Export (0) Print
Expand All

Configuring Forefront TMG logs

This section provides information about configuring and maintaining logs, and running log queries.

  • Microsoft Forefront Threat Management Gateway provides a number of logging formats, including logging to a text file, a local SQL Server Express database, and a remote SQL Server computer. For information about selecting a logging mechanism, and configuring a log location and maintenance policy, see Configuring logging.
  • Because Forefront TMG is deployed to help secure your network, it is critical that logging information is always available and accurate. You should carefully monitor alerts and verify that their activity is always being logged. Check for alerts that indicate failure to log for a variety of reasons, including disk space, SQL Server connectivity issues, and others. For more information, see Configuring logging to avoid lockdown. Forefront TMG provides a log queue feature to help ensure log availability during peak logging. For more information, see Configuring the log queue.
  • You can configure and run log queries to monitor and analyze traffic. For instructions, see Querying the Forefront TMG logs.

The following table summarizes default log settings following installation:

Setting Details Defaults

Firewall log

Logs traffic handled by the Firewall service

Enabled by default to log to SQL 2005 Express database on the local computer.

Web proxy log

Logs traffic handled by the Web proxy filter

Enabled by default to log to SQL 2005 Express database on the local computer.

Log folder

Location of log files

By default in the ISALogs folder of the Forefront TMG installation directory

Log limits

Management of log file size

Default settings:

Total size limit=8GB

Free disk size to maintain=512MB

Maintenance method: Delete files as necessary

Delete files older than=7 days

Log queue

The log queue is used to temporarily store log entries when they cannot be formatted. This may occur when log entries are generated faster than they can be formatted, or there is no connectivity to a remote SQL Server database.

By default the log queue is stored in the ISALogs folder of the Forefront TMG installation folder.

Alerts

The alerts service notifies you when specific events occur.

All log-related alerts are enabled by default

Was this page helpful?
(1500 characters remaining)
Thank you for your feedback
Show:
© 2014 Microsoft