You can customize alert definitions by enabling or disabling alerts, edit existing alerts, and create new alert definitions.

During Setup, alerts are preconfigured for all events, but you may want to define additional alerts. For example, consider the preconfigured alert definition for the Network configuration changed event. As the network administrator, you might want to refine this general alert, creating two unique alert definitions:

• An alert definition for when a network is disabled.
  
• An alert definition for when a network is enabled.
  

The alert definition for the former would trigger an action to run a batch file to disconnect the computer from a load balancing cluster each time a network becomes disabled. The alert definition for the latter might be to send you an e-mail message.

Alerts with specific events take precedence over less-specific events. For example, suppose you have two alerts configured, one for Any network configuration change and the other for Network connected. When a network is connected, the alert actions for the latter will be performed.

You create an alert definition using the New Alert Configuration Wizard. The following table summarizes the alert properties you specify in the wizard.

Property	Details
Alert name	Specify a unique name for the alert.
Events and Conditions	Specify an event that will trigger the alert. Some events allow you to specify an additional condition that must occur to trigger the alert. If an event and additional condition are configured, both must occur to trigger the alert.
Category and Severity	Select a category for the alert, as follows: Security Cache Routing Firewall service Network Load Balancing Other Select the severity of the alert: Error Warning Information
Actions	Specify the actions to be taken when the event is triggered.

You can define alerts to perform one or more of the following actions when triggered:

• Send an e-mail message.
  
• Run a specific action.
  
• Log the event in the Windows event log.
  
• Stop or start the Microsoft Firewall service or Scheduled Content Download service.
  

Alert action for sending an e-mail message

Alert action for running a program

Configuring actions for Alert Action Failure alert

After initial configuration of the new alert using the wizard, you can further refine settings in the property page of the alert. The following table summarizes the additional settings that can be configured on the property page of the alert.

Property	Details
Number of occurrences	Specify how many times in total the event should occur before the alert is triggered.
Number of events per second	Specify how many times the event will occur per second before the alert is triggered. If you specify a value in the number of occurrences and the number of events per second, both limits must be reached before the alert is reissued.
Immediately	Specify that the alert is triggered immediately each time the threshold is reached.
Only if the alert was manually reset	Specify that the alert is triggered again each time the threshold is reached only if it is manually reset.
If number of minutes since last execution is more than	Specify that the alert is triggered again each time the threshold is reached if it was last triggered before a specified number of minutes. Then specify the number of minutes.

All triggered alerts are displayed on the Alerts tab. The display shows the alert name, the time it occurred, the status, and the alert category: information, warning, and error. Information about each alert also appears in the Windows event log. You can perform the following tasks on alerts displayed in the tab:

• Set the refresh rate to specify an automatic refresh rate for alerts.
  
• Reset selected alerts. Resetting an alert effectively removes it from the Alerts tab.
  
• Acknowledge selected alerts. You can indicate that you are handling a specific event, or a group of events, by acknowledging the alerts. When you mark an alert (or group of alerts) as acknowledged, the status for those events is changed on the Alerts tab, and the alerts are no longer displayed on the Dashboard.
  

When the Microsoft ISA Server Control service (isactrl) is restarted or the ISA Server computer restarts, all alerts are automatically reset.

Predefined Trigger Limits

You can filter session information, and then save the resultant query for future use. You can also pause and stop session monitoring, and disconnect sessions.

Filtering Sessions

Pausing and Stopping Session Monitoring

Disconnecting Sessions

Connectivity verifiers are created using the New Connectivity Verifier Wizard. The settings you specify in the wizard are summarized in the following table.

Property	Details
Welcome page	Specify a unique name for the connectivity verifier.
Connectivity Verification Details page	Specify the following settings: The name, IP address, or URL of the server for which you want to verify the connection. Or browse to locate the server. The group in which you want to categorize the new connectivity verifier. The verification method you want to use to connect to the specified server. For example, if you select the Web (Internet) group, select to use the HTTP GET request. To verify that a specific application or service is running on the server, select from the predefined application list and predefined port number for the application, or select a custom port.

Note that if you select Send an HTTP "GET" request, a dialog box appears, informing you that a rule allowing HTTP or HTTPS to the specified destination must be configured. You can select to enable a default system policy rule: "Allow HTTP/HTTPS request from ISA Server to the selected servers for connectivity verifiers."

