Everyone,
I am trying to
figure out how to generate reports with Reporting Module that include URL
information. Right now I can only generate reports with source and destination.
Destination is not as useful as URL since it only contains the IP address and
not the full URL. This is also a problem when you want to track which site
someone visited on a server hosting multiple sites from a single IP address.
The requested URL
for outgoing http connections is being logged in the info column in log viewer.
When a user enters www.checkpoint.com in their web browser, "reason: url is: www.checkpoint.com/" appears in
the info column in the log viewer. This tells me that the configuration is at
least close. The firewall is capturing and logging the full URL. Several
questions come to mind when looking at the log viewer results. Why doesn't the
URL get logged in the URL column? The Requested URL column?
Log Consolidator is
configured to store the URL up to full path. Log Consolidator does not appear to
be receiving any URL's from the firewall. I wonder if this is related to the
firewall logging the URL in the info column instead of the URL
column.
Any assistance would
be appreciated.
Thank
You,
Kevin Palmer
Network Engineer - MCSE+I, CCSE, CCNA
Granite Solutions, Inc.
P: (877)
755-4455
P: (616) 324-8231 x26
F: (616) 324-5240
http://www.gsite.com
