io.net/Files/isa_monitor_Binary.zip
 
 
 
 
 




sadegh_top -> RE: Session Monitoring (12.Jul.2011 7:47:05 AM)

u can use FPLLogEntry::Get_Url()




sadegh_top -> RE: Session Monitoring (12.Jul.2011 7:51:08 AM)

i m writing C++ code and all the samples here is VB
my i ask you , in your code is any LEAK MEMORY in your do while
it happen in C++ and i dont know how to fix it




Page: [1]