After running the New Connectivity Verifier Wizard, you can configure additional properties on the connectivity verifier properties, as follows:

• Enable or disable the connectivity verifier.
  
• Specify a time-out response threshold, which by default is 5,000 milliseconds. This setting specifies a time limit for the specified server to respond. By default, an alert will be triggered if the server does not response within the allocated limit.
  

Server Farm Connectivity Verifiers

Analyzing HTTP GET Responses

Log information can be stored in one of the following formats:

• Microsoft SQL Server 2000 Desktop Engine (MSDE 2000) database.
  
• SQL database
  
• Text file
  

The following table compares the logging formats, which are detailed in the following sections.

Format	Features
File	Sequential logging to a text file has the following features: Provides the best performance of all logging methods. Logging is local, with no network bandwidth consumption. Log size is limited to 2 gigabytes (GB). Log maintenance feature enforces log size and cleans out log, as appropriate. Log failure stops the Firewall service. You can filter and view logs in real time (online). Filtering and viewing of historical data (offline) is not supported. File logging performs approximately two disk accesses for 10 megabits. In Enterprise Edition, there is a central log for all array members.
MSDE	Logging to a local MSDE database provides the following features: Provides good performance. Logging is local, with no network bandwidth consumption. Log size is limited to 1.5 GB Log maintenance feature enforces log size and cleans out log, as appropriate. Log failure stops the Firewall service. Runs on the ISA Server computer. An MSDE instance can only be accessed locally. You can filter and view logs in real time (online) or for historical data (offline). Consumes more disk resources than text file logging. MSDE logging performs approximately two disk accesses for every megabit. In Enterprise Edition, there is a central log for all array members.
SQL	Logging to a remote SQL database provides the following features: Because logging is to a remote server, sufficient network bandwidth is required, preferably 1 GB connectivity between ISA Server and computers running SQL Server to accommodate the capacity of the log traffic. Network connections must utilize Internet Protocol security (IPsec) to secure the log records sent to the remote SQL database. With sufficient hardware, performance will be better than MSDE logging. No limit to log size. This is configured by the user, based on retention and maintenance policy. The database administrator is responsible for log maintenance. Log failure stops the Firewall service. Account used for logging must have permissions on the computer running SQL Server. Data is encrypted on the connection to the computer running SQL Server. SQL Server and ISA Server are mutually authenticated. You can filter and view logs in real time (online) or for historical data (offline). Logging performance depends on: Number of ISA Server computers logging. SQL Server settings. Bandwidth allocation. On the ISA Server firewall, SQL logging consumes CPU resources somewhere between those used by MSDE and file logging, and uses almost no disk input/output (I/O). In Enterprise Edition, there is a central log for all arrays in the enterprise.

ISA Server includes the MSSQL$MSFW service, which is an instance of the Microsoft SQL Server 2000 Desktop Engine (MSDE 2000) that can be used for logging. By default, ISA Server saves logging information in MSDE databases. Each database is stored in two files, an .mdf file and an .ldf file. For each log database, two files are created: ISALOG_yyyymmdd_xxx_nnn.mdf and ISALOG_yyyymmdd_xxx_nnn.ldf, where:

• yyyy represents the year that the log database refers to.
  
• mm represents the month that the log database refers to.
  
• dd represents the day that the log database refers to.
  
• xxx represents the type that the log database refers to. This can be one of the following:
  
• FWS. Represents the Firewall log.
  
• WEB. Represents the Web Proxy log.
  
• nnn is a counter that distinguishes between log databases that refer to the same day.
  

ISA Server keeps a buffer in memory for 30 seconds (or until there is a 10,000 buffer entry) before writing information to the MSDE log. This number is specified by the MSDENumberOfInsertsPerBatch property of the ISA Server FPCLogs COM object. We do not recommend reducing this buffer size. Note that Web proxy requests (HTTP GET) are only logged after the request is complete.

By default, MSDE logs are saved in the %ProgramFiles%\Microsoft ISA Server\ISALogs folder. Do not select a compressed drive as the logging directory. Saving logs to a compressed directory causes severe performance degradation for MSDE, which impacts the ISA Server firewall performance.

ISA Server creates new MSDE databases as follows:

• For each log, ISA Server creates a new database every day.
  
• In addition, ISA Server limits MSDE logs to 1.5 GB. When a log exceeds this limit, ISA Server automatically creates a new database.
  

