Searching for denied connections

[SFIH]

So, in the past with ISA you could set up a query for a machine and then watch the traffic for just that machine.

This was helpful as i'm using a white list and someone will ask for a site with other CDN sites that i need to open as well e.g. (hotmail.com may also need live.com, and microsoft.com etc.).

There is the "Activity" section under Monitoring but it's hard to watch for denied URL's when you have hundreds of users browsing and the list is jumping all around. Is there a better place to show just denied connections for a particular user? and if not what are people using to do this?

[Aaron Koolen-Bourke]

Hi there.

Unfortunately we don't have a way to filter just a user's traffic. However, if you are using a Professional license or greater you can turn on the rule-result and/or rule-name field for the W3C Usage logging for the proxy you are using. It is found under Control Panel::Logging in the Log Files tab. This will cause the rule result (Allow, Deny etc) to be logged as a column. You can then do a search for 'Deny'.

If you want some log analysis we tend to recommend ProxyInspector or Sawmill Log Analyser.

Regards
Aaron