ISA Server prepares log databases for the next day in advance. When you save logs to MSDE, a database that refers to the next day always exists.

MSDE logs can be viewed in the log viewer. This provides easy access to online information about network activity. The log viewer displays all the data as if it were in a single database. You can export the data displayed in the log viewer, to save MSDE data to a text file.

Note that the MSDE instance used by ISA Server has network protocols disabled, and you cannot connect to it remotely. You can only connect using a local SQL tool, for example Enterprise Manager, OSQL, ISQL.

You can save ISA Server logs to a text file, in one of the following formats:

• World Wide Web Consortium (W3C) format. W3C logs contain both data and directives, describing the version, date, and logged fields. Because the fields are described in the file, unselected fields are not logged. The tab character is used as a delimiter. Date and time are in Coordinated Universal Time (UTC).
  
• ISA Server format. ISA Server format contains only data with no directives. All fields are always logged. Unselected fields are logged with a dash, to indicate that they are empty. The comma character is used as a delimiter. The date and time fields are in local time as configured on the computer.
  

By default, log files are saved in the %ProgramFiles%\Microsoft ISA Server\ISALogs folder. We recommend that log files are stored on an NTFS partition. Using NTFS, you can compress the log files to decrease their size and reduce the amount of space they use. You may notice a decrease in performance when working with NTFS-compressed files. When you read from (access) a compressed file, Windows automatically decompresses it for you, and when you write to the file, Windows compresses it. This process may decrease your computer's performance.

ISA Server creates new databases as follows:

• For each log, ISA Server creates a new database every day.
  
• In addition, ISA Server limits text file logs to 2 GB. When a log exceeds this limit, ISA Server automatically creates a new database.
  

Logs should always be stored in a safe location with tightly controlled access.

By default, MSDE logs and text file logs are stored in the %ProgramFiles%\Microsoft ISA Server\ISALogs folder. You can specify an alternative log file location, including an environment variable such as %logDirectory%. If you specify a relative directory, the log is saved in the ISALogs folder, under the ISA Server installation folder. If you specify an absolute path, the actual log folder may be different on every server. If the specified folder does not exist, ISA Server will warn you that the specified location is not valid and will try to create the folder.

For any alternative logging folder, the Network Service account must have read permissions from the root partition and any parent folder for the folder. On the logging folder itself, the following permissions are required:

• Network Service: Full Control
  
• System: Full Control
  
• Administrators: Full Control
  

If you change the log folder location and do not set the correct permissions, event ID 11002: Microsoft Firewall service failed to start, may be issued in Event Viewer.

If you need to copy MSDE log files from one location to another, or to move the files to another server, you must first detach the database from the current server. You should never detach a database that is currently in use. One way to determine whether a database is in use is to verify that the date included in the file name is a past date or that a database with a higher number exists for the current date. Another way is to enter the following lines at command prompts:

OSQL -S computer_name \MSFW -E

sp_who2

go

This will list all MSDE databases that currently have open connections, and show which application and user has them locked or is using them.

To detach a database from a server, enter the following lines at command prompts:

OSQL -S computer_name \MSFW -E

sp_detach_db database_name

go

quit

You can save log information to an SQL database. This is useful for remote logging. Configuring SQL logging consists of configuring settings on the computer running SQL Server and in ISA Server, as follows:

• Create a separate database and tables for Web Proxy logging and Microsoft Firewall service logging on the computer running SQL Server. ISA Server contains two SQL scripts to create the tables. These scripts are located in the %Program Files%\Microsoft ISA Server folder. For the Microsoft Firewall service logs, open the Fwsrv.sql file. For Web Proxy logs, open the W3proxy.sql file. You modify the script to use an existing database or create a new one. Then configure application permissions so that SQL Server accepts the data connection from the ISA Server computer. If SQL Server and ISA Server are in the same domain, use Windows authentication. If they are in untrusted domains or a workgroup scenario, you must set up a SQL Server account.
  
• Configure ISA Server for Web Proxy logging and Firewall logging to the SQL database. You must specify the name of the computer running SQL Server to which the information will be logging, the port number to use (1433 by default), the name of the database, and authentication method and credentials.
  

Note the following when configuring SQL logging:

• The system policy rule named "Allow remote logging using NetBIOS to trusted servers" must be enabled to log to an SQL database. In the System Policy Editor, verify that the enabled setting is selected for the Remote Logging (SQL) system policy configuration group to enable this rule. This rule allows SQL access from the Local Host network to all computers on the Internal network. We recommend that you modify the system policy so that this rule applies only to the specific computer running SQL Server.
  
• For ISA Server 2006 Standard Edition, note the following:
  
• In previous versions of ISA Server Standard Edition, SQL logging used ODBC. ISA Server 2006 uses direct access.
  
• By default, ISA Server uses a Secure Sockets Layer (SSL)-encrypted connection to the computer running SQL Server, to help secure the sensitive data in the log files. To enable this connection, you must install a root certification authority (CA) certificate on the ISA Server computer. For more information, see "How to enable SSL encryption for SQL Server 2000 if you have a valid Certificate Server" at Microsoft Help and Support.
  
• We recommend that you use Ethernet cards for the Peripheral Component Interconnect (PCI) bus with transfer rates of at least 100 megabits per second for communication between the ISA Server computer and the computer running SQL Server.
  
• For ISA Server 2006 Enterprise Edition, note the following:
  
• When applicable, we recommend that you use Windows authentication. In a workgroup deployment, if you configure SQL logging for Windows authentication, you should specify a local user account. This account must exist on all array members and on the computer running SQL Server. The account should also have appropriate logon permissions specified in SQL Server Security.
  
• If you specify a non-default port for the computer running SQL Server, do the following: Create custom UDP and a TCP protocols for the specified port. Then create an access rule from the Local Host network to the network on which the computer running SQL Server is located, allowing use of the two protocols you created.
  
• You can configure data encryption on the properties of Firewall logging and Web Proxy logging when connecting to an SQL database. If you configure encryption when logging to an SQL database, you must install a certificate on the computer running SQL Server. Then, update the trusted root authority on each array member to trust the server certificate.
  
• By default, ISA Server uses an SSL-encrypted connection to the computer running SQL Server, to help secure the sensitive data in the log files. To enable this connection, you must install a root certification authority (CA) certificate on the array members.
  

You can use the ISA Server log viewer to monitor and analyze traffic, and troubleshoot network activity. By default, the log viewer displays all log records for the Web Proxy log and Firewall log in real time as they occur, with each event displayed in the log viewer as soon as it is logged. To display records with the default filter, click the Logging tab, and then on the Tasks tab, select Start Query.

You can modify the default filter conditions to display data that meets specific criteria in the log viewer. The viewer displays only log data if it matches all the expressions included in the filter. The filter expressions are combined using the logical AND operator. For example, you may want all log entries currently being logged for a specific IP address. To do this, you would edit the logging filter as follows:

• Set Client IP to the relevant IP address.
  
• Set Log Time to Live.
  

When you filter the log, you can select to view the Web Proxy log, the Firewall log, or both.

All log formats allow you to filter data by Log Time. For Text logs, you can only specify the Log Time with the Live value. This is known as online viewing, and displays real-time log data. MSDE logging and SQL logging allow you to specify the Log Time with other values. This allows you to display log data that was logged during a specific time period, and not just live data. This is known as offline viewing. When offline data is displayed, the log viewer actually queries the database.

When you create a filter, you specify a criterion, a condition, and a value. You select a field on which to filter the log, and then select a condition from one of the conditions available for the field. Then select a value. For some fields, predefined values may be available, or you can type a value. Some fields and conditions do not have values associated with them.

You cannot remove the entries in the default filter, but you can select the fields that appear in the default query and make changes to the values.

The following table summarizes the criteria on which you can filter logs.

Filter by	Condition	Values and description
Action (not applicable to Web Proxy log)	Equals Not Equals	The action performed by the Firewall service for the current connection or session. Possible values: Allowed Connection Closed Connection Closed VPN Connection Connection Status Denied Connection Failed Connection Attempt Failed VPN Connection Attempt Initiated Connection Quarantine Timeout User Cleared Quarantine
Authenticated Client (not applicable to Firewall log)	Equals Not Equals	Indicates whether the client has been authenticated with ISA Server. Possible values: No or Yes
Authentication Server	Contains Equals Not Contains Not Equals	Possible values: Text or numeric value
Bidirectional (not applicable to Web Proxy log)	Equals Not Equals	Indicates whether the traffic is send/receive. Possible values: No or Yes
Bytes Received	Greater or Equal Less or Equal	The number of bytes sent from the destination computer and received by the client during the current connection. A hyphen (-), a zero (0), or a negative number in this field indicates that this information was not provided by the destination computer or that no bytes were received from the destination computer. Possible values: Numeric value only
Bytes Sent	Greater or Equal Less or Equal	The number of bytes sent from the source client to the destination server during the current connection. A hyphen (-), a zero (0), or a negative number in this field indicates that this information was not provided by the destination computer or that no bytes were sent to the destination computer. Possible values: Numeric value only
Cache Information (not applicable to Firewall log)	Equals Not Equals	This number reflects the cache status of the object, which indicates why the object was or was not cached. This field applies only to the Web Proxy log. Possible values: For a table of possible values, see the "Cache Information Log Values" section in "ISA Server 2006 Logging Fields and Values" at the Microsoft TechNet Web site.
Client Agent	Contains Equals Not Contains Not Equals	The client application type sent by the client in the HTTP header.For Microsoft Firewall service, this field includes information about the client's operating system. Possible values: For more information, see the "Client Agent Log Values" section in "ISA Server 2006 Logging Fields and Values" at the Microsoft TechNet Web site.
Client Host Name	Contains Equals Not Contains Not Equals	The domain name for the local computer for the current connection. For the Web Proxy log, a hyphen (-) in this field may indicate that an object was retrieved from the cache and not from the destination. In the Firewall log, this field is reserved for future use. Possible values: Numeric or text value
Client IP	Equals Greater or Equal Less or Equal Not Equal	The IP address of the requesting client. Possible values: IP address format
Client Username	Contains Equals Not Contains Not Equals	The account of the user making the request. If ISA Server access control is not being used, ISA Server uses anonymous. Possible values: Numeric or text value
Destination Host Name	Contains Equals Not Contains Not Equals	The domain name for the remote computer that provides service to the current connection. For the Web Proxy log, a hyphen (-) in this field may indicate that an object was retrieved from the cache and not from the destination. Possible values: Numeric or text value
Destination IP	Equals Greater or Equal Less or Equal Not Equal	The network IP address for the remote computer that provides service to the current connection. For the Web Proxy log, a hyphen (-) in this field may indicate that an object was sourced from the cache and not from the destination. One exception is negative caching. In that case, this field indicates a destination IP address for which a negative-cached object was returned. Possible values: IP address format
Destination Network	Contains Equals Not Contains Not Equal	The network that provides service to the current connection. Possible values: Any defined network
Destination Port	Equals Not Equal	The reserved port number on the remote computer that provides service to the current connection. This is used by the client application initiating the request. Possible values: Numeric value
Destination Proxy	Contains Equals Not Contains Not Equal	The remote computer that provides service to the current connection. Possible values: Numeric or text value
Error Information (not applicable to Firewall log)	Equals Not Equals	Error information. Possible values: Numeric value
Filter Information	Contains Equals Not Contains Not Equal	This field includes information that a Web filter can log. For example, when the HTTP filter denies a request, the reason for the denial is stored here. Possible values: Blocked by HTTP Security filter Body contains sequences which are disallowed Query string length exceeded maximum allowed Request body length exceeded maximum allowed Sent verb is disallowed Sent verb is not specifically allowed The request contains a header which exceeds the maximum header length allowed The request contains a header which is not allowed The response contains a header which exceeds the maximum header The response contains a header which is not allowed The response content is encoded and cannot be scanned There are request headers which contain a disallowed sequence There are response headers which contain a disallowed sequence URL contains '.' in the path URL contains an extension which is disallowed URL contains an extension which is not specifically allowed URL contains high-bit characters URL contains sequences which are disallowed URL length exceeded maximum allowed URL normalization was not complete after one pass
GMT Log Time	On or After On or Before	Indicates Coordinated Universal Time (UTC), also known as Greenwich Mean Time (GMT), which is the log time date. Possible values: Select calendar date
HTTP Method	Contains Equals Not Contains Not Equals	Specifies the application method used. . Possible values that are common for the Web Proxy log: GET PUT POST HEAD Possible values that are common for the Firewall log: CONNECT BIND SEND RECEIVE GHBN (GetHostByName) GHBA (GetHostByAddress)
HTTP Status Code	Equals Not Equals	Specifies the HTTP status code. Possible values: Numeric value
Log Record Type	Equals	Specifies the log type to filter. Possible values: Firewall Web Proxy Filter Firewall or Web Proxy Filter
Log Time	Last 24 hours Last 30 days Last 7 days Last hour Live On or After On or Before	The time that the logged event occurred. Possible values: Live, for all logging except MSDE format MSDE, for all values If you select On or After, or On or Before, select dates from the calendar.
MIME Type (not applicable to Firewall log)	Contains Equals Not Contains Not Equals	The MIME type for the current object. This field may also contain a hyphen (-) to indicate that this field is not used or that a valid MIME type was not defined or supported by the remote computer. Possible values: Select from defined content types Content types are defined on the Toolbox tab, available from the Firewall Policy node in ISA Server Management.
Network Interface (not applicable to Web Proxy log)	Contains Equals Not Contains Not Equals	Primary IP address of the interface that received the traffic. Possible values: Numeric or text value
Object Source (not applicable to Firewall log)	Equals Not Equals	Indicates the source that was used to retrieve the current object. Possible values: Cache Internet Not Modified Not Verified Cache Upstream Verified Cache Verified Failed Internet
Original Client IP	Equals Greater or Equal Less or Equal Not Equal	The IP address of the client making the request. Possible values: IP address format
Processing Time (not applicable to Firewall log)	Greater or Equal Less or Equal	This indicates the total time, in milliseconds, that is needed by ISA Server to process the current connection. It measures elapsed server time from the time that the server first received the request to the time when final processing occurred on the server—when results were returned to the client and the connection was closed. For cache requests that were processed through Web Proxy, processing time measures the elapsed server time needed to fully process a client request and return an object from the server cache to the client. Possible values: Numeric value
Protocol	Contains Equals Not Contains Not Equals	Specifies the application protocol used for the connection. Common values are HTTP, FTP, and HTTPS. For the Firewall service, the port number is also logged. Possible values: Any protocol defined in ISA Server
Raw IP Header (not applicable to Web Proxy log)	Contains Equals Not Contains Not Equals	The Raw IP header information. Possible values: Numeric or text value
Raw Payload (not applicable to Web Proxy log)	Contains Equals Not Contains Not Equals	The raw data of the packet. Possible values: Numeric or text value
Referring Server	Contains Equals Not Contains Not Equals	If ISA Server is used upstream in a chained configuration, this indicates the server name of the downstream server that sent the request. Possible values: Numeric or text value
Result Code	Equals Not Equals	The result code numeric ID. Possible values: For more information, see the "Result Code Log Values" section in "ISA Server 2006 Logging Fields and Values" at the Microsoft TechNet Web site.
Rule	Contains Equals Not Contains Not Equals	This reflects the rule that either allowed or denied access to the request. Possible values: Select the rule
Server Name (not applicable to Firewall log)	Contains Equals Not Contains Not Equals	The name of the computer running ISA Server. This is the computer name that is assigned in Microsoft Windows Server 2003 or Windows 2000 Server Possible values: Select the server name
Service (not applicable to Firewall log)	Equals Not Equals	The type of request being logged. Possible values: Proxy, indicating outgoing Web request Reverse Proxy, indicating incoming Web requests (publishing)
Source Network	Contains Equals Not Contains Not Equals	The network from which the request originated. Possible values: Select a network
Source Port (not applicable to Web Proxy log)	Equals Not Equals	The port on which the requesting client makes the request. Possible values Numeric value
Source Proxy (not applicable to Web Proxy log)	Contains Equals Not Contains Not Equals	IP address representing the client computer. Possible values: Text or numeric value
Transport	Contains Equals Not Contains Not Equals	Specifies the transport protocol used for the connection. Possible values: ICMP TCP UDP
URL (not applicable to Firewall log)	Contains Equals Not Contains Not Equals	This field shows the contents of the URL request. Possible values: Text or numeric value

Note the following when filtering log views:

• Up to 10,000 results are displayed in the log viewer.
  
• ISA Server logs each request in the authentication process for a Web Proxy client. The destination IP address and port number are not logged for denied requests.
  
• Some log information, including IP data, Raw IP header, and Interface, is displayed only for stateless traffic that is not allowed for reasons other than a policy rule or application filter. For example, if traffic is dropped because it is considered spoofed, it is displayed.
  
• If no rule specifically allows the outgoing or incoming request, the rule name is logged as "Default Rule." This indicates the following:
  
• That the connection was denied but the denial was not due to access policy. For example:
  
• No network relationship is defined between the source and destination networks.
  
• Intrusion detection dropped the traffic as spoofed.
  
• The request is from a client that exceeded the maximum connection limits.
  
• That the connection was allowed implicitly, without a specific system policy rule or access rule to allow it. This can happen in a number of scenarios. For example, an application filter running on ISA Server may update its files from the Web, and open a connection to a Web server without a specific policy rule that allows the connection. In this case, the rule name field in the log will be empty, and not populated with "Default Rule".
  
• After you define a filter and run a query with it, you can save it as an .xml file for future use. It is often useful to have a set of queries, with each query used to focus on a different session type. You can then import saved filter query definitions as required.
  

Because ISA Server is deployed to secure your network, it is critical that logging information is always available and accurate. You should carefully monitor alerts and verify that their activity is always being logged. Check for alerts that indicate failure to log for a variety of reasons, including disk space, SQL Server connectivity issues, and others.

ISA Server summarizes the previous day's logs, and reports are based on these log summaries. Properly maintained logs help ensure that reports are accurate. For MSDE logging and text file logging, you can specify the following log maintenance settings:

• Limit total log file size. Specifies how many total gigabytes (GB) of disk space log files can use. Each log file is limited to 1.5 GB. When a log file reaches 1.5 GB, a new file is automatically created.
  
• Maintain free disk space. Specifies the minimum amount of disk space that must be kept free.
  
• Delete files older than a specified number of days
  

When these limits are reached, logs are maintained according to one or more of the following methods:

• Delete older log files as necessary. Specifies that when limits are reached, older files are deleted as newer files are saved.
  
• Discard new log entries. Specifies that when limits are reached, new entries will not be saved until limits are changed, or old files are deleted. An alert is issued to notify of this event.
  
• Delete log files older than. Specify how long log files are kept before being automatically deleted. To delete old files from storage, decrease this number.
  
• Compress log files. Specify that log files should be compressed to reduce disk space. Only available on NTFS partitions.
  

ISA Server checks that logs do not exceed the specified limits every 30 seconds. This means that for up to a period of 30 seconds, logs might exceed the limits. ISA Server automatically deletes logs in accordance with these settings. For accurate reporting, ensure that you allocate sufficient disk space to accommodate logs for at least a day or two. If you only configure space for less than a day, reports will be based on that portion of the day only. Note that each log component (Firewall and Web proxy) is maintained separately in accordance with settings. So for example, if the total log size for each component is set to 8 GB, then the maximum size of the combined log will be 16 GB.

SQL logs are maintained on the computer running SQL Server by the SQL Server administrator.

Attack Mitigation

You can customize content to include in a report. ISA Server provides the following predefined report types that you can use, or modify if required:

• Summary. A Summary content report includes summarized information about network traffic usage, sorted by application. These reports are most relevant to the network administrator or the person managing or planning a company's Internet connectivity.
  
• Web Usage. A Web Usage content report displays information about frequent Web users, common responses, and browsers. These reports are most relevant to the network administrator or the person managing or planning a company's Internet connectivity. It shows how the Web is being used in a company.
  
• Application Usage. An Application Usage content report illustrates Internet application usage information about top users, client applications, and destinations.
  
• Traffic and Utilization. A Traffic and Utilization content report shows total Internet usage by application, protocol, and direction. These reports also show average traffic and peak simultaneous connections, cache hit ratio, errors, and other statistics.
  
• Security. A Security content report lists attempts to breach network security.
  
• You can customize the different report types, and specify a sort order, with the following types of criteria.
  

Report criteria	Details	Report types
Top protocols	Limit report to a specific number of the most highly used protocols during the report period.	Summary report Application Usage report Web Usage report
Top users	Limit report to include a specific number of users who generated the most traffic.	Summary report Application Usage report Web Usage report
Top sites	Limit report to include a specific number of the top sites visited.	Summary report Web Usage report
Cache hit ratio	Include the ratio between the number of Web object requests and the number served from the cache.	Summary report Traffic and Utilization report
Object types	Limit report to include a specific number of the most frequently requested object types.	Web Usage report
Browsers	Limit report to include a specific number of the most frequently used client browsers.	Web Usage report
Operating systems	Limit report to include a specific number of the most frequently used client operating systems.	Web Usage report Application Usage report
Destinations	Limit report to include a specific number of the most frequently requested destinations in the client request.	Application Usage report
Client applications	Limit report to include a specific number of the client applications with the highest network traffic.	Application Usage report
Dropped packets	Limit report to include a specific number of the clients with the highest number of dropped packets.	Security report
Authorization failures	Limit report to include a specific number of the clients causing the highest number of authorization failures.	Security report

To generate a report, ISA Server runs the ISARepGen.exe application, installed with ISA Server. You can create the following reports from the log summaries:

• Generate a one-time report. You create a one-time report using the New Report Wizard. The report created will be run only once, when the wizard completes. To generate a one-time report, from the Monitoring node, click the Reports tab, and then on the Tasks tab, click Generate a New Report.
  
• Configure a recurring report. You can schedule automated reports on a daily, weekly, monthly, or yearly basis. You configure recurring reports using the New Report Job Wizard. You specify the period of activity that the report will cover, and when and how often the report is generated. To generate a recurring report job, from the Monitoring node, click the Reports tab, and then on the Tasks tab, click Create and Configure Report Jobs.
  

The following table summarizes the settings you specify when running the New Report Wizard to create a single one-time report, or when running the New Report Job Wizard to create a scheduled recurring report.

Property	Details	Report type
Report name	Specify name for report.	One-time report and recurring report
Report Content	Select content type. By default, all content types are selected.	One-time report and recurring report
Report Period	Specify a start date and end date for the report. Reports are based on log summaries created daily, so the end date specified in the report should be at least one day earlier than the current date.	One-time report only
Report Job Schedule	Specify when a recurring report runs: Daily Weekly You can specify multiple days of the week so that reports cover part of the week, or select a single day so that the report covers an entire week. Monthly Specify dates.	Recurring report only
Report Publishing	Specify a directory to which the report should be published, and credentials if required. The account specified must have write permissions to the specified folder.	One-time report and recurring report
Send E-mail Notification	Specify that an e-mail message should be sent to notify that a report has been generated. Configure the SMTP server, and the e-mail addresses of the sender and the recipients. You can specify that a link to the completed report should be included in the mail.	One-time report and recurring report

The following traffic is not included in reports generated by ISA Server:

• Traffic for which the Action field in the log equals Established or Allowed.
  
• Proxy authentication queries. This type of traffic is identified in the log as having the LogType field equal to Web Proxy and the destination either ms_proxy_intra_array_auth_query or ms_proxy_auth_query.
  
• Establishment and termination of virtual private network (VPN) sessions. This type of traffic is identified in the log as having the ClientAgent field equal VPN remote access or VPN remote site.
  
• (ISA Server 2006 Enterprise Edition only.) Traffic for which the Object source field in the log equals Member. When Cache Array Routing Protocol (CARP) is configured, each client Web request appears twice in the log. The first request is from the client to the first ISA Server computer. The second request is from the second ISA Server computer to the actual Web server.
  

Generating Reports in ISA Server 2006 Enterprise Edition

You can view a report by double-clicking the report name in ISA Server Management. The report is displayed in Microsoft Internet Explorer®. The report can be viewed only on the computer running ISA Server Management. On any other computer, the report shows either empty data, or a page with empty frames and a message that the "Page cannot be displayed."

Note the following about data displayed in the report:

• Requests are calculated only when the connection is terminated.
  
• Bytes are counted for every line in the log.
  

To make reports more readily available, you can publish them to a shared folder. The published reports are stored in a folder named Report_Job_Name_(Start date—End date). For example, if you publish the report job named DailyReports, scheduled to run from December 1, 2006 through December 15, 2006, the published reports folder will be named DailyReports_(12.1.2006—12.15.2006).

To view the report, double-click the file named report.htm located in the published folder. This has links to all the report types generated. Everyone who needs access to the reports should have Read permissions to this folder. In this way, others can view the reports without accessing the ISA Server computer and ISA Server Management. When a report is published, several report files and the associated graphics are saved to the specified published folder.

When you publish any report, the ISARepGen.exe process must have Write permissions to the publishing folder. You can configure the credentials that ISARepGen.exe uses to create reports.

By default, the Local System account is used. Note, however, that if you publish reports to a different computer, the Local System account credentials are actually passed as the (ISA Server) computer account. The computer account must have permissions to write to the network shared folder.

If ISA Server is installed in workgroup mode, ISARepGen.exe uses the Unauthenticated account. In this case, we recommend that you specify user credentials when publishing reports to another computer.